add oauth2-proxy

flux/olympus/apps/services/grist/external-secret.yaml

@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: grist
+  namespace: services
+spec:
+  refreshInterval: "5m"
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: grist
+  data:
+    - secretKey: GRIST_SESSION_SECRET
+      remoteRef:
+        key: services/grist
+        property: grist_session_secret

flux/olympus/apps/services/grist/grist.yaml

@@ -0,0 +1,47 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: grist
+  namespace: services
+  labels:
+    app: grist
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: grist
+  template:
+    metadata:
+      labels:
+        app: grist
+    spec:
+      volumes:
+        - name: persist
+          persistentVolumeClaim:
+          claimName: grist
+      containers:
+        - name: grist-core
+          image: gristlabs/grist:1.1.7
+          volumeMounts:
+            - name: persist
+              mountPath: /persist
+          env:
+            - name: APP_HOME_URL
+              value: "https://grist.0x76.dev"
+            - name: GRIST_SINGLE_ORG
+              value: ""
+            - name: GRIST_SUPPORT_ANON
+              value: false
+            - name: PYTHON_VERSION
+              value: 3
+            - name: PYTHON_VERSION_ON_CREATION
+              value: 3
+            - name: GRIST_FORWARD_AUTH_HEADER
+              value: X-Forwarded-User
+            - name: GRIST_FORWARD_AUTH_LOGOUT_PATH
+              value: /_oauth/logout
+          envFrom:
+            - secretRef:
+                name: grist
+          ports:
+            - containerPort: 8484

flux/olympus/apps/services/grist/ingress.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: grist
+  namespace: services
+spec:
+  selector:
+    app: grist
+  ports:
+    - protocol: TCP
+      port: 8484
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: grist
+  namespace: services
+spec:
+  rules:
+    - host: "grist.0x76.dev"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: grist
+                port:
+                  number: 8484

flux/olympus/apps/services/grist/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - external-secret.yaml
+  - pvc.yaml
+  - grist.yaml
+  - ingress.yaml

flux/olympus/apps/services/grist/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: grist
+  namespace: services
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 2Gi

flux/olympus/apps/services/kustomization.yaml

@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - renovate
+  - oauth2-proxy

flux/olympus/apps/services/oauth2-proxy/external-secret.yaml

@@ -0,0 +1,25 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: oauth2-proxy
+  namespace: services
+spec:
+  refreshInterval: "5m"
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: oauth2-proxy
+  data:
+    - secretKey: OAUTH2_PROXY_CLIENT_ID
+      remoteRef:
+        key: services/oauth2-proxy
+        property: client_id
+    - secretKey: OAUTH2_PROXY_CLIENT_SECRET
+      remoteRef:
+        key: services/oauth2-proxy
+        property: client_secret
+    - secretKey: OAUTH2_PROXY_COOKIE_SECRET
+      remoteRef:
+        key: services/oauth2-proxy
+        property: cookie_secret

flux/olympus/apps/services/oauth2-proxy/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - external-secret.yaml
+  - oauth2-proxy.yaml

flux/olympus/apps/services/oauth2-proxy/oauth2-proxy.yaml

@@ -0,0 +1,67 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    k8s-app: oauth2-proxy
+  name: oauth2-proxy
+  namespace: services
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      k8s-app: oauth2-proxy
+  template:
+    metadata:
+      labels:
+        k8s-app: oauth2-proxy
+    spec:
+      containers:
+      - args:
+        - --provider=oidc
+        - --provider-display2-name="Dex"
+        - --oidc-issuer-url=https://dex.0x76.dev/dex
+        - --redirect-url=https://o2p.0x76.dev/oauth2/callback
+        - --cookie-secure=false
+        - --http-address=0.0.0.0:4180
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
+        envFrom:
+          - secretRef:
+              name: oauth2-proxy
+        name: oauth2-proxy
+        ports:
+        - containerPort: 4180
+          protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    k8s-app: oauth2-proxy
+  name: oauth2-proxy
+  namespace: services
+spec:
+  ports:
+  - name: http
+    port: 4180
+    protocol: TCP
+    targetPort: 4180
+  selector:
+    k8s-app: oauth2-proxy
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: oauth2-proxy
+  namespace: services
+spec:
+  rules:
+    - host: "o2p.0x76.dev"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy
+                port:
+                  number: 4180

nixos/hosts/olympus/dex/configuration.nix

@@ -90,6 +90,12 @@ in
           redirectURIs = [ "https://flux.0x76.dev/oauth2/callback" ];
           secretEnv = "FLUX_CLIENT_SECRET";
         }
+        {
+          id = "oauth2-proxy";
+          name = "OAuth2 Proxy";
+          redirectURIs = [ "https://o2p.0x76.dev/oauth2/callback" ];
+          secretEnv = "O2P_CLIENT_SECRET";
+        }
       ];
     };