gsdavidp/home-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update .gitignore to exclude all .tmp files and enhance clarity in middleware-https-proto.yaml by adding X-Forwarded-Host and X-Forwarded-Port headers for improved redirect handling in Headlamp.

Browse Source
This commit is contained in:
Nikholas Pcenicni
2026-05-14 18:35:49 -04:00
parent 86df02f9bd
commit 95b1866144
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@@ -6,7 +6,7 @@ talos/kubeconfig
# Local secrets # Local secrets
age-key.txt age-key.txt
.env .env
.tmp .tmp*
# Generated by ansible noble_landing_urls # Generated by ansible noble_landing_urls
ansible/output/noble-lab-ui-urls.md ansible/output/noble-lab-ui-urls.md

7
clusters/noble/bootstrap/headlamp/middleware-https-proto.yaml
View File

@@ -1,7 +1,10 @@
# Traefik terminates TLS; the hop Traefik → Headlamp is often HTTP, so Headlamp may see # Traefik terminates TLS; the hop Traefik → Headlamp is often HTTP, so Headlamp may see
# X-Forwarded-Proto=http and build OAuth redirect/callback as http — Authentik then rejects # X-Forwarded-Proto=http and build OAuth redirect/callback as http — Authentik then rejects
# the flow (redirect URI / PKCE / cookie issues). Force the external scheme for Headlamp. # the flow (redirect URI / PKCE / cookie issues). Force the external scheme for Headlamp.
# Reference from Ingress: headlamp-https-proto@kubernetescrd (same namespace as the Ingress). # Also set host/port so post-callback redirects and cookie/session logic match the browser URL
# (see Headlamp in-cluster OIDC docs: X-Forwarded-Proto; missing Forwarded-* can strand users
# after IdP login).
# Ingress ref: <namespace>-headlamp-https-proto@kubernetescrd (e.g. headlamp-headlamp-https-proto@kubernetescrd).
apiVersion: traefik.io/v1alpha1 apiVersion: traefik.io/v1alpha1
kind: Middleware kind: Middleware
metadata: metadata:
@@ -14,3 +17,5 @@ spec:
headers: headers:
customRequestHeaders: customRequestHeaders:
X-Forwarded-Proto: "https" X-Forwarded-Proto: "https"
X-Forwarded-Host: "headlamp.apps.noble.lab.pcenicni.dev"
X-Forwarded-Port: "443"