mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 14:04:31 +00:00
2a2b16d0fa
Deploys an Apache + mod_auth_gssapi sidecar in the gitea namespace that handles SPNEGO/Kerberos negotiation (HTTP/git.prole.org@PROLE.ORG) and injects X-WEBAUTH-USER for Gitea reverse-proxy auto-login. Identity chain: Browser → Traefik TLS → Kong → gitea-spnego-proxy:4000 → GSSAPI negotiate → X-WEBAUTH-USER: <username> → gitea-http:3000 (reverse proxy auto-registration) Changes: - gitea-spnego-proxy.yaml: krb5.conf ConfigMap + Deployment + Service - gitea/spnego-proxy/: Dockerfile and Apache vhost (build source) - kong-configmap.yaml: route git.prole.org → gitea-spnego-proxy:4000 Gitea reverse proxy settings applied via helm upgrade: ENABLE_REVERSE_PROXY_AUTHENTICATION=true ENABLE_REVERSE_PROXY_AUTO_REGISTRATION=true REVERSE_PROXY_AUTHENTICATION_USER_HEADER=X-WEBAUTH-USER Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
36 lines
1.1 KiB
Plaintext
36 lines
1.1 KiB
Plaintext
Listen 4000
|
|
|
|
<VirtualHost *:4000>
|
|
ServerName git.prole.org
|
|
|
|
LogLevel info
|
|
ErrorLog /proc/self/fd/2
|
|
CustomLog /proc/self/fd/1 combined
|
|
|
|
# Health check endpoint — no auth required (used by k8s probes)
|
|
<Location /_healthz>
|
|
AuthType None
|
|
Require all granted
|
|
</Location>
|
|
|
|
# GSSAPI/SPNEGO — all other paths require a valid Kerberos ticket
|
|
# Keytab contains HTTP/git.prole.org@PROLE.ORG (stored as gitea-krb5-keytab secret)
|
|
<Location />
|
|
AuthType GSSAPI
|
|
AuthName "Kerberos - PROLE.ORG"
|
|
GssapiCredStore keytab:/etc/krb5/http.keytab
|
|
GssapiLocalName on
|
|
Require valid-user
|
|
|
|
# Inject bare username into X-WEBAUTH-USER for Gitea reverse proxy login.
|
|
# Strip the @REALM suffix if GssapiLocalName didn't resolve it.
|
|
RequestHeader set X-WEBAUTH-USER "%{REMOTE_USER}e"
|
|
RequestHeader edit X-WEBAUTH-USER "@.*$" ""
|
|
</Location>
|
|
|
|
ProxyPreserveHost On
|
|
ProxyPass /_healthz !
|
|
ProxyPass / http://gitea-http.gitea.svc.cluster.local:3000/
|
|
ProxyPassReverse / http://gitea-http.gitea.svc.cluster.local:3000/
|
|
</VirtualHost>
|