mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 17:34:30 +00:00
bb71cf68ea
knoe-auth (Spring Boot OIDC provider): - AuthProperties: add google.workspaceDomain and kerberos.servicePrincipal fields - GoogleOAuthService: validate hd (hosted domain) claim; restrict to configured workspace - LoginController: /login/google endpoint + SPNEGO negotiation entry point - PrincipalNormalizer: map Kerberos principal (user@REALM) to knoe-auth user - application.yml: add spring.security.kerberos and oauth2.client stubs (values injected at runtime from env / Kubernetes Secrets) - knoe-auth-deployment.yaml: mount HTTP keytab Secret; add GOOGLE_PROLE_CLIENT_ID / GOOGLE_PROLE_CLIENT_SECRET env from oauth2-proxy-prole-secret - knoe-auth-http-keytab-secret.example.yaml: example Secret for HTTP/<host> keytab Kong (init_kong.sh): - Add db.prole.org route in k3s mode block via oauth2-proxy upstream - Mode-gate: only registered for k3s, excluded for k3d/k8s Supabase / oauth2-proxy: - New supabase/helm/oauth2-proxy Helm chart: gates Supabase Studio at db.prole.org with Google OAuth (email-domain=prole.org) + cookie settings for .prole.org domain - values-k3s.yaml: k3s-specific overrides (upstream service, TLS, cookie domain) - secret-example.yaml: placeholder for oauth2-proxy-prole-secret Ansible: - infrastructure/playbooks/kerberos_trust_setup.yml: automates samba-tool domain trust create on myrddin.prole.org for PROLE.LOCAL ↔ PROLE.ORG cross-realm trust Test: - GoogleLoginProleOrgTest: verifies hd=prole.org tokens are accepted; hd=other.com rejected Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
36 lines
1.2 KiB
YAML
36 lines
1.2 KiB
YAML
# Example Secret for oauth2-proxy on the prole.org k3s cluster.
|
|
#
|
|
# DO NOT apply this file directly — it contains placeholder values only.
|
|
#
|
|
# Where to obtain the real values:
|
|
# client-id / client-secret:
|
|
# Google Cloud Console → APIs & Services → Credentials
|
|
# Project: prole.org
|
|
# OAuth 2.0 Client ID: "Supabase Studio (db.prole.org)"
|
|
# Authorized redirect URI: https://db.prole.org/oauth2/callback
|
|
#
|
|
# cookie-secret:
|
|
# Generate a random 32-byte base64url string:
|
|
# openssl rand -base64 32 | tr -- '+/' '-_'
|
|
#
|
|
# To create the live secret:
|
|
# kubectl create secret generic oauth2-proxy-prole-secret \
|
|
# --namespace supabase \
|
|
# --from-literal=client-id="<PASTE_FROM_GOOGLE_CONSOLE>" \
|
|
# --from-literal=client-secret="<PASTE_FROM_GOOGLE_CONSOLE>" \
|
|
# --from-literal=cookie-secret="$(openssl rand -base64 32 | tr -- '+/' '-_')"
|
|
#
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: oauth2-proxy-prole-secret
|
|
namespace: supabase
|
|
labels:
|
|
app.kubernetes.io/managed-by: knoe-installer
|
|
type: Opaque
|
|
data:
|
|
# base64("<placeholder>") — replace with real values before applying
|
|
client-id: PHBsYWNlaG9sZGVyPg==
|
|
client-secret: PHBsYWNlaG9sZGVyPg==
|
|
cookie-secret: PHBsYWNlaG9sZGVyPg==
|