From 7ed0ddeab8080c9fc33ede529a159d0470ffcd5f Mon Sep 17 00:00:00 2001 From: Junwei Zhao Date: Mon, 24 Nov 2025 12:16:37 +1100 Subject: [PATCH] Update pass --- adhoc-config/grafana-ingress.yml | 4 +- adhoc-config/oauth2-proxy.yaml | 177 +++++++++++++++++++++++++ adhoc-config/prometheus-ingress.yml | 4 +- ai/crawl4ai.yaml | 4 +- argocd-values.yaml | 4 +- home-apps/home-proxy.yaml | 16 +-- home-apps/home.yaml | 4 +- home-apps/n8n.yaml | 4 +- media/alist.yaml | 4 +- media/jackett.yaml | 4 +- media/media.yaml | 8 +- media/static-file.yaml | 4 +- traefik-middleware/global-auth.yaml | 15 --- traefik-middleware/https-redirect.yaml | 9 -- 14 files changed, 207 insertions(+), 54 deletions(-) create mode 100644 adhoc-config/oauth2-proxy.yaml delete mode 100644 traefik-middleware/global-auth.yaml delete mode 100644 traefik-middleware/https-redirect.yaml diff --git a/adhoc-config/grafana-ingress.yml b/adhoc-config/grafana-ingress.yml index fc5dbb1..d880d7e 100644 --- a/adhoc-config/grafana-ingress.yml +++ b/adhoc-config/grafana-ingress.yml @@ -6,8 +6,8 @@ metadata: annotations: kubernetes.io/tls-acme: "true" cert-manager.io/cluster-issuer: "letsencrypt-prod" - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" spec: ingressClassName: nginx tls: diff --git a/adhoc-config/oauth2-proxy.yaml b/adhoc-config/oauth2-proxy.yaml new file mode 100644 index 0000000..341355c --- /dev/null +++ b/adhoc-config/oauth2-proxy.yaml @@ -0,0 +1,177 @@ +--- +# OAuth2 Proxy configured to use Pocket ID as OIDC provider +# This acts as the authentication middleware between NGINX Ingress and Pocket ID +apiVersion: v1 +kind: Secret +metadata: + name: pocket-id-oauth-proxy-secrets + namespace: nginx-ingress +type: Opaque +stringData: + # Generate with: openssl rand -base64 32 | head -c 32 | base64 + cookie-secret: "TDhNb1p1ZGpYem4xL2ZiV0E2V1pacXYwTS8rbzZWazY=" + # Get these from Pocket ID OIDC client configuration + client-id: "4119945b-29db-40fa-bafe-7698ae8b1342" + client-secret: "pKiKmd5v0w9h0fMNvwjS7poycSBz8c3t" + +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: pocket-id-oauth-proxy-config + namespace: nginx-ingress +data: + oauth2_proxy.cfg: | + # OIDC Provider Configuration (Pocket ID) + provider = "oidc" + oidc_issuer_url = "https://pass.junv.cc" + + # Client Configuration + client_id = "YOUR-POCKET-ID-CLIENT-ID" + client_secret = "YOUR-POCKET-ID-CLIENT-SECRET" + + # Cookie Configuration + cookie_name = "_oauth2_proxy" + cookie_secret = "CHANGE-ME-GENERATE-NEW-SECRET" + cookie_secure = true + cookie_httponly = true + cookie_domains = [".junv.cc"] + cookie_expire = "168h" + cookie_refresh = "1h" + + # Email Configuration + email_domains = ["*"] + + # Upstream Configuration + upstreams = ["static://200"] + + # Server Configuration + http_address = "0.0.0.0:4180" + reverse_proxy = true + + # Header Configuration + set_xauthrequest = true + pass_access_token = true + pass_authorization_header = true + + # Redirect Configuration + redirect_url = "https://pass.junv.cc/oauth2/callback" + + # Logging + request_logging = true + auth_logging = true + +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: pocket-id-oauth-proxy + namespace: nginx-ingress + labels: + app: pocket-id-oauth-proxy +spec: + replicas: 1 + selector: + matchLabels: + app: pocket-id-oauth-proxy + template: + metadata: + labels: + app: pocket-id-oauth-proxy + spec: + containers: + - name: pocket-id-oauth-proxy + image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0 + args: + - --config=/etc/oauth2-proxy/oauth2_proxy.cfg + env: + - name: OAUTH2_PROXY_CLIENT_ID + valueFrom: + secretKeyRef: + name: pocket-id-oauth-proxy-secrets + key: client-id + - name: