feat(igotify): wire the assist bridge with a Gotify client token

The bridge runs server-side, so it cannot run a browser flow and ZITADEL has no part in it. Give it a Gotify client token instead: GOTIFY_URLS points at the public host, GOTIFY_CLIENT_TOKENS comes from a SOPS secret. The token belongs to user `rock`, is named igotify-assist, and has expiresAfterInactivitySeconds 0 so it never idles out. Delete the client row in Gotify to revoke it. Verified with the token: GET /client returns 200 and GET /message returns the latest message.
2026-10-27 12:14:28 -07:00
parent a525a52580
commit 863c11d75f
3 changed files with 40 additions and 3 deletions
@@ -28,9 +28,17 @@ spec:
              value: "true"
            - name: ENABLE_SCALAR_UI
              value: "true"
-            # GOTIFY_URLS / GOTIFY_CLIENT_TOKENS / SECNTFY_TOKENS intentionally
-            # left unset — not required when Gotify is reachable via public domain
-            # (gotify.riotpiao.com). iGotify iOS app registers itself at runtime.
+            # The bridge authenticates with a Gotify client token, not with
+            # ZITADEL. Gotify has no way to accept a forwarded identity, so the
+            # token is the only credential that works server-side. The token
+            # belongs to user `rock`, never expires, and is revoked by deleting
+            # the client row in Gotify.
+            - name: GOTIFY_URLS
+              value: "https://gotify.riotpiao.com"
+            - name: GOTIFY_CLIENT_TOKENS
+              valueFrom:
+                secretKeyRef: {name: igotify-client-token, key: client-token}
+            # SECNTFY_TOKENS intentionally left unset: secntfy is not deployed.
          volumeMounts:
            - name: data
              mountPath: /app/data