mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 16:04:31 +00:00
885fa99a29
- monitoring/kps-values-k3s.yaml: Grafana helm values for k3s homelab with dual auth (auth.proxy Kerberos + auth.google for prole.org Workspace) - grafana-proxy-configmap.yaml: nginx passthrough for /grafana/login/google and /grafana/login to allow Google OAuth flow without knoe-auth redirect - grafana-google-oidc-secret-prole.example.yaml: Secret template for Grafana Google OAuth client (svc.prole.org, Internal consent, prole.org Workspace) - oauth2-proxy-google-oidc-secret-prole.example.yaml: Secret template for oauth2-proxy gating db.prole.org Studio - oauth2-proxy-deployment-prole.yaml: k3s oauth2-proxy deployment for db.prole.org (prole.org domain, no BackendConfig) - init_grafana_oauth_prole.sh: Bootstrap script for Grafana OAuth secret - init_oauth2_proxy_prole.sh: Bootstrap script for Studio oauth2-proxy Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
33 lines
1.3 KiB
YAML
33 lines
1.3 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: oauth2-proxy-google-oidc
|
|
namespace: supabase
|
|
labels:
|
|
app: oauth2-proxy
|
|
app.kubernetes.io/managed-by: knoe-installer
|
|
# Google OAuth 2.0 client credentials + cookie secret for the oauth2-proxy
|
|
# gating Supabase Studio at db.prole.org on the k3s homelab cluster.
|
|
# Applied by etc/init_oauth2_proxy_prole.sh via envsubst from
|
|
# etc/secrets/oauth2-proxy-{client-id,client-secret,cookie-secret}-prole.
|
|
#
|
|
# Create the OAuth client at: https://console.cloud.google.com/apis/credentials
|
|
# (in the prole.org GCP project — separate from the knoey.com project)
|
|
# - Application type: Web application
|
|
# - Name: prole.org Studio
|
|
# - Authorized JavaScript origins: https://db.prole.org
|
|
# - Authorized redirect URIs: https://db.prole.org/oauth2/callback
|
|
# - OAuth consent screen: Internal (prole.org Workspace only)
|
|
# - Scopes: openid, email, profile
|
|
#
|
|
# cookie_secret: must be 32 bytes. Generate with:
|
|
# openssl rand -base64 32
|
|
#
|
|
# Why a separate client from prole.org Grafana: independent rotation surface.
|
|
# Companion to grafana-google-oidc-secret-prole.example.yaml.
|
|
type: Opaque
|
|
stringData:
|
|
client_id: "${OAUTH2_PROXY_CLIENT_ID}"
|
|
client_secret: "${OAUTH2_PROXY_CLIENT_SECRET}"
|
|
cookie_secret: "${OAUTH2_PROXY_COOKIE_SECRET}"
|