feat(config): add tokenUrl, clientId, clientSecret to auth config (#17)

Closes homelab#12 (P3.7) ## Changes - `AuthConfig`: added `TokenURL`, `ClientID`, `ClientSecret` fields - `loader.go`: reads `tokenUrl`/`clientId` from YAML, `ClientSecret` from `AUTH_CLIENT_SECRET` env - `deployment.yaml`: `AUTH_CLIENT_SECRET` from `api-gw-client-secret` Secret (optional) - `gateway-config-secret.enc.yaml` + `configmap.yaml`: added `tokenUrl` and `clientId` ## Secret never in YAML `clientSecret` deliberately omitted from YAML struct. Loaded from env only. ## Tests 3 tests: full config load, env-only secret, backward compat (missing fields = zero). Co-authored-by: poimen <[email protected]>
2026-09-08 23:43:29 +00:00
parent 09318778fa
commit ddee0f2dc9
6 changed files with 125 additions and 0 deletions
@@ -17,6 +17,8 @@ data:
      audience: "api-gw"
      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
      requiredCapability: "llm:inference"
+      tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
+      clientId: "api-gw"
    
    # Routes: standard HTTP proxy routes (not LLM-specific)
    # These are for non-LLM services (agent-pod/console, etc.)