mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 12:03:59 +00:00
3f96f66a78
Rewrites (updated for knoe namespace, GKE support, and current service configs): init_gitlab.sh, init_kong.sh, init_cnpg_backup.sh, init_monitoring.sh, init_garage_store.sh, init_gitea.sh, init_kdc.sh, init_openbao.sh, init_argocd.sh, init_certmgr.sh, init_common_services.sh, init_db_manager.sh, init_forgejo.sh, init_k3s_registry.sh, init_kerberos.sh, init_nginx_ingress.sh, init_port_forwards.sh, init_registry.sh, init_service_layer.sh Deleted: init_cloudnative_pg.sh (superseded by init_cnpg_gke.sh) New scripts: init_cnpg_gke.sh — CNPG setup for GKE with Workload Identity init_knoe_auth.sh — knoe-auth OIDC service init init_knoe_users.sh — user provisioning init_redis.sh — Redis init init_oauth2_proxy.sh / init_oauth2_proxy_prole.sh — OAuth2 proxy setup init_grafana_oauth.sh / init_grafana_oauth_prole.sh — Grafana OAuth wiring init_1password.sh — 1Password Connect init init_min.sh — minimal bootstrap Co-authored-by: Junie <junie@jetbrains.com>
128 lines
5.3 KiB
Bash
Executable File
128 lines
5.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# init_oauth2_proxy.sh
|
|
#
|
|
# Bootstrap the oauth2-proxy gate in front of Supabase Studio at
|
|
# db.0.knoe.dev. Gates access via Google Workspace OIDC (knoey.com) so any
|
|
# @knoey.com identity (chrisfu, ron) can sign in and share the Studio
|
|
# session. Outside-domain users are rejected at this layer.
|
|
#
|
|
# Usage:
|
|
# ./etc/init_oauth2_proxy.sh
|
|
#
|
|
# Env vars (resolved from etc/secrets/* if not set in the shell):
|
|
# OAUTH2_PROXY_CLIENT_ID ← from etc/secrets/oauth2-proxy-client-id
|
|
# OAUTH2_PROXY_CLIENT_SECRET ← from etc/secrets/oauth2-proxy-client-secret
|
|
# OAUTH2_PROXY_COOKIE_SECRET ← from etc/secrets/oauth2-proxy-cookie-secret
|
|
#
|
|
# Optional:
|
|
# APP_CLUSTER_KUBECONTEXT (default: $KUBECONTEXT then ambient)
|
|
# NAMESPACE (default: supabase)
|
|
#
|
|
# Pre-reqs:
|
|
# - OAuth 2.0 client created at GCP Console (see the secret template
|
|
# deploy/gcp/gke/oauth2-proxy-google-oidc-secret.example.yaml for the
|
|
# exact authorized redirect URI + consent screen settings).
|
|
# - cookie_secret generated with: openssl rand -base64 32
|
|
# - Three values saved into etc/secrets/oauth2-proxy-{client-id,client-secret,cookie-secret}
|
|
# (chmod 0600 each; etc/secrets/ is gitignored except for .keep).
|
|
#
|
|
# After this script runs and the oauth2-proxy Deployment is Ready, two
|
|
# manual steps complete the wiring (NOT done by this script — see the plan
|
|
# in docs/plans/ for the full sequence):
|
|
#
|
|
# 1. Patch the supabase-kong Ingress to route db.0.knoe.dev through
|
|
# oauth2-proxy:80 instead of supabase-kong:8000:
|
|
#
|
|
# kubectl --context=$APP_CLUSTER_KUBECONTEXT -n supabase patch ingress \
|
|
# supabase-kong --type=json -p '[
|
|
# {"op": "replace",
|
|
# "path": "/spec/rules/1/http/paths/0/backend/service/name",
|
|
# "value": "oauth2-proxy"},
|
|
# {"op": "replace",
|
|
# "path": "/spec/rules/1/http/paths/0/backend/service/port/number",
|
|
# "value": 80}
|
|
# ]'
|
|
# (verify the index by checking which rule has host=db.0.knoe.dev first;
|
|
# index may shift on future Helm reconciles)
|
|
#
|
|
# 2. Remove the basic-auth plugin from the dashboard route in the
|
|
# supabase-kong configmap (oauth2-proxy is the gate now; double-auth is
|
