Trey t
b66151ddd9
First phase of replacing the hand-rolled auth (internal/services/auth_service.go
et al.) with Ory Kratos. This commit is infrastructure only — Kratos will run
but nothing consumes it yet; the Go API still does its own auth until phase 2.
Adds deploy-k3s/manifests/kratos/:
- configmap.yaml — kratos.yml, identity schema, Google/Apple OIDC claim
mappers (no secrets in the ConfigMap)
- migrate-job.yaml — `kratos migrate sql`, run before the Deployment
- kratos.yaml — Deployment (x2), Service, NetworkPolicies
- ingress.yaml — auth.myhoneydue.com -> Kratos public API :4433
- README.md — operator prerequisites + deploy runbook
Wiring:
- 02-setup-secrets.sh creates kratos-secrets, gated on a config.yaml `kratos:`
block (DSN, cookie/cipher, SMTP URI, OIDC client secret, Apple key).
- 03-deploy.sh applies the Kratos manifests + runs the migrate Job, gated on
the kratos-secrets Secret existing.
Both gates mean the existing stack deploys completely unaffected until the
operator completes the prerequisites (Neon `kratos` DB, auth.myhoneydue.com
DNS, Apple/Google OAuth apps, Kratos image version). Pre-production, so no
user-data migration — see manifests/kratos/README.md.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
39 lines
1.3 KiB
YAML
39 lines
1.3 KiB
YAML
# Public ingress for Ory Kratos — auth.myhoneydue.com → Kratos public API :4433.
|
|
#
|
|
# Chains the same edge middlewares as the honeyDue API ingress: cloudflare-only
|
|
# (reject non-Cloudflare source IPs), security-headers, and the general
|
|
# rate-limit. Kratos's self-service flows are multi-request, so the strict
|
|
# auth-rate-limit (5/min) is intentionally NOT used here — Kratos applies its
|
|
# own per-flow protections.
|
|
#
|
|
# OPERATOR: confirm the cloudflare-origin-cert TLS secret covers
|
|
# auth.myhoneydue.com (apex + wildcard origin cert), and add the
|
|
# auth.myhoneydue.com DNS record in Cloudflare (proxied) → cluster ingress.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: honeydue-auth
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/name: kratos
|
|
app.kubernetes.io/part-of: honeydue
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.middlewares: honeydue-cloudflare-only@kubernetescrd,honeydue-security-headers@kubernetescrd,honeydue-rate-limit@kubernetescrd
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- auth.myhoneydue.com
|
|
secretName: cloudflare-origin-cert
|
|
rules:
|
|
- host: auth.myhoneydue.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: kratos
|
|
port:
|
|
number: 4433
|