unkinben
1922014ab9
The k8s Gitea drops SSH and serves git.unkin.net (canonical) plus git.k8s.syd1.au.unkin.net (admin/backup route, live now via external-dns). Replace the old git2 validation host in the OAuth2 redirect URIs to match argocd-apps#309. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
26 lines
1.2 KiB
YAML
26 lines
1.2 KiB
YAML
# OAuth2/OIDC provider + application for the k8s Gitea forge.
|
|
# Redirect URIs cover both the temporary validation host (git2...) and the final
|
|
# git.unkin.net cutover host, so SSO keeps working across the migration. The
|
|
# path segment "authentik" is the Gitea OAuth2 login-source name — it must match
|
|
# the source registered on the Gitea side. client_secret is read from Vault
|
|
# (seeded out of band), never committed.
|
|
name: Gitea
|
|
authorization_flow: default-provider-authorization-implicit-consent
|
|
invalidation_flow: default-provider-invalidation-flow
|
|
client_type: confidential
|
|
client_id: gitea
|
|
client_secret_vault:
|
|
mount: kv
|
|
path: kubernetes/namespace/gitea/default/oauth-credentials
|
|
scope_mappings:
|
|
- goauthentik.io/providers/oauth2/scope-openid
|
|
- goauthentik.io/providers/oauth2/scope-email
|
|
- goauthentik.io/providers/oauth2/scope-profile
|
|
redirect_uris:
|
|
# Canonical/production host (active after the git.unkin.net DNS cutover).
|
|
- matching_mode: strict
|
|
url: https://git.unkin.net/user/oauth2/authentik/callback
|
|
# Admin/backup route (live now via external-dns), used for validation too.
|
|
- matching_mode: strict
|
|
url: https://git.k8s.syd1.au.unkin.net/user/oauth2/authentik/callback
|