Compare commits
5 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
82ed1c6078 | ||
 Ultradesu
|
0df274c0b2 | ||
|
Ultradesu
|
658ec19ff1 | ||
|
Ultradesu
|
eb27dcf65b | ||
|
Ultradesu
|
e44cf95bb2 |
@@ -17,9 +17,12 @@ ArgoCD homelab project
|
||||
| **cert-manager** | [](https://ag.hexor.cy/applications/argocd/cert-manager) |
|
||||
| **external-secrets** | [](https://ag.hexor.cy/applications/argocd/external-secrets) |
|
||||
| **gpu** | [](https://ag.hexor.cy/applications/argocd/gpu) |
|
||||
| **kanidm** | [](https://ag.hexor.cy/applications/argocd/kanidm) |
|
||||
| **keycloak** | [](https://ag.hexor.cy/applications/argocd/keycloak) |
|
||||
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
||||
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
||||
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
||||
| **oauth2-proxy** | [](https://ag.hexor.cy/applications/argocd/oauth2-proxy) |
|
||||
| **postgresql** | [](https://ag.hexor.cy/applications/argocd/postgresql) |
|
||||
| **prom-stack** | [](https://ag.hexor.cy/applications/argocd/prom-stack) |
|
||||
| **system-upgrade** | [](https://ag.hexor.cy/applications/argocd/system-upgrade) |
|
||||
@@ -62,9 +65,12 @@ ArgoCD homelab project
|
||||
| **sonarr-stack** | [](https://ag.hexor.cy/applications/argocd/sonarr-stack) |
|
||||
| **stirling-pdf** | [](https://ag.hexor.cy/applications/argocd/stirling-pdf) |
|
||||
| **syncthing** | [](https://ag.hexor.cy/applications/argocd/syncthing) |
|
||||
| **teamspeak** | [](https://ag.hexor.cy/applications/argocd/teamspeak) |
|
||||
| **tg-bots** | [](https://ag.hexor.cy/applications/argocd/tg-bots) |
|
||||
| **vaultwarden** | [](https://ag.hexor.cy/applications/argocd/vaultwarden) |
|
||||
| **vpn** | [](https://ag.hexor.cy/applications/argocd/vpn) |
|
||||
| **web-petting** | [](https://ag.hexor.cy/applications/argocd/web-petting) |
|
||||
| **wedding** | [](https://ag.hexor.cy/applications/argocd/wedding) |
|
||||
| **xandikos** | [](https://ag.hexor.cy/applications/argocd/xandikos) |
|
||||
|
||||
</td>
|
||||
|
||||
@@ -1,5 +1,41 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: keycloak-auth
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://oauth2-proxy.oauth2-proxy.svc:80/oauth2/auth
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-Auth-Request-User
|
||||
- X-Auth-Request-Email
|
||||
- X-Auth-Request-Groups
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: keycloak-auth-redirect
|
||||
spec:
|
||||
errors:
|
||||
status:
|
||||
- "401"
|
||||
service:
|
||||
name: oauth2-proxy-redirect
|
||||
port: 80
|
||||
query: /oauth2/sign_in?rd={url}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: oauth2-proxy-redirect
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: oauth2-proxy.oauth2-proxy.svc.cluster.local
|
||||
ports:
|
||||
- port: 80
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: secret-reader
|
||||
@@ -9,11 +45,16 @@ spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`secret-reader.hexor.cy`) && PathPrefix(`/oauth2/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: oauth2-proxy-redirect
|
||||
port: 80
|
||||
- match: Host(`secret-reader.hexor.cy`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: keycloak-auth
|
||||
namespace: oauth2-proxy
|
||||
- name: keycloak-auth-redirect
|
||||
services:
|
||||
- name: secret-reader
|
||||
port: 80
|
||||
|
||||
@@ -10,10 +10,10 @@ spec:
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
client_id: oauth2-proxy
|
||||
client_secret: |-
|
||||
client-id: oauth2-proxy
|
||||
client-secret: |-
|
||||
{{ .client_secret }}
|
||||
cookie_secret: |-
|
||||
cookie-secret: |-
|
||||
{{ .cookie_secret }}
|
||||
data:
|
||||
- secretKey: client_secret
|
||||
|
||||
@@ -4,7 +4,6 @@ kind: Kustomization
|
||||
resources:
|
||||
- app.yaml
|
||||
- external-secrets.yaml
|
||||
- middleware.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: oauth2-proxy
|
||||
|
||||
@@ -1,14 +1,3 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: keycloak-auth
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://oauth2-proxy.oauth2-proxy.svc:80/oauth2/auth
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-Auth-Request-User
|
||||
- X-Auth-Request-Email
|
||||
- X-Auth-Request-Groups
|
||||
- Authorization
|
||||
# Middleware is deployed per-namespace alongside each IngressRoute
|
||||
# because Traefik does not allow cross-namespace middleware references.
|
||||
# See k8s/apps/mtproxy/secret-reader-ingress.yaml for example.
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
replicaCount: 1
|
||||
|
||||
config:
|
||||
existingSecret: oauth2-proxy-creds
|
||||
configFile: |-
|
||||
provider = "keycloak-oidc"
|
||||
provider_display_name = "Keycloak"
|
||||
@@ -21,23 +22,6 @@ config:
|
||||
code_challenge_method = "S256"
|
||||
scope = "openid profile email"
|
||||
|
||||
extraEnv:
|
||||
- name: OAUTH2_PROXY_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth2-proxy-creds
|
||||
key: client_id
|
||||
- name: OAUTH2_PROXY_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth2-proxy-creds
|
||||
key: client_secret
|
||||
- name: OAUTH2_PROXY_COOKIE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth2-proxy-creds
|
||||
key: cookie_secret
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: traefik
|
||||
|
||||
Reference in New Issue
Block a user