chrisfu bb71cf68ea feat(auth): dual IdP for db.prole.org — Google OAuth + Kerberos SPNEGO ... knoe-auth (Spring Boot OIDC provider): - AuthProperties: add google.workspaceDomain and kerberos.servicePrincipal fields - GoogleOAuthService: validate hd (hosted domain) claim; restrict to configured workspace - LoginController: /login/google endpoint + SPNEGO negotiation entry point - PrincipalNormalizer: map Kerberos principal (user@REALM) to knoe-auth user - application.yml: add spring.security.kerberos and oauth2.client stubs (values injected at runtime from env / Kubernetes Secrets) - knoe-auth-deployment.yaml: mount HTTP keytab Secret; add GOOGLE_PROLE_CLIENT_ID / GOOGLE_PROLE_CLIENT_SECRET env from oauth2-proxy-prole-secret - knoe-auth-http-keytab-secret.example.yaml: example Secret for HTTP/<host> keytab Kong (init_kong.sh): - Add db.prole.org route in k3s mode block via oauth2-proxy upstream - Mode-gate: only registered for k3s, excluded for k3d/k8s Supabase / oauth2-proxy: - New supabase/helm/oauth2-proxy Helm chart: gates Supabase Studio at db.prole.org with Google OAuth (email-domain=prole.org) + cookie settings for .prole.org domain - values-k3s.yaml: k3s-specific overrides (upstream service, TLS, cookie domain) - secret-example.yaml: placeholder for oauth2-proxy-prole-secret Ansible: - infrastructure/playbooks/kerberos_trust_setup.yml: automates samba-tool domain trust create on myrddin.prole.org for PROLE.LOCAL ↔ PROLE.ORG cross-realm trust Test: - GoogleLoginProleOrgTest: verifies hd=prole.org tokens are accepted; hd=other.com rejected Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-05-03 20:03:09 -07:00
..
k3s	feat(auth): dual IdP for db.prole.org — Google OAuth + Kerberos SPNEGO	2026-05-03 20:03:09 -07:00
k8s/manifests	feat(oauth): add Google OIDC/OAuth2 Proxy support for Studio and Grafana. Add Google OIDC configuration for Grafana in gke.cfg, introduce oauth2-proxy templates and configurations for Supabase Studio, update Helm values/templates for authenticated Studio access, and add ingress/service manifests for Postgres TCP and Prole services.	2026-04-28 11:27:34 -07:00
prod	Complete rebranding from prole to knoe and fix macOS application identity. Bulk renamed 'prole' to 'knoe' across code, scripts, and manifests. Updated Makefile with 'knoe', 'build', and 'start' targets. Implemented macOS Application Bundle (.app) support for correct identity. Fixed macOS 'Python' process name to 'Knoe.DB Installer' via Objective-C bridge. Standardized application name to 'Knoe.DB Installer' across all interfaces.	2026-04-22 15:08:35 -07:00