chrisfu
5cfd24cd05
fix(auth): fix gitea krb5.conf KDC hostname: knoe-auth→auth
...
KDC Service is 'auth' (ports 88/749); 'knoe-auth' only exposes HTTP port 8080.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-08 12:18:22 -07:00
chrisfu
063667c0b7
fix(gitea-spnego): upgrade probes tcpSocket→httpGet; halve memory limits
...
Go proxy exposes /_healthz so use httpGet probes (tcpSocket was only a
connectivity check, not a health check). Also reduce memory request/limit
to 32Mi/64Mi — the Go binary is lean and in-cluster load is minimal.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-08 11:35:01 -07:00
chrisfu
2a2b16d0fa
feat(gitea): add Kerberos SPNEGO proxy for git.prole.org SSO
...
Deploys an Apache + mod_auth_gssapi sidecar in the gitea namespace that
handles SPNEGO/Kerberos negotiation (HTTP/git.prole.org@PROLE.ORG ) and
injects X-WEBAUTH-USER for Gitea reverse-proxy auto-login.
Identity chain:
Browser → Traefik TLS → Kong → gitea-spnego-proxy:4000
→ GSSAPI negotiate → X-WEBAUTH-USER: <username>
→ gitea-http:3000 (reverse proxy auto-registration)
Changes:
- gitea-spnego-proxy.yaml: krb5.conf ConfigMap + Deployment + Service
- gitea/spnego-proxy/: Dockerfile and Apache vhost (build source)
- kong-configmap.yaml: route git.prole.org → gitea-spnego-proxy:4000
Gitea reverse proxy settings applied via helm upgrade:
ENABLE_REVERSE_PROXY_AUTHENTICATION=true
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION=true
REVERSE_PROXY_AUTHENTICATION_USER_HEADER=X-WEBAUTH-USER
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-08 02:53:05 -07:00
