feat(config): add tokenUrl, clientId, clientSecret to auth config

Wire token exchange config for /auth/token and /auth/refresh endpoints. clientSecret loaded from AUTH_CLIENT_SECRET env var (never from YAML). Backward compatible — missing fields default to zero values. 3 new tests covering: full config, env-only secret, backward compat. Closes homelab#12 Co-authored-by: poimen <[email protected]>
2026-09-08 16:25:32 -07:00
parent 09318778fa
commit 136c85ad13
6 changed files with 125 additions and 0 deletions
@@ -17,6 +17,8 @@ data:
      audience: "api-gw"
      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
      requiredCapability: "llm:inference"
+      tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
+      clientId: "api-gw"
    
    # Routes: standard HTTP proxy routes (not LLM-specific)
    # These are for non-LLM services (agent-pod/console, etc.)