From 0ba2785eb5b872f22ed8a83ecb9ae56c273c5db6 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Wed, 29 Jul 2026 22:01:58 +1000 Subject: [PATCH] Add Gitea OAuth2/OIDC provider + application Register the k8s Gitea forge as an Authentik OIDC app so it can use SSO at cutover. Redirect URIs cover both the temporary git2 validation host and the final git.unkin.net host so login works across the migration. - add config/providers_oauth2/gitea.yaml (confidential OAuth2 provider + app, client_secret read from kv/kubernetes/namespace/gitea/default/oauth-credentials) Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --- config/providers_oauth2/gitea.yaml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 config/providers_oauth2/gitea.yaml diff --git a/config/providers_oauth2/gitea.yaml b/config/providers_oauth2/gitea.yaml new file mode 100644 index 0000000..751194e --- /dev/null +++ b/config/providers_oauth2/gitea.yaml @@ -0,0 +1,25 @@ +# OAuth2/OIDC provider + application for the k8s Gitea forge. +# Redirect URIs cover both the temporary validation host (git2...) and the final +# git.unkin.net cutover host, so SSO keeps working across the migration. The +# path segment "authentik" is the Gitea OAuth2 login-source name — it must match +# the source registered on the Gitea side. client_secret is read from Vault +# (seeded out of band), never committed. +name: Gitea +authorization_flow: default-provider-authorization-implicit-consent +invalidation_flow: default-provider-invalidation-flow +client_type: confidential +client_id: gitea +client_secret_vault: + mount: kv + path: kubernetes/namespace/gitea/default/oauth-credentials +scope_mappings: + - goauthentik.io/providers/oauth2/scope-openid + - goauthentik.io/providers/oauth2/scope-email + - goauthentik.io/providers/oauth2/scope-profile +redirect_uris: + # Temporary validation host. + - matching_mode: strict + url: https://git2.k8s.syd1.au.unkin.net/user/oauth2/authentik/callback + # Final host (active after DNS/cert cutover). + - matching_mode: strict + url: https://git.unkin.net/user/oauth2/authentik/callback