rock
03cebb0aeb
Gotify has no OIDC support, so it cannot validate a ZITADEL token itself. Put oauth2-proxy in front of it and let nginx ask the proxy for every request. The Gotify REST API keeps its own client-token check. /message, /application, /client, /user, /version, /stream and /health are skipped by the proxy, so Forgejo webhooks, the harness, poimen-sender and the Android client keep working without a browser session. Only the web UI requires SSO. The /oauth2 path needs its own ingress: the auth_request annotation would otherwise also guard /oauth2/start, and the login entry point would demand a login first. The client id and secret come from project role provisioning: `zitadel-provision.py apply` now creates the `gotify` OIDC app, and the secret is SOPS-encrypted under k8s/argocd/secrets. Gotify's own login remains behind the proxy. ZITADEL decides who reaches the service, Gotify decides what that person may do inside it.
16 lines
352 B
YAML
16 lines
352 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- namespace.yaml
|
|
- db.yaml
|
|
- deployment.yaml
|
|
- service.yaml
|
|
- oauth2-proxy-deployment.yaml
|
|
- oauth2-proxy-service.yaml
|
|
- oauth2-proxy-ingress.yaml
|
|
- ingress.yaml
|
|
- igotify-pvc.yaml
|
|
- igotify-deployment.yaml
|
|
- igotify-service.yaml
|
|
- igotify-ingress.yaml
|