mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
72 lines
3.5 KiB
YAML
72 lines
3.5 KiB
YAML
# GKE production values overlay for knoe-supabase Helm chart.
|
|
#
|
|
# Apply on top of values.yaml:
|
|
# helm upgrade --install knoe-supabase ./supabase/helm/knoe-supabase \
|
|
# --values supabase/helm/knoe-supabase/values.yaml \
|
|
# --values supabase/helm/knoe-supabase/values-gke.yaml \
|
|
# --set environment.auth.GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID="$CLIENT_ID" \
|
|
# --set environment.auth.GOTRUE_EXTERNAL_GOOGLE_SECRET="$CLIENT_SECRET" \
|
|
# --set environment.auth.GOTRUE_SITE_URL="https://$FRONTDOOR_HOST" \
|
|
# --set environment.auth.GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI="https://$FRONTDOOR_HOST/auth/v1/callback" \
|
|
# --set environment.auth.GOTRUE_URI_ALLOW_LIST="https://$FRONTDOOR_HOST/**"
|
|
#
|
|
# Or set FRONTDOOR_HOST, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET in environment
|
|
# and let init_supabase.sh --mode k8s substitute them automatically.
|
|
|
|
# ── Storage: use GCS instead of bundled MinIO ───────────────────────────────
|
|
# When CNPG Workload Identity is active the pod SA already has storage access;
|
|
# set storage driver to gcs and disable minio.
|
|
deployment:
|
|
minio:
|
|
enabled: false
|
|
|
|
# ── GoTrue: enable Google OAuth via knoe-auth OIDC broker ───────────────────
|
|
environment:
|
|
auth:
|
|
# Override base URL to the GKE frontdoor
|
|
API_EXTERNAL_URL: "" # set to https://<frontdoor-host>/auth/v1 at deploy time
|
|
GOTRUE_SITE_URL: "" # set to https://<frontdoor-host>
|
|
GOTRUE_URI_ALLOW_LIST: "" # set to https://<frontdoor-host>/**
|
|
|
|
# Google OAuth2 — client ID and secret from knoe-auth-google-oidc secret
|
|
GOTRUE_EXTERNAL_GOOGLE_ENABLED: "true"
|
|
GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: "" # injected at deploy time
|
|
GOTRUE_EXTERNAL_GOOGLE_SECRET: "" # injected at deploy time
|
|
GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI: "" # set to https://<frontdoor-host>/auth/v1/callback
|
|
|
|
# Disable anonymous sign-in in production
|
|
GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED: "false"
|
|
|
|
# Auto-confirm email (Google accounts are pre-verified)
|
|
GOTRUE_MAILER_AUTOCONFIRM: "true"
|
|
|
|
# ── Studio: oauth2-proxy for Google Workspace OIDC login ────────────────────
|
|
# Replaces the basic-auth popup with a proper Google login page.
|
|
# Credentials are injected at deploy time via secretRef (see conf/gke.cfg:
|
|
# DB_OIDC_CLIENT_ID = secretref://db-oidc-client-id
|
|
# DB_OIDC_CLIENT_SECRET = secretref://db-oidc-client-secret
|
|
# DB_OIDC_COOKIE_SECRET = secretref://db-oidc-cookie-secret)
|
|
#
|
|
# To create the Google OAuth client:
|
|
# GCP Console → APIs & Services → Credentials → Create OAuth Client
|
|
# Type: Web application, name: "knoe.dev Supabase Studio"
|
|
# Redirect URI: https://db.0.knoe.dev/oauth2/callback
|
|
deployment:
|
|
oauth2proxy:
|
|
enabled: true
|
|
emailDomain: "knoey.com"
|
|
redirectUrl: "https://db.0.knoe.dev/oauth2/callback"
|
|
|
|
secret:
|
|
dashboard: ~ # disables basic-auth Kong consumer when oauth2proxy is active
|
|
oauth2proxy:
|
|
secretRef: "" # set to a pre-existing secret name, or leave blank to use
|
|
clientId: "" # DB_OIDC_CLIENT_ID (injected at deploy time via secretref)
|
|
clientSecret: "" # DB_OIDC_CLIENT_SECRET
|
|
cookieSecret: "" # DB_OIDC_COOKIE_SECRET
|
|
|
|
# ── Ingress: use GKE-managed ingress class ──────────────────────────────────
|
|
ingress:
|
|
studio:
|
|
className: "gce" # GKE L7 load balancer; override with "kong" if Kong is installed
|