mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 12:03:59 +00:00
bb71cf68ea
knoe-auth (Spring Boot OIDC provider): - AuthProperties: add google.workspaceDomain and kerberos.servicePrincipal fields - GoogleOAuthService: validate hd (hosted domain) claim; restrict to configured workspace - LoginController: /login/google endpoint + SPNEGO negotiation entry point - PrincipalNormalizer: map Kerberos principal (user@REALM) to knoe-auth user - application.yml: add spring.security.kerberos and oauth2.client stubs (values injected at runtime from env / Kubernetes Secrets) - knoe-auth-deployment.yaml: mount HTTP keytab Secret; add GOOGLE_PROLE_CLIENT_ID / GOOGLE_PROLE_CLIENT_SECRET env from oauth2-proxy-prole-secret - knoe-auth-http-keytab-secret.example.yaml: example Secret for HTTP/<host> keytab Kong (init_kong.sh): - Add db.prole.org route in k3s mode block via oauth2-proxy upstream - Mode-gate: only registered for k3s, excluded for k3d/k8s Supabase / oauth2-proxy: - New supabase/helm/oauth2-proxy Helm chart: gates Supabase Studio at db.prole.org with Google OAuth (email-domain=prole.org) + cookie settings for .prole.org domain - values-k3s.yaml: k3s-specific overrides (upstream service, TLS, cookie domain) - secret-example.yaml: placeholder for oauth2-proxy-prole-secret Ansible: - infrastructure/playbooks/kerberos_trust_setup.yml: automates samba-tool domain trust create on myrddin.prole.org for PROLE.LOCAL ↔ PROLE.ORG cross-realm trust Test: - GoogleLoginProleOrgTest: verifies hd=prole.org tokens are accepted; hd=other.com rejected Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
74 lines
2.1 KiB
YAML
74 lines
2.1 KiB
YAML
# oauth2-proxy values for the prole.org k3s homelab cluster.
|
|
#
|
|
# Gates Supabase Studio at db.prole.org behind Google OAuth.
|
|
# Restricts access to @prole.org Workspace accounts.
|
|
# Credentials are read from Kubernetes Secret oauth2-proxy-prole-secret
|
|
# (keys: client-id, client-secret, cookie-secret) — never hardcoded here.
|
|
#
|
|
# Deploy:
|
|
# kubectl create secret generic oauth2-proxy-prole-secret \
|
|
# --namespace supabase \
|
|
# --from-literal=client-id="<from Google Cloud Console>" \
|
|
# --from-literal=client-secret="<from Google Cloud Console>" \
|
|
# --from-literal=cookie-secret="$(openssl rand -base64 32 | tr -- '+/' '-_')"
|
|
#
|
|
# helm upgrade --install oauth2-proxy ./supabase/helm/oauth2-proxy \
|
|
# --namespace supabase \
|
|
# --values ./supabase/helm/oauth2-proxy/values-k3s.yaml
|
|
|
|
replicaCount: 1
|
|
|
|
image:
|
|
repository: quay.io/oauth2-proxy/oauth2-proxy
|
|
tag: v7.15.2
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Kubernetes Secret containing OAuth2 credentials.
|
|
# Keys must be: client-id, client-secret, cookie-secret
|
|
# Real values: Google Cloud Console → APIs & Services → Credentials
|
|
# Project: prole.org, OAuth 2.0 client for "Supabase Studio"
|
|
credentialsSecret:
|
|
name: oauth2-proxy-prole-secret
|
|
|
|
provider:
|
|
# Use Google OAuth directly (not OIDC broker) for prole.org Workspace.
|
|
name: google
|
|
oidcIssuerUrl: https://accounts.google.com
|
|
# Restrict to prole.org Google Workspace accounts only.
|
|
emailDomain: prole.org
|
|
|
|
redirect:
|
|
url: https://db.prole.org/oauth2/callback
|
|
|
|
# Upstream: Supabase Studio service in the supabase namespace.
|
|
upstream: http://supabase-studio.supabase.svc.cluster.local:3000
|
|
|
|
cookie:
|
|
secure: true
|
|
domain: .prole.org
|
|
name: _knoe_oauth2
|
|
|
|
# Pass authenticated identity headers to the upstream.
|
|
headers:
|
|
setXAuthRequest: true
|
|
passAccessToken: true
|
|
|
|
# Bypass Google auth for Supabase API surfaces — Kong's key-auth enforces
|
|
# anon/service-role keys on these paths.
|
|
skipAuthRoutes:
|
|
- ^/(auth|rest|realtime|storage|functions|graphql)/v1/.*
|
|
- ^/pg/.*
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|
|
targetPort: 4180
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 100m
|
|
memory: 128Mi
|