P3.7: Wire auth config (tokenUrl, clientId, clientSecret) into gateway deployment #12

New Issue

2026-09-08T04:42:55Z

rock commented

2026-09-08 04:42:55 +00:00

Summary

Add token exchange config to gateway ConfigMap + SOPS Secret.

Both repos: ConfigMap/Secret in rock/homelab-frontend/k8s/, config struct in rock/homelab-frontend/internal/config/

Current state (verified 2026-09-08)

api-gw provider exists with:

client_id: api-gw
client_secret: exists in Authentik (query via API)
token_url: https://authentik.riotpiao.com/application/o/token/
jwks_url: already configured in gateway config
Grant types: authorization_code, refresh_token, client_credentials, password, device_code
Scopes: openid, email, profile, groups, permissions, roles, memory

Password grant configured but returning invalid_grant for user rock — needs debugging (flow stage issue suspected).

Changes needed

`gateway-config-secret.enc.yaml`

auth:
  tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
  clientId: "api-gw"
  # clientSecret from env var AUTH_CLIENT_SECRET

`deployment.yaml`

env:
  - name: AUTH_CLIENT_SECRET
    valueFrom:
      secretKeyRef:
        name: api-gw-client-secret
        key: client-secret

`internal/config/config.go`

Add TokenURL, ClientID, ClientSecret fields to AuthConfig

Acceptance Criteria

tokenUrl + clientId in config
clientSecret from env (never plaintext)
Startup fails with clear error if missing
Secret created in api namespace

## Summary Add token exchange config to gateway ConfigMap + SOPS Secret. **Both repos:** ConfigMap/Secret in `rock/homelab-frontend/k8s/`, config struct in `rock/homelab-frontend/internal/config/` ## Current state (verified 2026-09-08) `api-gw` provider exists with: - `client_id`: `api-gw` - `client_secret`: exists in Authentik (query via API) - `token_url`: `https://authentik.riotpiao.com/application/o/token/` - `jwks_url`: already configured in gateway config - Grant types: `authorization_code`, `refresh_token`, `client_credentials`, `password`, `device_code` - Scopes: `openid`, `email`, `profile`, `groups`, `permissions`, `roles`, `memory` Password grant configured but returning `invalid_grant` for user `rock` — needs debugging (flow stage issue suspected). ## Changes needed ### `gateway-config-secret.enc.yaml` ```yaml auth: tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/" clientId: "api-gw" # clientSecret from env var AUTH_CLIENT_SECRET ``` ### `deployment.yaml` ```yaml env: - name: AUTH_CLIENT_SECRET valueFrom: secretKeyRef: name: api-gw-client-secret key: client-secret ``` ### `internal/config/config.go` Add `TokenURL`, `ClientID`, `ClientSecret` fields to `AuthConfig` ## Acceptance Criteria - [ ] tokenUrl + clientId in config - [ ] clientSecret from env (never plaintext) - [ ] Startup fails with clear error if missing - [ ] Secret created in api namespace

rock added this to the Phase 3: OAuth2 Token Exchange & Identity Propagation milestone 2026-09-08 04:42:55 +00:00

rock added the priority/high area/gateway status/todo type/infra labels 2026-09-08 04:42:55 +00:00

rock self-assigned this 2026-09-08 04:42:55 +00:00

rock added this to the API-GW OAuth project 2026-09-08 04:44:03 +00:00

rock moved this to Todo in API-GW OAuth on 2026-09-08 04:44:40 +00:00

rock closed this issue

2026-09-08 23:43:59 +00:00

rock commented

2026-09-09 00:56:12 +00:00

Closed by homelab-frontend PR #17: riotpiao-poimen/homelab-frontend#17

Closed by homelab-frontend PR #17: https://forgejo.riotpiao.com/riotpiao-poimen/homelab-frontend/pulls/17

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#12