feat(gotify): put the Gotify UI behind ZITADEL single sign-on

Gotify has no OIDC support, so it cannot validate a ZITADEL token itself. Put
oauth2-proxy in front of it and let nginx ask the proxy for every request.

The Gotify REST API keeps its own client-token check. /message, /application,
/client, /user, /version, /stream and /health are skipped by the proxy, so
Forgejo webhooks, the harness, poimen-sender and the Android client keep working
without a browser session. Only the web UI requires SSO.

The /oauth2 path needs its own ingress: the auth_request annotation would
otherwise also guard /oauth2/start, and the login entry point would demand a
login first.

The client id and secret come from project role provisioning:
`zitadel-provision.py apply` now creates the `gotify` OIDC app, and the secret is
SOPS-encrypted under k8s/argocd/secrets.

Gotify's own login remains behind the proxy. ZITADEL decides who reaches the
service, Gotify decides what that person may do inside it.

This commit was merged in pull request #72.

This commit is contained in:

rock

2026-10-27 12:06:00 -07:00

parent cc7c30ee20

commit 03cebb0aeb

8 changed files with 178 additions and 0 deletions

									
										k8s/apps/gotify/kustomization.yaml
									
		+3
		
												View File
												
				@@ -5,6 +5,9 @@ resources:

				  - db.yaml

				  - deployment.yaml

				  - service.yaml

				  - oauth2-proxy-deployment.yaml

				  - oauth2-proxy-service.yaml

				  - oauth2-proxy-ingress.yaml

				  - ingress.yaml

				  - igotify-pvc.yaml

				  - igotify-deployment.yaml