mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 15:04:31 +00:00
5077e1335d
Three-part fix to make browser and curl SPNEGO auth work end-to-end: 1. spnego-proxy: issue WWW-Authenticate: Negotiate challenge when no Authorization header is present so Chrome (with AuthServerAllowlist) and curl --negotiate automatically present Kerberos tokens. Previously the proxy only validated tokens if the client proactively sent them. Pass-through preserved for non-Negotiate schemes (Basic/token) so git CLI users with PATs continue to work via Gitea own auth. 2. gitea_spnego_keytab.yml: new Ansible playbook that provisions the gitea-http AD account (AES-only, msDS-SupportedEncryptionTypes=24), registers SPN HTTP/git.prole.org, resets the password to derive fresh AES keys, exports the domain keytab, and rekeys it to principal name HTTP/git.prole.org@PROLE.ORG that gokrb5 needs for keytab lookup. Key lesson: samba-tool exportkeytab --principal=HTTP/... returns empty; must export full domain keytab and rekey in Python. 3. init_gitea.sh: add setup_gitea_spnego() calling the Ansible playbook in k3s mode as part of the standard deploy flow, with inline notes on every non-obvious constraint discovered during this work. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| acme.yml | ||
| audit.yml | ||
| bootstrap_local_ansible_user.yml | ||
| certmgr.yml | ||
| cgroups.yml | ||
| check_k3s_endpoint.yml | ||
| disable_pi_k3s.yml | ||
| gitea_spnego_keytab.yml | ||
| iscsi_cleanup.yml | ||
| iscsi_login.yml | ||
| iscsi_mount.yml | ||
| k3s_cleanup.yml | ||
| k3s_delete.yml | ||
| k3s_diagnose_repair.yml | ||
| k3s_fetch_kubeconfig.yml | ||
| k3s_import_images.yml | ||
| k3s_install_single.yml | ||
| k3s_mariadb_datastore_prepare.yml | ||
| k3s_mariadb_datastore_rollout.yml | ||
| k3s_reset.yml | ||
| k3s_server_refresh.yml | ||
| k3s_start_single.yml | ||
| k3s_stop.yml | ||
| k3s_sync.yml | ||
| kerberos_trust_setup.yml | ||
| merlin_mariadb_full_export.yml | ||
| merlin_mariadb_full_import.yml | ||
| merlin_mariadb_provision.yml | ||
| pihole_flush_dns.yml | ||
| prole_logs_migrate.yml | ||
| rotate_pihole_db.yml | ||
| site.yml | ||
| smoke_ping.yml | ||
| start_k3s_agents.yml | ||
| start_k3s_servers.yml | ||
| stop_k3s_agents.yml | ||
| stop_k3s_servers.yml | ||
| swap.yml | ||
| sync_pihole_toml.yml | ||
| tailscale.yml | ||
| test_k3s_kubeconfig_rewrite.yml | ||
| test_k3s_validate_args.yml | ||
| tmp_bao_dir.yml | ||
| tmp_mount.yml | ||
| workstation_kerberos.yml | ||