Update pass

adhoc-config/grafana-ingress.yml

@@ -6,8 +6,8 @@ metadata:
   annotations:
     kubernetes.io/tls-acme: "true"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
 spec:
   ingressClassName: nginx
   tls:

adhoc-config/oauth2-proxy.yaml

@@ -0,0 +1,177 @@
+---
+# OAuth2 Proxy configured to use Pocket ID as OIDC provider
+# This acts as the authentication middleware between NGINX Ingress and Pocket ID
+apiVersion: v1
+kind: Secret
+metadata:
+  name: pocket-id-oauth-proxy-secrets
+  namespace: nginx-ingress
+type: Opaque
+stringData:
+  # Generate with: openssl rand -base64 32 | head -c 32 | base64
+  cookie-secret: "TDhNb1p1ZGpYem4xL2ZiV0E2V1pacXYwTS8rbzZWazY="
+  # Get these from Pocket ID OIDC client configuration
+  client-id: "4119945b-29db-40fa-bafe-7698ae8b1342"
+  client-secret: "pKiKmd5v0w9h0fMNvwjS7poycSBz8c3t"
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pocket-id-oauth-proxy-config
+  namespace: nginx-ingress
+data:
+  oauth2_proxy.cfg: |
+    # OIDC Provider Configuration (Pocket ID)
+    provider = "oidc"
+    oidc_issuer_url = "https://pass.junv.cc"
+
+    # Client Configuration
+    client_id = "YOUR-POCKET-ID-CLIENT-ID"
+    client_secret = "YOUR-POCKET-ID-CLIENT-SECRET"
+
+    # Cookie Configuration
+    cookie_name = "_oauth2_proxy"
+    cookie_secret = "CHANGE-ME-GENERATE-NEW-SECRET"
+    cookie_secure = true
+    cookie_httponly = true
+    cookie_domains = [".junv.cc"]
+    cookie_expire = "168h"
+    cookie_refresh = "1h"
+
+    # Email Configuration
+    email_domains = ["*"]
+
+    # Upstream Configuration
+    upstreams = ["static://200"]
+
+    # Server Configuration
+    http_address = "0.0.0.0:4180"
+    reverse_proxy = true
+
+    # Header Configuration
+    set_xauthrequest = true
+    pass_access_token = true
+    pass_authorization_header = true
+
+    # Redirect Configuration
+    redirect_url = "https://pass.junv.cc/oauth2/callback"
+
+    # Logging
+    request_logging = true
+    auth_logging = true
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pocket-id-oauth-proxy
+  namespace: nginx-ingress
+  labels:
+    app: pocket-id-oauth-proxy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pocket-id-oauth-proxy
+  template:
+    metadata:
+      labels:
+        app: pocket-id-oauth-proxy
+    spec:
+      containers:
+      - name: pocket-id-oauth-proxy
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
+        args:
+        - --config=/etc/oauth2-proxy/oauth2_proxy.cfg
+        env:
+        - name: OAUTH2_PROXY_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              name: pocket-id-oauth-proxy-secrets
+              key: client-id
+        - name: OAUTH2_PROXY_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: pocket-id-oauth-proxy-secrets
+              key: client-secret
+        - name: OAUTH2_PROXY_COOKIE_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: pocket-id-oauth-proxy-secrets
+              key: cookie-secret
+        ports:
+        - containerPort: 4180
+          protocol: TCP
+          name: http
+        volumeMounts:
+        - name: config
+          mountPath: /etc/oauth2-proxy
+        livenessProbe:
+          httpGet:
+            path: /ping
+            port: 4180
+          initialDelaySeconds: 10
+          timeoutSeconds: 1
+        readinessProbe:
+          httpGet:
+            path: /ping
+            port: 4180
+          initialDelaySeconds: 10
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: "500m"
+            memory: "256Mi"
+          requests:
+            cpu: "100m"
+            memory: "128Mi"
+      volumes:
+      - name: config
+        configMap:
+          name: pocket-id-oauth-proxy-config
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pocket-id-oauth-proxy
+  namespace: nginx-ingress
+  labels:
+    app: pocket-id-oauth-proxy
+spec:
+  type: ClusterIP
+  ports:
+  - port: 4180
+    targetPort: 4180
+    protocol: TCP
+    name: http
+  selector:
+    app: pocket-id-oauth-proxy
+
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: pocket-id-oauth-proxy-ingress
+  namespace: nginx-ingress
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - pass.junv.cc
+    secretName: pocket-id-oauth-proxy-tls
+  rules:
+  - host: pass.junv.cc
+    http:
+      paths:
+      - path: /oauth2
+        pathType: Prefix
+        backend:
+          service:
+            name: pocket-id-oauth-proxy
+            port:
+              number: 4180

