mirror of
https://github.com/shadoll/helm-charts.git
synced 2026-10-12 21:59:18 +00:00
shaandClaude Opus 5
f0d7c1f474
Pocket ID rejects the authorization request outright when its OIDC client has PKCE required -- "This client requires PKCE, but the 'code_challenge' parameter is missing" -- which is the default for clients created in recent Pocket ID versions. Every app behind the portal fails at login, not just the one being tested. Upstream supports this via the pocketID provider's enablePKCE flag; the chart never emitted it, so it stayed at its false default. Adds it to the normalised portal shape (per-portal override via portals[].pocketID.enablePKCE) and defaults it on, since PKCE is harmless when the client does not require it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
103 lines
3.1 KiB
YAML
103 lines
3.1 KiB
YAML
image:
|
|
repository: ghcr.io/italypaleale/traefik-forward-auth
|
|
pullPolicy: IfNotPresent
|
|
# Overrides the image tag; defaults to Chart.AppVersion
|
|
tag: ""
|
|
|
|
# Domains served by this instance. One entry per registrable domain.
|
|
#
|
|
# `domain` scopes the session cookie; `authHost` is where this service is
|
|
# reachable for that domain, and must be it or a sub-domain of it.
|
|
#
|
|
# A browser will not send a cookie scoped to one registrable domain to a host
|
|
# under another, so an app on a second domain needs its own entry here. A second
|
|
# OAuth2 client alone does not solve it.
|
|
domains: []
|
|
# - domain: example.com
|
|
# authHost: auth.example.com
|
|
# - domain: example.org
|
|
# authHost: auth.example.org
|
|
|
|
# Single-domain shorthand, used when `domains` is empty. Equivalent to one
|
|
# `domains` entry of {domain: cookieDomain, authHost: hostname}.
|
|
hostname: ""
|
|
cookieDomain: ""
|
|
|
|
tokens:
|
|
sessionLifetime: 24h
|
|
|
|
# Portals. Each is one OAuth2 client, selected by the middleware address
|
|
# (/portals/<name>) — which is how access is separated: grant one Pocket ID
|
|
# application to one group of people and the other to another, and each portal
|
|
# admits only its own.
|
|
#
|
|
# Each portal mounts its secret at
|
|
# /var/run/secrets/traefik-forward-auth/<name>/client-secret.
|
|
portals: []
|
|
# - name: main
|
|
# middlewareName: pocket-id-auth # default: <release>-<name>
|
|
# existingSecret: tfa-main-secret # must define key `client-secret`
|
|
# secretKey: client-secret # optional, if the key differs
|
|
# pocketID:
|
|
# endpoint: https://id.example.com
|
|
# clientID: "..."
|
|
# enablePKCE: true
|
|
|
|
# Single-portal shorthand, used when `portals` is empty.
|
|
pocketID:
|
|
endpoint: ""
|
|
clientID: ""
|
|
# Send a PKCE code_challenge on the authorization request. Pocket ID rejects
|
|
# the request outright ("This client requires PKCE") when its OIDC client has
|
|
# PKCE required, which is the default for new clients. Harmless when the
|
|
# client does not require it, so this defaults on.
|
|
enablePKCE: true
|
|
|
|
# Secret containing the client secret. Must define key `client-secret`.
|
|
# Use sealed-secrets to provide this in cluster overlays.
|
|
existingSecret: ""
|
|
|
|
portal:
|
|
name: main
|
|
|
|
# Extra YAML appended to config.yaml (advanced use only).
|
|
extraConfig: ""
|
|
|
|
service:
|
|
port: 80
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
|
|
# Traefik Middleware of kind forwardAuth. Referenced by apps as
|
|
# <namespace>-<middleware.name>@kubernetescrd.
|
|
middleware:
|
|
enabled: true
|
|
name: "" # defaults to "<release>-auth" if empty
|
|
authResponseHeaders:
|
|
- X-Forwarded-User
|
|
- X-Forwarded-Displayname
|
|
- X-Forwarded-Groups
|
|
trustForwardHeader: true
|
|
|
|
ingresses: {}
|
|
# https:
|
|
# host: auth.example.com
|
|
# annotations:
|
|
# traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
|
|
# traefik.ingress.kubernetes.io/router.tls: "true"
|
|
# traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
|
|
# traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect-to-https@kubernetescrd
|
|
# tls:
|
|
# - hosts:
|
|
# - auth.example.com
|