rock
03cebb0aeb
Gotify has no OIDC support, so it cannot validate a ZITADEL token itself. Put oauth2-proxy in front of it and let nginx ask the proxy for every request. The Gotify REST API keeps its own client-token check. /message, /application, /client, /user, /version, /stream and /health are skipped by the proxy, so Forgejo webhooks, the harness, poimen-sender and the Android client keep working without a browser session. Only the web UI requires SSO. The /oauth2 path needs its own ingress: the auth_request annotation would otherwise also guard /oauth2/start, and the login entry point would demand a login first. The client id and secret come from project role provisioning: `zitadel-provision.py apply` now creates the `gotify` OIDC app, and the secret is SOPS-encrypted under k8s/argocd/secrets. Gotify's own login remains behind the proxy. ZITADEL decides who reaches the service, Gotify decides what that person may do inside it.
23 lines
707 B
YAML
23 lines
707 B
YAML
# The proxy needs its own ingress path. nginx auth_request also guards
|
|
# /oauth2/start and /oauth2/callback, which would loop: the login entry point
|
|
# would itself require a login. A longer path match sends /oauth2 to the proxy
|
|
# directly, and the prefix rule on the gotify ingress handles everything else.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: gotify-oauth2
|
|
namespace: notifications
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: gotify.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /oauth2
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: gotify-oauth2-proxy
|
|
port:
|
|
number: 4180
|