chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-27 05:14:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
636 Commits 2 Branches 1 Tag 176 MiB
5b30c2c5b2
Commit Graph

3 Commits

Author SHA1 Message Date
chrisfu
5b30c2c5b2 fix(spnego-proxy): add statusCapture to log SPNEGO auth failures 
gokrb5 returns 401 silently on invalid tickets. Wrap ResponseWriter to
capture status code and log failures with remote addr, host, path, and
first 20 chars of the Negotiate token for easier debugging.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-08 21:43:20 -07:00
chrisfu
83a9a44c74 refactor(gitea): replace Apache SPNEGO proxy with Go-based proxy 2026-05-08 03:30:36 -07:00
chrisfu
2a2b16d0fa feat(gitea): add Kerberos SPNEGO proxy for git.prole.org SSO 
Deploys an Apache + mod_auth_gssapi sidecar in the gitea namespace that
handles SPNEGO/Kerberos negotiation (HTTP/git.prole.org@PROLE.ORG) and
injects X-WEBAUTH-USER for Gitea reverse-proxy auto-login.

Identity chain:
  Browser → Traefik TLS → Kong → gitea-spnego-proxy:4000
    → GSSAPI negotiate → X-WEBAUTH-USER: <username>
    → gitea-http:3000 (reverse proxy auto-registration)

Changes:
- gitea-spnego-proxy.yaml: krb5.conf ConfigMap + Deployment + Service
- gitea/spnego-proxy/: Dockerfile and Apache vhost (build source)
- kong-configmap.yaml: route git.prole.org → gitea-spnego-proxy:4000

Gitea reverse proxy settings applied via helm upgrade:
  ENABLE_REVERSE_PROXY_AUTHENTICATION=true
  ENABLE_REVERSE_PROXY_AUTO_REGISTRATION=true
  REVERSE_PROXY_AUTHENTICATION_USER_HEADER=X-WEBAUTH-USER

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-08 02:53:05 -07:00