Wire token exchange config for /auth/token and /auth/refresh endpoints.
clientSecret loaded from AUTH_CLIENT_SECRET env var (never from YAML).
Backward compatible — missing fields default to zero values.
3 new tests covering: full config, env-only secret, backward compat.
Closes homelab#12
Co-authored-by: poimen <[email protected]>
MinIO ClusterIP service listens on port 80 (targetPort 9000).
Config had port 9000 which caused 30s timeout then 502 — gateway
connected to service port 9000 which doesn't exist on the ClusterIP.
Changes:
- configmap.yaml: S3 upstream :9000 → :80
- gateway-config-secret.enc.yaml: same
- network-policy.yaml: add port 80 egress to storage namespace
Verified: S3 adapter now reaches MinIO (403 AccessDenied = auth issue,
not connectivity).