|
# friction). Then rollout-restart supabase-kong.
|
|
#
|
|
# When knoe-auth Round 1 ships an OIDC OP at https://api.knoe.dev/auth, change
|
|
# `--provider=google` to `--provider=oidc --oidc-issuer-url=https://api.knoe.dev/auth`
|
|
# in deploy/gcp/gke/oauth2-proxy-deployment.yaml and re-run this script.
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
GKE_MANIFEST_DIR="$REPO_ROOT/deploy/gcp/gke"
|
|
|
|
NAMESPACE="${NAMESPACE:-supabase}"
|
|
KCTX="${APP_CLUSTER_KUBECONTEXT:-${KUBECONTEXT:-}}"
|
|
|
|
if [[ -n "$KCTX" ]]; then
|
|
KCTX_FLAG=(--context="$KCTX")
|
|
else
|
|
KCTX_FLAG=()
|
|
fi
|
|
|
|
log() { printf "[%s] %s\n" "$(date +%H:%M:%S)" "$*"; }
|
|
die() { log "ERROR: $*" >&2; exit 1; }
|
|
|
|
resolve_secret() {
|
|
# Resolve a value from env (preferred) or etc/secrets/<file>.
|
|
local var="$1" file="$2" val="${!1:-}"
|
|
if [[ -z "$val" && -f "$REPO_ROOT/etc/secrets/$file" ]]; then
|
|
val="$(cat "$REPO_ROOT/etc/secrets/$file")"
|
|
fi
|
|
if [[ -z "$val" ]]; then
|
|
die "missing $var (set the env var, or save the value into etc/secrets/$file)"
|
|
fi
|
|
printf '%s' "$val"
|
|
}
|
|
|
|
for tool in kubectl envsubst; do
|
|
command -v "$tool" >/dev/null 2>&1 || die "required tool not found: $tool"
|
|
done
|
|
|
|
OAUTH2_PROXY_CLIENT_ID="$(resolve_secret OAUTH2_PROXY_CLIENT_ID oauth2-proxy-client-id)"
|
|
OAUTH2_PROXY_CLIENT_SECRET="$(resolve_secret OAUTH2_PROXY_CLIENT_SECRET oauth2-proxy-client-secret)"
|
|
OAUTH2_PROXY_COOKIE_SECRET="$(resolve_secret OAUTH2_PROXY_COOKIE_SECRET oauth2-proxy-cookie-secret)"
|
|
export OAUTH2_PROXY_CLIENT_ID OAUTH2_PROXY_CLIENT_SECRET OAUTH2_PROXY_COOKIE_SECRET
|
|
|
|
SECRET_TMPL="$GKE_MANIFEST_DIR/oauth2-proxy-google-oidc-secret.example.yaml"
|
|
DEPLOY_MANIFEST="$GKE_MANIFEST_DIR/oauth2-proxy-deployment.yaml"
|
|
|
|
[[ -f "$SECRET_TMPL" ]] || die "missing manifest: $SECRET_TMPL"
|
|
[[ -f "$DEPLOY_MANIFEST" ]] || die "missing manifest: $DEPLOY_MANIFEST"
|
|
|
|
log "==> oauth2-proxy bootstrap"
|
|
log " namespace : $NAMESPACE"
|
|
log " kubectx : ${KCTX:-<ambient>}"
|
|
|
|
log "Applying oauth2-proxy-google-oidc secret ..."
|
|
envsubst '${OAUTH2_PROXY_CLIENT_ID} ${OAUTH2_PROXY_CLIENT_SECRET} ${OAUTH2_PROXY_COOKIE_SECRET}' \
|
|
< "$SECRET_TMPL" \
|
|
| kubectl "${KCTX_FLAG[@]}" -n "$NAMESPACE" apply -f -
|
|
|
|
log "Applying oauth2-proxy ServiceAccount + BackendConfig + Service + Deployment ..."
|
|
kubectl "${KCTX_FLAG[@]}" -n "$NAMESPACE" apply -f "$DEPLOY_MANIFEST"
|
|
|
|
log "Waiting for oauth2-proxy Deployment to become Ready (timeout 180s) ..."
|
|
kubectl "${KCTX_FLAG[@]}" -n "$NAMESPACE" rollout status deployment/oauth2-proxy --timeout=180s
|
|
|
|
log "==> oauth2-proxy bootstrap complete."
|
|
echo ""
|
|
echo " Next steps (NOT performed by this script):"
|
|
echo " 1. Patch the supabase-kong Ingress so db.0.knoe.dev routes to"
|
|
echo " oauth2-proxy:80 instead of supabase-kong:8000."
|
|
echo " 2. Remove the basic-auth plugin from the dashboard route in the"
|
|
echo " supabase-kong configmap, then rollout-restart supabase-kong."
|
|
echo " 3. In a browser, sign in to https://db.0.knoe.dev/ with a"
|
|
echo " @knoey.com Google account. Try a non-knoey account too — should"
|
|
echo " receive 403 from oauth2-proxy."
|
|
echo ""
|
|
echo " See the active plan in ~/.claude/plans/ for the exact patch commands."
|