rock
03cebb0aeb
Gotify has no OIDC support, so it cannot validate a ZITADEL token itself. Put oauth2-proxy in front of it and let nginx ask the proxy for every request. The Gotify REST API keeps its own client-token check. /message, /application, /client, /user, /version, /stream and /health are skipped by the proxy, so Forgejo webhooks, the harness, poimen-sender and the Android client keep working without a browser session. Only the web UI requires SSO. The /oauth2 path needs its own ingress: the auth_request annotation would otherwise also guard /oauth2/start, and the login entry point would demand a login first. The client id and secret come from project role provisioning: `zitadel-provision.py apply` now creates the `gotify` OIDC app, and the secret is SOPS-encrypted under k8s/argocd/secrets. Gotify's own login remains behind the proxy. ZITADEL decides who reaches the service, Gotify decides what that person may do inside it.
16 lines
264 B
YAML
16 lines
264 B
YAML
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gotify-oauth2-proxy
|
|
namespace: notifications
|
|
labels:
|
|
app: gotify-oauth2-proxy
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: gotify-oauth2-proxy
|
|
ports:
|
|
- name: http
|
|
port: 4180
|
|
targetPort: http
|