chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-27 05:04:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
633 Commits 2 Branches 1 Tag 176 MiB
063667c0b7
Commit Graph

2 Commits

Author SHA1 Message Date
chrisfu
063667c0b7 fix(gitea-spnego): upgrade probes tcpSocket→httpGet; halve memory limits 
Go proxy exposes /_healthz so use httpGet probes (tcpSocket was only a
connectivity check, not a health check). Also reduce memory request/limit
to 32Mi/64Mi — the Go binary is lean and in-cluster load is minimal.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-08 11:35:01 -07:00
chrisfu
2a2b16d0fa feat(gitea): add Kerberos SPNEGO proxy for git.prole.org SSO 
Deploys an Apache + mod_auth_gssapi sidecar in the gitea namespace that
handles SPNEGO/Kerberos negotiation (HTTP/git.prole.org@PROLE.ORG) and
injects X-WEBAUTH-USER for Gitea reverse-proxy auto-login.

Identity chain:
  Browser → Traefik TLS → Kong → gitea-spnego-proxy:4000
    → GSSAPI negotiate → X-WEBAUTH-USER: <username>
    → gitea-http:3000 (reverse proxy auto-registration)

Changes:
- gitea-spnego-proxy.yaml: krb5.conf ConfigMap + Deployment + Service
- gitea/spnego-proxy/: Dockerfile and Apache vhost (build source)
- kong-configmap.yaml: route git.prole.org → gitea-spnego-proxy:4000

Gitea reverse proxy settings applied via helm upgrade:
  ENABLE_REVERSE_PROXY_AUTHENTICATION=true
  ENABLE_REVERSE_PROXY_AUTO_REGISTRATION=true
  REVERSE_PROXY_AUTHENTICATION_USER_HEADER=X-WEBAUTH-USER

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-08 02:53:05 -07:00