OAUTH2_PROXY_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: pocket-id-oauth-proxy-secrets + key: client-secret + - name: OAUTH2_PROXY_COOKIE_SECRET + valueFrom: + secretKeyRef: + name: pocket-id-oauth-proxy-secrets + key: cookie-secret + ports: + - containerPort: 4180 + protocol: TCP + name: http + volumeMounts: + - name: config + mountPath: /etc/oauth2-proxy + livenessProbe: + httpGet: + path: /ping + port: 4180 + initialDelaySeconds: 10 + timeoutSeconds: 1 + readinessProbe: + httpGet: + path: /ping + port: 4180 + initialDelaySeconds: 10 + timeoutSeconds: 1 + resources: + limits: + cpu: "500m" + memory: "256Mi" + requests: + cpu: "100m" + memory: "128Mi" + volumes: + - name: config + configMap: + name: pocket-id-oauth-proxy-config + +--- +apiVersion: v1 +kind: Service +metadata: + name: pocket-id-oauth-proxy + namespace: nginx-ingress + labels: + app: pocket-id-oauth-proxy +spec: + type: ClusterIP + ports: + - port: 4180 + targetPort: 4180 + protocol: TCP + name: http + selector: + app: pocket-id-oauth-proxy + +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: pocket-id-oauth-proxy-ingress + namespace: nginx-ingress + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" + nginx.ingress.kubernetes.io/proxy-buffer-size: "8k" +spec: + ingressClassName: nginx + tls: + - hosts: + - pass.junv.cc + secretName: pocket-id-oauth-proxy-tls + rules: + - host: pass.junv.cc + http: + paths: + - path: /oauth2 + pathType: Prefix + backend: + service: + name: pocket-id-oauth-proxy + port: + number: 4180 diff --git a/adhoc-config/prometheus-ingress.yml b/adhoc-config/prometheus-ingress.yml index 1198fa6..dc8fb95 100644 --- a/adhoc-config/prometheus-ingress.yml +++ b/adhoc-config/prometheus-ingress.yml @@ -6,8 +6,8 @@ metadata: annotations: kubernetes.io/tls-acme: "true" cert-manager.io/cluster-issuer: "letsencrypt-prod" - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" spec: ingressClassName: nginx tls: diff --git a/ai/crawl4ai.yaml b/ai/crawl4ai.yaml index 9565eb6..9f0c625 100644 --- a/ai/crawl4ai.yaml +++ b/ai/crawl4ai.yaml @@ -143,8 +143,8 @@ metadata: kubernetes.io/ingress.class: "nginx" kubernetes.io/tls-acme: "true" cert-manager.io/cluster-issuer: "letsencrypt-prod" - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" # Increase proxy timeouts for long-running crawl operations nginx.ingress.kubernetes.io/proxy-connect-timeout: "300" nginx.ingress.kubernetes.io/proxy-send-timeout: "300" diff --git a/argocd-values.yaml b/argocd-values.yaml index 4683735..ee9d754 100644 --- a/argocd-values.yaml +++ b/argocd-values.yaml @@ -28,8 +28,8 @@ server: kubernetes.io/tls-acme: "true" cert-manager.io/cluster-issuer: "letsencrypt-prod" nginx.ingress.kubernetes.io/proxy-body-size: 102400m - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" hostname: "argo.junv.cc" tls: - hosts: diff --git a/home-apps/home-proxy.yaml b/home-apps/home-proxy.yaml index 94c0001..b7788b5 100644 --- a/home-apps/home-proxy.yaml +++ b/home-apps/home-proxy.yaml @@ -201,8 +201,8 @@ metadata: kubernetes.io/tls-acme: "true" cert-manager.io/cluster-issuer: "letsencrypt-prod" nginx.ingress.kubernetes.io/proxy-body-size: 1024000m - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" spec: ingressClassName: nginx tls: @@ -231,8 +231,8 @@ metadata: annotations: kubernetes.io/tls-acme: "true" cert-manager.io/cluster-issuer: "letsencrypt-prod" - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" spec: ingressClassName: nginx tls: @@ -262,8 +262,8 @@ metadata: kubernetes.io/tls-acme: "true" cert-manager.io/cluster-issuer: "letsencrypt-prod" # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" spec: ingressClassName: nginx tls: @@ -320,8 +320,8 @@ metadata: annotations: kubernetes.io/tls-acme: "true" cert-manager.io/cluster-issuer: "letsencrypt-prod" - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" spec: ingressClassName: nginx tls: diff --git a/home-apps/home.yaml b/home-apps/home.yaml index 214f6a4..cacb057 100644 --- a/home-apps/home.yaml +++ b/home-apps/home.yaml @@ -47,8 +47,8 @@ metadata: namespace: home-apps annotations: cert-manager.io/cluster-issuer: "letsencrypt-prod" - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" spec: ingressClassName: nginx tls: diff --git a/home-apps/n8n.yaml b/home-apps/n8n.yaml index fcfc089..85dea46 100644 --- a/home-apps/n8n.yaml +++ b/home-apps/n8n.yaml @@ -145,8 +145,8 @@ metadata: name: n8n-ingress annotations: cert-manager.io/cluster-issuer: "letsencrypt-prod" - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" spec: ingressClassName: nginx tls: diff --git a/media/alist.yaml b/media/alist.yaml index 8d5f02a..c008500 100644 --- a/media/alist.yaml +++ b/media/alist.yaml @@ -93,8 +93,8 @@ metadata: cert-manager.io/cluster-issuer: "letsencrypt-prod" nginx.ingress.kubernetes.io/proxy-body-size: 102400m nginx.ingress.kubernetes.io/whitelist-source-range: "192.168.1.0/24" - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" spec: tls: - hosts: diff --git a/media/jackett.yaml b/media/jackett.yaml index 80c15c1..a1dbb6a 100644 --- a/media/jackett.yaml +++ b/media/jackett.yaml @@ -90,8 +90,8 @@ metadata: kubernetes.io/ingress.class: "nginx" kubernetes.io/tls-acme: "true" cert-manager.io/cluster-issuer: "letsencrypt-prod" - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth?email=wahyd4%40gmail.com" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?email=wahyd4%40gmail.com&redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" spec: tls: - hosts: diff --git a/media/media.yaml b/media/media.yaml index a09c904..2077c03 100644 --- a/media/media.yaml +++ b/media/media.yaml @@ -559,8 +559,8 @@ metadata: cert-manager.io/cluster-issuer: "letsencrypt-prod" # 200G nginx.ingress.kubernetes.io/proxy-body-size: 204800m - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" spec: tls: - hosts: @@ -616,8 +616,8 @@ metadata: cert-manager.io/cluster-issuer: "letsencrypt-prod" # 200G nginx.ingress.kubernetes.io/proxy-body-size: 204800m - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" spec: tls: - hosts: diff --git a/media/static-file.yaml b/media/static-file.yaml index 929aa4e..2a6b2d3 100644 --- a/media/static-file.yaml +++ b/media/static-file.yaml @@ -139,8 +139,8 @@ metadata: kubernetes.io/ingress.class: "nginx" kubernetes.io/tls-acme: "true" cert-manager.io/cluster-issuer: "letsencrypt-prod" - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/?redirect=https%3A%2F%2F$host$request_uri" + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=$escaped_request_uri" spec: tls: - hosts: diff --git a/traefik-middleware/global-auth.yaml b/traefik-middleware/global-auth.yaml deleted file mode 100644 index 61b6194..0000000 --- a/traefik-middleware/global-auth.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: global-auth - namespace: traefik-middleware -spec: - forwardAuth: - address: "https://pass.junv.cc/auth" - authRequestHeaders: - - "X-Forwarded-Proto" - - "X-Forwarded-Host" - - "X-Forwarded-Uri" - authResponseHeaders: - - "X-Forwarded-User" - trustForwardHeader: true diff --git a/traefik-middleware/https-redirect.yaml b/traefik-middleware/https-redirect.yaml deleted file mode 100644 index edc0fcd..0000000 --- a/traefik-middleware/https-redirect.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: https-redirect - namespace: traefik-middleware -spec: - redirectScheme: - scheme: https - permanent: true