chrisfu
|
2a2b16d0fa
|
feat(gitea): add Kerberos SPNEGO proxy for git.prole.org SSO
Deploys an Apache + mod_auth_gssapi sidecar in the gitea namespace that
handles SPNEGO/Kerberos negotiation (HTTP/git.prole.org@PROLE.ORG) and
injects X-WEBAUTH-USER for Gitea reverse-proxy auto-login.
Identity chain:
Browser → Traefik TLS → Kong → gitea-spnego-proxy:4000
→ GSSAPI negotiate → X-WEBAUTH-USER: <username>
→ gitea-http:3000 (reverse proxy auto-registration)
Changes:
- gitea-spnego-proxy.yaml: krb5.conf ConfigMap + Deployment + Service
- gitea/spnego-proxy/: Dockerfile and Apache vhost (build source)
- kong-configmap.yaml: route git.prole.org → gitea-spnego-proxy:4000
Gitea reverse proxy settings applied via helm upgrade:
ENABLE_REVERSE_PROXY_AUTHENTICATION=true
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION=true
REVERSE_PROXY_AUTHENTICATION_USER_HEADER=X-WEBAUTH-USER
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-05-08 02:53:05 -07:00 |
|