adhoc-config/prometheus-ingress.yml

@@ -6,8 +6,8 @@ metadata:
   annotations:
     kubernetes.io/tls-acme: "true"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
 spec:
   ingressClassName: nginx
   tls:

ai/crawl4ai.yaml

@@ -143,8 +143,8 @@ metadata:
     kubernetes.io/ingress.class: "nginx"
     kubernetes.io/tls-acme: "true"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
     # Increase proxy timeouts for long-running crawl operations
     nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "300"

argocd-values.yaml

@@ -28,8 +28,8 @@ server:
       kubernetes.io/tls-acme: "true"
       cert-manager.io/cluster-issuer: "letsencrypt-prod"
       nginx.ingress.kubernetes.io/proxy-body-size: 102400m
-      nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+      nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+      nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
     hostname: "argo.junv.cc"
     tls:
     - hosts:

home-apps/home-proxy.yaml

@@ -201,8 +201,8 @@ metadata:
     kubernetes.io/tls-acme: "true"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     nginx.ingress.kubernetes.io/proxy-body-size: 1024000m
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
 spec:
   ingressClassName: nginx
   tls:
@@ -231,8 +231,8 @@ metadata:
   annotations:
     kubernetes.io/tls-acme: "true"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
 spec:
   ingressClassName: nginx
   tls:
@@ -262,8 +262,8 @@ metadata:
     kubernetes.io/tls-acme: "true"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
 spec:
   ingressClassName: nginx
   tls:
@@ -320,8 +320,8 @@ metadata:
   annotations:
     kubernetes.io/tls-acme: "true"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
 spec:
   ingressClassName: nginx
   tls:

home-apps/home.yaml

@@ -47,8 +47,8 @@ metadata:
   namespace: home-apps
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
 spec:
   ingressClassName: nginx
   tls:

home-apps/n8n.yaml

@@ -145,8 +145,8 @@ metadata:
   name: n8n-ingress
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
 spec:
   ingressClassName: nginx
   tls:

media/alist.yaml

@@ -93,8 +93,8 @@ metadata:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     nginx.ingress.kubernetes.io/proxy-body-size: 102400m
     nginx.ingress.kubernetes.io/whitelist-source-range: "192.168.1.0/24"
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
 spec:
   tls:
   - hosts:

media/jackett.yaml

@@ -90,8 +90,8 @@ metadata:
     kubernetes.io/ingress.class: "nginx"
     kubernetes.io/tls-acme: "true"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth?email=wahyd4%40gmail.com"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?email=wahyd4%40gmail.com&redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
 spec:
   tls:
   - hosts:

media/media.yaml

@@ -559,8 +559,8 @@ metadata:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     # 200G
     nginx.ingress.kubernetes.io/proxy-body-size: 204800m
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
 spec:
   tls:
   - hosts:
@@ -616,8 +616,8 @@ metadata:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     # 200G
     nginx.ingress.kubernetes.io/proxy-body-size: 204800m
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
 spec:
   tls:
   - hosts:

media/static-file.yaml

@@ -139,8 +139,8 @@ metadata:
     kubernetes.io/ingress.class: "nginx"
     kubernetes.io/tls-acme: "true"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri"
 spec:
   tls:
   - hosts:

traefik-middleware/global-auth.yaml

@@ -1,15 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: global-auth
-  namespace: traefik-middleware
-spec:
-  forwardAuth:
-    address: "https://pass.junv.cc/auth"
-    authRequestHeaders:
-      - "X-Forwarded-Proto"
-      - "X-Forwarded-Host"
-      - "X-Forwarded-Uri"
-    authResponseHeaders:
-      - "X-Forwarded-User"
-    trustForwardHeader: true

traefik-middleware/https-redirect.yaml

@@ -1,9 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: https-redirect
-  namespace: traefik-middleware
-spec:
-  redirectScheme:
-    scheme: https
-    permanent: true