# gitea-spnego-proxy.yaml
# Apache + mod_auth_gssapi sidecar that handles SPNEGO/Kerberos negotiation for
# git.prole.org. Sits between Kong and Gitea; injects X-WEBAUTH-USER for reverse
# proxy auto-login.  Gitea remains on port 3000 (cluster-internal); this proxy
# listens on port 4000 and is the Kong upstream target.
#
# Identity chain:
#   Browser → Traefik TLS → Kong → gitea-spnego-proxy:4000
#     → GSSAPI (HTTP/git.prole.org@PROLE.ORG keytab)
#     → X-WEBAUTH-USER: <username>
#     → gitea-http.gitea:3000
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: gitea-krb5-conf
  namespace: gitea
data:
  krb5.conf: |
    [libdefaults]
        default_realm = PROLE.ORG
        dns_lookup_realm = false
        dns_lookup_kdc = false
        forwardable = true
        renewable = true
        rdns = false

    [realms]
        PROLE.ORG = {
            kdc = prole-kerberos-ad-dc.knoe-system.svc.cluster.local:88
            admin_server = prole-kerberos-ad-dc.knoe-system.svc.cluster.local:88
        }
        KNOE.LOCAL = {
            kdc = auth.knoe-system.svc.cluster.local:88
            admin_server = auth.knoe-system.svc.cluster.local:749
        }

    [domain_realm]
        .prole.org = PROLE.ORG
        prole.org = PROLE.ORG
        .prole.local = KNOE.LOCAL
        prole.local = KNOE.LOCAL
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea-spnego-proxy
  namespace: gitea
  labels:
    app: gitea-spnego-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitea-spnego-proxy
  template:
    metadata:
      labels:
        app: gitea-spnego-proxy
    spec:
      nodeSelector:
        kubernetes.io/hostname: gandalf.prole.org
      containers:
        - name: proxy
          image: myrddin.prole.org:5000/gitea-spnego-proxy:latest
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 4000
              protocol: TCP
          env:
            - name: KRB5_CONFIG
              value: /etc/krb5.conf
            - name: KRB5_KTNAME
              value: /etc/krb5/http.keytab
          volumeMounts:
            - name: keytab
              mountPath: /etc/krb5
              readOnly: true
            - name: krb5-conf
              mountPath: /etc/krb5.conf
              subPath: krb5.conf
              readOnly: true
          livenessProbe:
            httpGet:
              path: /_healthz
              port: 4000
            initialDelaySeconds: 10
            periodSeconds: 30
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /_healthz
              port: 4000
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              cpu: 200m
              memory: 64Mi
      volumes:
        - name: keytab
          secret:
            secretName: gitea-krb5-keytab
            defaultMode: 0400
        - name: krb5-conf
          configMap:
            name: gitea-krb5-conf
---
apiVersion: v1
kind: Service
metadata:
  name: gitea-spnego-proxy
  namespace: gitea
  labels:
    app: gitea-spnego-proxy
spec:
  selector:
    app: gitea-spnego-proxy
  ports:
    - name: http
      port: 4000
      targetPort: 4000
      protocol: TCP
  type: ClusterIP