tegwick
f885697e96
Mark workplan active. Add Traefik ForwardAuth middleware and Ingress manifests for activity.coulomb.social and activity-temporal.coulomb.social. Prefer Authelia SSO identity for ops mutations; document DNS gate and fleet pattern (docs/ops-sso-access.md).
22 lines
715 B
YAML
22 lines
715 B
YAML
# Traefik ForwardAuth → Authelia (fleet SSO).
|
|
# Pattern: net-kingdom sso-mfa Authelia at auth.coulomb.social
|
|
# ACTIVITY-WP-0025
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: authelia-forwardauth
|
|
namespace: activity-core
|
|
labels:
|
|
app.kubernetes.io/name: activity-core
|
|
app.kubernetes.io/part-of: activity-core
|
|
app.kubernetes.io/component: sso
|
|
spec:
|
|
forwardAuth:
|
|
# rd= sends the browser to the Authelia login portal when unauthenticated.
|
|
address: http://authelia.sso.svc.cluster.local:9091/api/verify?rd=https://auth.coulomb.social/
|
|
trustForwardHeader: true
|
|
authResponseHeaders:
|
|
- Remote-User
|
|
- Remote-Groups
|
|
- Remote-Name
|
|
- Remote-Email
|