mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
bb71cf68ea
knoe-auth (Spring Boot OIDC provider): - AuthProperties: add google.workspaceDomain and kerberos.servicePrincipal fields - GoogleOAuthService: validate hd (hosted domain) claim; restrict to configured workspace - LoginController: /login/google endpoint + SPNEGO negotiation entry point - PrincipalNormalizer: map Kerberos principal (user@REALM) to knoe-auth user - application.yml: add spring.security.kerberos and oauth2.client stubs (values injected at runtime from env / Kubernetes Secrets) - knoe-auth-deployment.yaml: mount HTTP keytab Secret; add GOOGLE_PROLE_CLIENT_ID / GOOGLE_PROLE_CLIENT_SECRET env from oauth2-proxy-prole-secret - knoe-auth-http-keytab-secret.example.yaml: example Secret for HTTP/<host> keytab Kong (init_kong.sh): - Add db.prole.org route in k3s mode block via oauth2-proxy upstream - Mode-gate: only registered for k3s, excluded for k3d/k8s Supabase / oauth2-proxy: - New supabase/helm/oauth2-proxy Helm chart: gates Supabase Studio at db.prole.org with Google OAuth (email-domain=prole.org) + cookie settings for .prole.org domain - values-k3s.yaml: k3s-specific overrides (upstream service, TLS, cookie domain) - secret-example.yaml: placeholder for oauth2-proxy-prole-secret Ansible: - infrastructure/playbooks/kerberos_trust_setup.yml: automates samba-tool domain trust create on myrddin.prole.org for PROLE.LOCAL ↔ PROLE.ORG cross-realm trust Test: - GoogleLoginProleOrgTest: verifies hd=prole.org tokens are accepted; hd=other.com rejected Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
120 lines
2.1 KiB
Plaintext
120 lines
2.1 KiB
Plaintext
/.DS_Store
|
|
**/.DS_Store
|
|
/.gitignore
|
|
# Python artifacts
|
|
**/__pycache__/
|
|
*.py[cod]
|
|
*$py.class
|
|
*.pyc
|
|
|
|
# Build and distribution
|
|
/build/
|
|
/dist/
|
|
/installer/build/
|
|
/installer/dist/
|
|
/prole-app/dist/
|
|
/prole-app/dist-*/
|
|
/prole-tools-app/dist/
|
|
/prole-tools-app/.build/
|
|
/prole-tools-app/.build-cli/
|
|
|
|
# Binaries and generated tools
|
|
/net/prole-agent
|
|
/net/prole-scan
|
|
/bin/prole-agent
|
|
/bin/prole-scan
|
|
|
|
# IDE / tool state — never commit
|
|
/.junie/
|
|
/knoe-db/.idea/
|
|
/tmp/
|
|
# MagicMock artifacts (accidental Python materialisation)
|
|
/<MagicMock*/
|
|
|
|
/bin/*
|
|
!/bin/prole-env.sh
|
|
!/bin/prole-kpf.sh
|
|
/lib/
|
|
/include/
|
|
/.idea/
|
|
/.vagrant/
|
|
/.vscode/
|
|
/.venv/
|
|
/prole-tools-app/.build/
|
|
/prole-tools-app/.build-cli/
|
|
/prole/backup/
|
|
|
|
# Secrets and local config
|
|
*.kubeconfig
|
|
*.kubeconfig*
|
|
etc/secrets/
|
|
*-password.txt
|
|
# Catches both the legacy literal `.prole_user_password` (was committed
|
|
# to history under prole-db/ and knoe-db/) and any future variant.
|
|
.prole_user_password
|
|
**/.prole_user_password
|
|
*_password
|
|
*.password
|
|
postgres-password*
|
|
mssql-password*
|
|
*secret.yaml
|
|
*-secret.yaml
|
|
*-secret
|
|
.vault_pass
|
|
/conf/prole.cfg
|
|
/secrets/
|
|
# etc/secrets/ holds plaintext values for secretref:// indirection.
|
|
# The directory is ignored, but keep the .keep marker tracked so forks see
|
|
# the pattern and know to create the directory locally.
|
|
!etc/secrets/.keep
|
|
/data/
|
|
/logs/
|
|
/storage/
|
|
# Runtime data directories — never version-controlled
|
|
knoe-db/data/
|
|
var/
|
|
/target/
|
|
**/target/
|
|
/pyvenv.cfg
|
|
.output.txt
|
|
deploy/gcp/terraform-setup.txt
|
|
.terraform/
|
|
.terraform.lock.hcl
|
|
*.tfstate
|
|
*.tfstate.backup
|
|
|
|
# SSL material — never check in private keys
|
|
/ssl/
|
|
|
|
# Local MCP / AI tooling config (personal, per-clone)
|
|
.ai/
|
|
|
|
# Ad-hoc run artifacts — deploy.sh and friends leave these in the repo root
|
|
/end_time.txt
|
|
/start_time.txt
|
|
/start_time_final.txt
|
|
/sidekiq_logs.txt
|
|
/network_description.txt
|
|
/network_prompt.txt
|
|
/test_resolve.sh
|
|
/docs/deploy_*.log
|
|
/docs/compressed-history.log
|
|
|
|
# Large binaries
|
|
*.zip
|
|
*.tar.gz
|
|
|
|
# Ansible
|
|
.ansible/
|
|
|
|
# Coverage and testing
|
|
.coverage
|
|
htmlcov/
|
|
.pytest_cache/
|
|
|
|
/ssh-keys/
|
|
/mock_val/secrets/
|
|
/prole-db.iml
|
|
supabase/helm/generated/values.generated.json
|
|
/.claude/
|