mirror of
https://github.com/shadoll/helm-charts.git
synced 2026-08-28 11:33:17 +00:00
shaandClaude Opus 5
cf2aebf298
A session cookie scoped to one registrable domain is never sent to a host under
another, so an app on a second domain could not be protected by this instance at
all. It failed with a 500 naming the cause: "return URL host does not match any
configured cookie domain".
`domains` is now a list of {domain, authHost}, matching the upstream
`server.domains` schema. The chart previously emitted `server.hostname` and
`cookies.domain`, which are not in 4.14.1's documented options — a deprecated
form that still worked. The single-domain values remain as shorthand and fold
into one entry, so an existing release renders the same protection it did before.
`portals` is a list too. A portal is one OAuth2 client, chosen by the middleware
address, so two portals means two Pocket ID applications — which is how access
can be separated per domain rather than merely shared across them. Each portal
gets its own Middleware and its own mounted secret, under
/var/run/secrets/traefik-forward-auth/<portal>/.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
97 lines
2.8 KiB
YAML
97 lines
2.8 KiB
YAML
image:
|
|
repository: ghcr.io/italypaleale/traefik-forward-auth
|
|
pullPolicy: IfNotPresent
|
|
# Overrides the image tag; defaults to Chart.AppVersion
|
|
tag: ""
|
|
|
|
# Domains served by this instance. One entry per registrable domain.
|
|
#
|
|
# `domain` scopes the session cookie; `authHost` is where this service is
|
|
# reachable for that domain, and must be it or a sub-domain of it.
|
|
#
|
|
# A browser will not send a cookie scoped to one registrable domain to a host
|
|
# under another, so an app on a second domain needs its own entry here. A second
|
|
# OAuth2 client alone does not solve it.
|
|
domains: []
|
|
# - domain: example.com
|
|
# authHost: auth.example.com
|
|
# - domain: example.org
|
|
# authHost: auth.example.org
|
|
|
|
# Single-domain shorthand, used when `domains` is empty. Equivalent to one
|
|
# `domains` entry of {domain: cookieDomain, authHost: hostname}.
|
|
hostname: ""
|
|
cookieDomain: ""
|
|
|
|
tokens:
|
|
sessionLifetime: 24h
|
|
|
|
# Portals. Each is one OAuth2 client, selected by the middleware address
|
|
# (/portals/<name>) — which is how access is separated: grant one Pocket ID
|
|
# application to one group of people and the other to another, and each portal
|
|
# admits only its own.
|
|
#
|
|
# Each portal mounts its secret at
|
|
# /var/run/secrets/traefik-forward-auth/<name>/client-secret.
|
|
portals: []
|
|
# - name: main
|
|
# middlewareName: pocket-id-auth # default: <release>-<name>
|
|
# existingSecret: tfa-main-secret # must define key `client-secret`
|
|
# secretKey: client-secret # optional, if the key differs
|
|
# pocketID:
|
|
# endpoint: https://id.example.com
|
|
# clientID: "..."
|
|
|
|
# Single-portal shorthand, used when `portals` is empty.
|
|
pocketID:
|
|
endpoint: ""
|
|
clientID: ""
|
|
|
|
# Secret containing the client secret. Must define key `client-secret`.
|
|
# Use sealed-secrets to provide this in cluster overlays.
|
|
existingSecret: ""
|
|
|
|
portal:
|
|
name: main
|
|
|
|
# Extra YAML appended to config.yaml (advanced use only).
|
|
extraConfig: ""
|
|
|
|
service:
|
|
port: 80
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
|
|
# Traefik Middleware of kind forwardAuth. Referenced by apps as
|
|
# <namespace>-<middleware.name>@kubernetescrd.
|
|
middleware:
|
|
enabled: true
|
|
name: "" # defaults to "<release>-auth" if empty
|
|
authResponseHeaders:
|
|
- X-Forwarded-User
|
|
- X-Forwarded-Displayname
|
|
- X-Forwarded-Groups
|
|
trustForwardHeader: true
|
|
|
|
ingresses: {}
|
|
# https:
|
|
# host: auth.example.com
|
|
# annotations:
|
|
# traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
|
|
# traefik.ingress.kubernetes.io/router.tls: "true"
|
|
# traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
|
|
# traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect-to-https@kubernetescrd
|
|
# tls:
|
|
# - hosts:
|
|
# - auth.example.com
|