mirror of
https://github.com/shadoll/helm-charts.git
synced 2026-08-28 19:43:12 +00:00
shaandClaude Opus 5
cf2aebf298
A session cookie scoped to one registrable domain is never sent to a host under
another, so an app on a second domain could not be protected by this instance at
all. It failed with a 500 naming the cause: "return URL host does not match any
configured cookie domain".
`domains` is now a list of {domain, authHost}, matching the upstream
`server.domains` schema. The chart previously emitted `server.hostname` and
`cookies.domain`, which are not in 4.14.1's documented options — a deprecated
form that still worked. The single-domain values remain as shorthand and fold
into one entry, so an existing release renders the same protection it did before.
`portals` is a list too. A portal is one OAuth2 client, chosen by the middleware
address, so two portals means two Pocket ID applications — which is how access
can be separated per domain rather than merely shared across them. Each portal
gets its own Middleware and its own mounted secret, under
/var/run/secrets/traefik-forward-auth/<portal>/.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
68 lines
2.1 KiB
YAML
68 lines
2.1 KiB
YAML
{{- $portals := include "tfa.portals" . | fromYamlArray -}}
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ .Release.Name }}
|
|
labels:
|
|
{{- include "tfa.labels" . | nindent 4 }}
|
|
annotations:
|
|
version-source: {{ index .Chart.Annotations "version-source" }}
|
|
version-pattern: {{ index .Chart.Annotations "version-pattern" | quote }}
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: {{ .Release.Name }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: {{ .Release.Name }}
|
|
annotations:
|
|
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
|
spec:
|
|
{{- with .Values.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
containers:
|
|
- name: {{ .Chart.Name }}
|
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
ports:
|
|
- name: http
|
|
containerPort: 4181
|
|
protocol: TCP
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/traefik-forward-auth
|
|
readOnly: true
|
|
{{- range $portals }}
|
|
# One directory per portal: each has its own OAuth2 client, so each
|
|
# has its own secret.
|
|
- name: client-secret-{{ .name }}
|
|
mountPath: "{{ include "tfa.secretDir" $ }}/{{ .name }}"
|
|
readOnly: true
|
|
{{- end }}
|
|
resources:
|
|
{{- toYaml .Values.resources | nindent 12 }}
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: {{ .Release.Name }}-config
|
|
{{- range $portals }}
|
|
- name: client-secret-{{ .name }}
|
|
secret:
|
|
secretName: {{ .existingSecret }}
|
|
items:
|
|
- key: {{ .secretKey }}
|
|
path: client-secret
|
|
{{- end }}
|