mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 14:54:34 +00:00
885fa99a29
- monitoring/kps-values-k3s.yaml: Grafana helm values for k3s homelab with dual auth (auth.proxy Kerberos + auth.google for prole.org Workspace) - grafana-proxy-configmap.yaml: nginx passthrough for /grafana/login/google and /grafana/login to allow Google OAuth flow without knoe-auth redirect - grafana-google-oidc-secret-prole.example.yaml: Secret template for Grafana Google OAuth client (svc.prole.org, Internal consent, prole.org Workspace) - oauth2-proxy-google-oidc-secret-prole.example.yaml: Secret template for oauth2-proxy gating db.prole.org Studio - oauth2-proxy-deployment-prole.yaml: k3s oauth2-proxy deployment for db.prole.org (prole.org domain, no BackendConfig) - init_grafana_oauth_prole.sh: Bootstrap script for Grafana OAuth secret - init_oauth2_proxy_prole.sh: Bootstrap script for Studio oauth2-proxy Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
82 lines
2.8 KiB
YAML
82 lines
2.8 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: knoe-grafana-proxy-nginx
|
|
data:
|
|
nginx.conf: |
|
|
worker_processes 1;
|
|
events { worker_connections 1024; }
|
|
http {
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
# Never trust inbound auth headers from clients.
|
|
proxy_set_header X-WEBAUTH-USER "";
|
|
proxy_set_header X-Knoe-Groups "";
|
|
|
|
location = /_auth_verify {
|
|
internal;
|
|
proxy_pass http://knoe-auth:8080/auth/verify;
|
|
proxy_pass_request_body off;
|
|
proxy_set_header Content-Length "";
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
}
|
|
|
|
# Pass Google OAuth and Grafana login paths through without auth_request
|
|
# so auth.google sign-in can complete. Kerberos users still reach Grafana
|
|
# via the auth_request path below and get X-WEBAUTH-USER injected.
|
|
location = /grafana/login/google {
|
|
proxy_set_header X-WEBAUTH-USER "";
|
|
proxy_set_header X-Knoe-Groups "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_pass http://kps-grafana.monitoring.svc.cluster.local:80;
|
|
}
|
|
|
|
location ~ ^/grafana/login(/.*)?$ {
|
|
proxy_set_header X-WEBAUTH-USER "";
|
|
proxy_set_header X-Knoe-Groups "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_pass http://kps-grafana.monitoring.svc.cluster.local:80;
|
|
}
|
|
|
|
location / {
|
|
auth_request /_auth_verify;
|
|
auth_request_set $knoe_user $upstream_http_x_knoe_user;
|
|
auth_request_set $knoe_groups $upstream_http_x_knoe_groups;
|
|
|
|
error_page 401 = @login;
|
|
error_page 403 = @login;
|
|
|
|
proxy_set_header X-WEBAUTH-USER $knoe_user;
|
|
proxy_set_header X-Knoe-Groups $knoe_groups;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
|
|
proxy_pass http://kps-grafana.monitoring.svc.cluster.local:80;
|
|
}
|
|
|
|
location @login {
|
|
return 302 https://api.knoe.org/auth/login?next=$scheme://$host$request_uri;
|
|
}
|
|
}
|
|
}
|