unkin-agent
43d325146c
The ClickHouse log UI (logviewer) is being exposed at https://logviewer.unkin.net behind oauth2-proxy in the logging namespace; this adds the Authentik side as the prerequisite. - Adds config/providers_oauth2/logviewer.yaml mirroring traefik: confidential client, client_id logviewer, secret from Vault kv kubernetes/namespace/logging/default/oauth-credentials, openid/email/profile scopes (ak_groups is attached to every oauth2 provider by the module), strict redirect URI for the logviewer oauth2 callback. - Adds config/permissions/akP-logviewer-admin.yaml bound to the logviewer application and nests it under akR-global-admin.
4 lines
172 B
YAML
4 lines
172 B
YAML
# Permission group akP-logviewer-admin (name = filename). Grants admin
|
|
# access to logviewer: bound to the logviewer application, gating the log UI.
|
|
application: logviewer
|