olb042
6f29be2987
Validate login GitOps repo / validate (push) Successful in 9s
- Keycloak Operator v26 deployed to keycloak-system namespace - Keycloak HA instance (2 replicas, jdbc-ping cluster discovery) - Dedicated CNPG cluster (local-postgres storage, 2 instances) - KeycloakRealmImport: home-lab realm with groups and traefik-oidc client - Traefik IngressRoute: login.olb42.com (CF Access bypass) - Admin credentials placeholder (seal before first deploy) - ArgoCD ApplicationSets: login-operator + login
37 lines
1.1 KiB
YAML
37 lines
1.1 KiB
YAML
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: login
|
|
namespace: login
|
|
annotations:
|
|
# Cloudflare tunnel: public access, bypass CF Access
|
|
# Keycloak IS the auth provider — it must be reachable before any OIDC
|
|
# flow can begin, so CF Access must not gate it.
|
|
dns.public: "true"
|
|
dns.public.access.policy: bypass
|
|
dns.public.hostname: login.olb42.com
|
|
|
|
# Homepage service discovery
|
|
gethomepage.dev/enabled: "true"
|
|
gethomepage.dev/name: "Keycloak"
|
|
gethomepage.dev/group: "Security"
|
|
gethomepage.dev/description: "Identity & Access Management (operator-managed)"
|
|
gethomepage.dev/href: "https://login.olb42.com"
|
|
gethomepage.dev/icon: "keycloak"
|
|
gethomepage.dev/app: "keycloak"
|
|
gethomepage.dev/namespace: "login"
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- match: Host(`login.olb42.com`)
|
|
kind: Rule
|
|
# No OIDC middleware: Keycloak is the identity provider itself.
|
|
# Traefik passes traffic straight through to the Keycloak service.
|
|
services:
|
|
- name: keycloak-service
|
|
namespace: login
|
|
port: 8080
|
|
tls:
|
|
secretName: olb42-wildcard-tls
|