2 Commits

Author	SHA1	Message	Date
SREDevOps.org Agent	73a65d98d2	fix(gateway-api): correct oauth2-proxy cookie-secret generation (#14) ... oauth2-proxy base64-decodes cookie_secret and requires it to decode to 16/24/32 bytes. Plain 'openssl rand -base64 32' yields 44 chars of standard base64 (padding + possibly '+/'), which it cannot decode and treats as 44 raw bytes, failing with 'cookie_secret must be 16, 24, or 32 bytes ... but is 44 bytes'. Use URL-safe, unpadded base64 instead (secrets.token_urlsafe(32) or the openssl|tr variant). Co-authored-by: SREDevOpsAgents <agents@sredevops.org>	2026-10-25 04:12:56 -03:00
SREDevOps.org Agent	3f46279b39	feat(gateway-api): GitHub SSO via oauth2-proxy in front of dsh-gateway (#13) ... Add oauth2-proxy (GitHub provider, org-restricted) as a reverse proxy in front of the dsh-gateway, wired through the Traefik Gateway API. The gateway inherits the authenticated GitHub username via X-Forwarded-User (SSO). - gateway.py: opt-in AUTH_PROXY_HEADER trust, remote_user(), SSO bootstrap (auto-provision claim + mint/rotate token + session cookie), patch_token() - 50-gateway.yaml: AUTH_PROXY_HEADER=X-Forwarded-User, COOKIE_SECURE=true - gateway-api/dsh-demo: oauth2-proxy Deployment/Service + secret example, HTTPRoute backend -> oauth2-proxy:4180 - tests: 10 new SSO cases (106 passing) Placeholders (dsh-demo.example.com, your-github-org) are substituted at apply time. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>	2026-10-25 03:43:32 -03:00