Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
742e8a5716 |
@@ -17,9 +17,12 @@ ArgoCD homelab project
|
||||
| **cert-manager** | [](https://ag.hexor.cy/applications/argocd/cert-manager) |
|
||||
| **external-secrets** | [](https://ag.hexor.cy/applications/argocd/external-secrets) |
|
||||
| **gpu** | [](https://ag.hexor.cy/applications/argocd/gpu) |
|
||||
| **kanidm** | [](https://ag.hexor.cy/applications/argocd/kanidm) |
|
||||
| **keycloak** | [](https://ag.hexor.cy/applications/argocd/keycloak) |
|
||||
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
||||
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
||||
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
||||
| **oauth2-proxy** | [](https://ag.hexor.cy/applications/argocd/oauth2-proxy) |
|
||||
| **postgresql** | [](https://ag.hexor.cy/applications/argocd/postgresql) |
|
||||
| **prom-stack** | [](https://ag.hexor.cy/applications/argocd/prom-stack) |
|
||||
| **system-upgrade** | [](https://ag.hexor.cy/applications/argocd/system-upgrade) |
|
||||
@@ -62,9 +65,12 @@ ArgoCD homelab project
|
||||
| **sonarr-stack** | [](https://ag.hexor.cy/applications/argocd/sonarr-stack) |
|
||||
| **stirling-pdf** | [](https://ag.hexor.cy/applications/argocd/stirling-pdf) |
|
||||
| **syncthing** | [](https://ag.hexor.cy/applications/argocd/syncthing) |
|
||||
| **teamspeak** | [](https://ag.hexor.cy/applications/argocd/teamspeak) |
|
||||
| **tg-bots** | [](https://ag.hexor.cy/applications/argocd/tg-bots) |
|
||||
| **vaultwarden** | [](https://ag.hexor.cy/applications/argocd/vaultwarden) |
|
||||
| **vpn** | [](https://ag.hexor.cy/applications/argocd/vpn) |
|
||||
| **web-petting** | [](https://ag.hexor.cy/applications/argocd/web-petting) |
|
||||
| **wedding** | [](https://ag.hexor.cy/applications/argocd/wedding) |
|
||||
| **xandikos** | [](https://ag.hexor.cy/applications/argocd/xandikos) |
|
||||
|
||||
</td>
|
||||
|
||||
@@ -1,18 +1,5 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: keycloak-auth
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://oauth2-proxy.oauth2-proxy.svc:80
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-Auth-Request-User
|
||||
- X-Auth-Request-Email
|
||||
- X-Auth-Request-Groups
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: secret-reader
|
||||
@@ -26,6 +13,7 @@ spec:
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: keycloak-auth
|
||||
namespace: oauth2-proxy
|
||||
services:
|
||||
- name: secret-reader
|
||||
port: 80
|
||||
|
||||
@@ -10,10 +10,10 @@ spec:
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
client-id: oauth2-proxy
|
||||
client-secret: |-
|
||||
client_id: oauth2-proxy
|
||||
client_secret: |-
|
||||
{{ .client_secret }}
|
||||
cookie-secret: |-
|
||||
cookie_secret: |-
|
||||
{{ .cookie_secret }}
|
||||
data:
|
||||
- secretKey: client_secret
|
||||
@@ -25,7 +25,7 @@ spec:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
|
||||
key: PLACEHOLDER_VAULTWARDEN_ITEM_ID
|
||||
property: login.password
|
||||
- secretKey: cookie_secret
|
||||
sourceRef:
|
||||
@@ -36,5 +36,5 @@ spec:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
|
||||
key: PLACEHOLDER_VAULTWARDEN_ITEM_ID
|
||||
property: fields[0].value
|
||||
|
||||
@@ -4,11 +4,12 @@ kind: Kustomization
|
||||
resources:
|
||||
- app.yaml
|
||||
- external-secrets.yaml
|
||||
- middleware.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: oauth2-proxy
|
||||
repo: https://oauth2-proxy.github.io/manifests
|
||||
version: 10.4.3
|
||||
version: 7.12.6
|
||||
releaseName: oauth2-proxy
|
||||
namespace: oauth2-proxy
|
||||
valuesFile: values.yaml
|
||||
|
||||
@@ -1,3 +1,15 @@
|
||||
# Middleware is deployed per-namespace alongside each IngressRoute
|
||||
# because Traefik does not allow cross-namespace middleware references.
|
||||
# See k8s/apps/mtproxy/secret-reader-ingress.yaml for example.
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: keycloak-auth
|
||||
namespace: oauth2-proxy
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://oauth2-proxy.oauth2-proxy.svc:80/oauth2/auth
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-Auth-Request-User
|
||||
- X-Auth-Request-Email
|
||||
- X-Auth-Request-Groups
|
||||
- Authorization
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
replicaCount: 1
|
||||
|
||||
config:
|
||||
existingSecret: oauth2-proxy-creds
|
||||
configFile: |-
|
||||
provider = "keycloak-oidc"
|
||||
provider_display_name = "Keycloak"
|
||||
@@ -22,6 +21,23 @@ config:
|
||||
code_challenge_method = "S256"
|
||||
scope = "openid profile email"
|
||||
|
||||
extraEnv:
|
||||
- name: OAUTH2_PROXY_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth2-proxy-creds
|
||||
key: client_id
|
||||
- name: OAUTH2_PROXY_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth2-proxy-creds
|
||||
key: client_secret
|
||||
- name: OAUTH2_PROXY_COOKIE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth2-proxy-creds
|
||||
key: cookie_secret
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: traefik
|
||||
|
||||
Reference in New Issue
Block a user