rock
03cebb0aeb
Gotify has no OIDC support, so it cannot validate a ZITADEL token itself. Put oauth2-proxy in front of it and let nginx ask the proxy for every request. The Gotify REST API keeps its own client-token check. /message, /application, /client, /user, /version, /stream and /health are skipped by the proxy, so Forgejo webhooks, the harness, poimen-sender and the Android client keep working without a browser session. Only the web UI requires SSO. The /oauth2 path needs its own ingress: the auth_request annotation would otherwise also guard /oauth2/start, and the login entry point would demand a login first. The client id and secret come from project role provisioning: `zitadel-provision.py apply` now creates the `gotify` OIDC app, and the secret is SOPS-encrypted under k8s/argocd/secrets. Gotify's own login remains behind the proxy. ZITADEL decides who reaches the service, Gotify decides what that person may do inside it.
45 lines
1.5 KiB
YAML
45 lines
1.5 KiB
YAML
apiVersion: viaduct.ai/v1
|
|
kind: ksops
|
|
metadata:
|
|
name: sops-secret-generator
|
|
annotations:
|
|
config.kubernetes.io/function: |
|
|
exec:
|
|
path: ksops
|
|
files:
|
|
- agent-pod-models.enc.yaml
|
|
- agent-pod-ssh-key.enc.yaml
|
|
- cloudflare-secrets.enc.yaml
|
|
- cloudflared-credentials.enc.yaml
|
|
- forgejo-registry-pat-api.enc.yaml
|
|
- forgejo-registry-pull.enc.yaml
|
|
- forgejo-runner-token.enc.yaml
|
|
- forgejo-secrets.enc.yaml
|
|
- grafana-oidc-secrets.enc.yaml
|
|
- grafana-secrets.enc.yaml
|
|
- homelab-ca-secrets.enc.yaml
|
|
- loki-secrets.enc.yaml
|
|
- minio-secrets.enc.yaml
|
|
- paperless-secrets.enc.yaml
|
|
- vault-secrets.enc.yaml
|
|
- vault-unseal-keys.enc.yaml
|
|
- portfolio-secrets.enc.yaml
|
|
- gotify-admin-secrets.enc.yaml
|
|
- gotify-tokens-secrets.enc.yaml
|
|
- gotify-smtp-secrets.enc.yaml
|
|
- forgejo-smtp-secrets.enc.yaml
|
|
- paperless-ai-secrets.enc.yaml
|
|
- memory-agent-oidc.enc.yaml
|
|
- oauth2-credentials.enc.yaml
|
|
- forgejo-registry-token.enc.yaml
|
|
- pi-sandbox-secrets.enc.yaml
|
|
- etcd-defrag-creds.enc.yaml
|
|
- zitadel-masterkey.enc.yaml
|
|
- smtp-gotify-secrets.enc.yaml
|
|
- gotify-oauth2-proxy-secrets.enc.yaml
|
|
# Login UI RSA keypair, adopted from the chart-generated Secret so ArgoCD
|
|
# owns it. Without this, the chart re-generates the keypair on every render,
|
|
# which changes checksum/secret-login-service-key and leaves both Zitadel
|
|
# Deployments permanently OutOfSync.
|
|
- zitadel-login-service-key.enc.yaml
|