unkinben
0ba2785eb5
Register the k8s Gitea forge as an Authentik OIDC app so it can use SSO at cutover. Redirect URIs cover both the temporary git2 validation host and the final git.unkin.net host so login works across the migration. - add config/providers_oauth2/gitea.yaml (confidential OAuth2 provider + app, client_secret read from kv/kubernetes/namespace/gitea/default/oauth-credentials) Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
26 lines
1.1 KiB
YAML
26 lines
1.1 KiB
YAML
# OAuth2/OIDC provider + application for the k8s Gitea forge.
|
|
# Redirect URIs cover both the temporary validation host (git2...) and the final
|
|
# git.unkin.net cutover host, so SSO keeps working across the migration. The
|
|
# path segment "authentik" is the Gitea OAuth2 login-source name — it must match
|
|
# the source registered on the Gitea side. client_secret is read from Vault
|
|
# (seeded out of band), never committed.
|
|
name: Gitea
|
|
authorization_flow: default-provider-authorization-implicit-consent
|
|
invalidation_flow: default-provider-invalidation-flow
|
|
client_type: confidential
|
|
client_id: gitea
|
|
client_secret_vault:
|
|
mount: kv
|
|
path: kubernetes/namespace/gitea/default/oauth-credentials
|
|
scope_mappings:
|
|
- goauthentik.io/providers/oauth2/scope-openid
|
|
- goauthentik.io/providers/oauth2/scope-email
|
|
- goauthentik.io/providers/oauth2/scope-profile
|
|
redirect_uris:
|
|
# Temporary validation host.
|
|
- matching_mode: strict
|
|
url: https://git2.k8s.syd1.au.unkin.net/user/oauth2/authentik/callback
|
|
# Final host (active after DNS/cert cutover).
|
|
- matching_mode: strict
|
|
url: https://git.unkin.net/user/oauth2/authentik/callback
|