mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 19:04:31 +00:00
2a2b16d0fa
Deploys an Apache + mod_auth_gssapi sidecar in the gitea namespace that handles SPNEGO/Kerberos negotiation (HTTP/git.prole.org@PROLE.ORG) and injects X-WEBAUTH-USER for Gitea reverse-proxy auto-login. Identity chain: Browser → Traefik TLS → Kong → gitea-spnego-proxy:4000 → GSSAPI negotiate → X-WEBAUTH-USER: <username> → gitea-http:3000 (reverse proxy auto-registration) Changes: - gitea-spnego-proxy.yaml: krb5.conf ConfigMap + Deployment + Service - gitea/spnego-proxy/: Dockerfile and Apache vhost (build source) - kong-configmap.yaml: route git.prole.org → gitea-spnego-proxy:4000 Gitea reverse proxy settings applied via helm upgrade: ENABLE_REVERSE_PROXY_AUTHENTICATION=true ENABLE_REVERSE_PROXY_AUTO_REGISTRATION=true REVERSE_PROXY_AUTHENTICATION_USER_HEADER=X-WEBAUTH-USER Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
102 lines
2.8 KiB
YAML
102 lines
2.8 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: knoe-svc-kong-config
|
|
namespace: knoe-system
|
|
data:
|
|
kong.yml: |
|
|
_format_version: "3.0"
|
|
_transform: true
|
|
|
|
services:
|
|
- name: healthz
|
|
url: http://knoe.healthz.invalid/
|
|
routes:
|
|
- name: healthz
|
|
paths:
|
|
- /healthz
|
|
strip_path: true
|
|
plugins:
|
|
- name: request-termination
|
|
config:
|
|
status_code: 200
|
|
message: ok
|
|
|
|
- name: knoe-service
|
|
url: http://knoe-svc.knoe-system.svc.cluster.local:8080
|
|
routes:
|
|
- name: knoe-k3s-kubeconfig
|
|
hosts:
|
|
- svc.prole.org
|
|
paths:
|
|
- /k3s/kube_config.sh
|
|
strip_path: false
|
|
|
|
- name: db-manager
|
|
url: http://knoe-db-manager.knoe-db.svc.cluster.local:80
|
|
routes:
|
|
- name: backup-route
|
|
hosts:
|
|
- svc.prole.org
|
|
paths:
|
|
- /backup
|
|
strip_path: false
|
|
|
|
# Grafana: routed through knoe-grafana-proxy (nginx) which handles
|
|
# Kerberos auth_request (X-WEBAUTH-USER injection) and passes
|
|
# /grafana/login paths through for auth.google sign-in.
|
|
- name: grafana
|
|
url: http://knoe-grafana-proxy.monitoring.svc.cluster.local:80
|
|
routes:
|
|
- name: grafana-root
|
|
hosts:
|
|
- svc.prole.org
|
|
paths:
|
|
- /
|
|
strip_path: false
|
|
|
|
- name: knoe-auth
|
|
url: http://knoe-auth.knoe-system.svc.cluster.local:8080
|
|
routes:
|
|
- name: knoe-auth-root
|
|
hosts:
|
|
- api.prole.org
|
|
paths:
|
|
- /
|
|
strip_path: false
|
|
|
|
# Supabase Studio: gated by oauth2-proxy (Google Workspace prole.org).
|
|
# oauth2-proxy forwards authenticated requests upstream to supabase-kong.
|
|
- name: studio
|
|
url: http://oauth2-proxy.supabase.svc.cluster.local:4180
|
|
routes:
|
|
- name: studio-root
|
|
hosts:
|
|
- db.prole.org
|
|
paths:
|
|
- /
|
|
strip_path: false
|
|
|
|
# Gitea: routed through gitea-spnego-proxy (Apache + mod_auth_gssapi) which
|
|
# negotiates SPNEGO/Kerberos and injects X-WEBAUTH-USER for reverse proxy login.
|
|
- name: gitea-http
|
|
url: http://gitea-spnego-proxy.gitea.svc.cluster.local:4000
|
|
routes:
|
|
- name: gitea-root
|
|
hosts:
|
|
- git.prole.org
|
|
paths:
|
|
- /
|
|
strip_path: false
|
|
|
|
- name: gitea-ssh
|
|
host: gitea-ssh.gitea.svc.cluster.local
|
|
port: 22
|
|
protocol: tcp
|
|
routes:
|
|
- name: gitea-ssh-tcp
|
|
protocols:
|
|
- tcp
|
|
destinations:
|
|
- port: 3022
|