83 lines
3.1 KiB
YAML
83 lines
3.1 KiB
YAML
|
# oauth2-proxy in front of Gotify. Gotify has no OIDC support of its own, so it
|
||
|
|
# cannot validate a ZITADEL token. This proxy is the front door: nginx asks it
|
||
|
|
# for an auth decision on every request (auth_request), and it answers from a
|
||
|
|
# ZITADEL session cookie.
|
||
|
|
#
|
||
|
|
# The Gotify REST API keeps its own client-token auth (X-Gotify-Key) and must
|
||
|
|
# stay reachable without a browser session, or every push sender breaks:
|
||
|
|
# Forgejo webhooks, the harness, poimen-sender and the ntfy-style relays all post
|
||
|
|
# to /message. skip-auth-route leaves those paths to Gotify's own token check.
|
||
|
|
#
|
||
|
|
# Gotify's own login still exists behind the proxy. ZITADEL decides who may
|
||
|
|
# reach the service; Gotify decides what that person may do inside it.
|
||
|
|
apiVersion: apps/v1
|
||
|
|
kind: Deployment
|
||
|
|
metadata:
|
||
|
|
name: gotify-oauth2-proxy
|
||
|
|
namespace: notifications
|
||
|
|
labels:
|
||
|
|
app: gotify-oauth2-proxy
|
||
|
|
spec:
|
||
|
|
replicas: 1
|
||
|
|
selector:
|
||
|
|
matchLabels:
|
||
|
|
app: gotify-oauth2-proxy
|
||
|
|
template:
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
app: gotify-oauth2-proxy
|
||
|
|
spec:
|
||
|
|
securityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 65534
|
||
|
|
seccompProfile:
|
||
|
|
type: RuntimeDefault
|
||
|
|
containers:
|
||
|
|
- name: oauth2-proxy
|
||
|
|
image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
|
||
|
|
args:
|
||
|
|
- --provider=oidc
|
||
|
|
- --oidc-issuer-url=https://zitadel.riotpiao.com
|
||
|
|
- --email-domain=*
|
||
|
|
- --upstream=static://202
|
||
|
|
- --reverse-proxy=true
|
||
|
|
- --set-xauthrequest=true
|
||
|
|
- --cookie-secure=true
|
||
|
|
- --cookie-expire=12h
|
||
|
|
- --cookie-refresh=1h
|
||
|
|
- --skip-provider-button=true
|
||
|
|
- --redirect-url=https://gotify.riotpiao.com/oauth2/callback
|
||
|
|
- --http-address=0.0.0.0:4180
|
||
|
|
# Browser paths keep SSO. API paths fall through to Gotify's own
|
||
|
|
# client-token check, so existing senders and the Android client
|
||
|
|
# keep working without a browser session.
|
||
|
|
- --skip-auth-route=^/(message|application|client|user|version|stream|health)(/.*)?$
|
||
|
|
env:
|
||
|
|
- name: OAUTH2_PROXY_CLIENT_ID
|
||
|
|
valueFrom:
|
||
|
|
secretKeyRef: {name: gotify-oauth2-proxy, key: client-id}
|
||
|
|
- name: OAUTH2_PROXY_CLIENT_SECRET
|
||
|
|
valueFrom:
|
||
|
|
secretKeyRef: {name: gotify-oauth2-proxy, key: client-secret}
|
||
|
|
- name: OAUTH2_PROXY_COOKIE_SECRET
|
||
|
|
valueFrom:
|
||
|
|
secretKeyRef: {name: gotify-oauth2-proxy, key: cookie-secret}
|
||
|
|
ports:
|
||
|
|
- name: http
|
||
|
|
containerPort: 4180
|
||
|
|
readinessProbe:
|
||
|
|
httpGet: {path: /ping, port: http}
|
||
|
|
initialDelaySeconds: 5
|
||
|
|
periodSeconds: 10
|
||
|
|
livenessProbe:
|
||
|
|
httpGet: {path: /ping, port: http}
|
||
|
|
initialDelaySeconds: 15
|
||
|
|
periodSeconds: 20
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities:
|
||
|
|
drop: ["ALL"]
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 10m, memory: 32Mi}
|
||
|
|
limits: {cpu: 200m, memory: 128Mi}
|