From 9e6344fd7cddc67886a2104fbda46fe7b8ace010 Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sun, 19 Jul 2026 13:30:41 +0000 Subject: [PATCH] Fix Dozzle authentication with oauth2-proxy sidecar Switch from direct OIDC (not supported by Dozzle) to forward-proxy authentication using oauth2-proxy as a sidecar container. Changes: - Add oauth2-proxy sidecar container for OIDC authentication - Configure Dozzle to use forward-proxy auth with user headers - Update service and ingress to route to oauth2-proxy (port 4180) - Add cookie-secret to sealed secret for oauth2-proxy session management - Update documentation to reflect oauth2-proxy architecture The oauth2-proxy authenticates users via Pocket ID and forwards requests to Dozzle with X-Forwarded-User, X-Forwarded-Email, and X-Forwarded-Preferred-Username headers. Co-Authored-By: Paperclip --- apps/dozzle/README.md | 21 ++++++--- apps/dozzle/deployment.yaml | 66 +++++++++++++++++++++++------ apps/dozzle/dozzle-oidc-sealed.yaml | 5 ++- apps/dozzle/ingress.yaml | 2 +- apps/dozzle/service.yaml | 4 +- 5 files changed, 73 insertions(+), 25 deletions(-) diff --git a/apps/dozzle/README.md b/apps/dozzle/README.md index 423612a..668b540 100644 --- a/apps/dozzle/README.md +++ b/apps/dozzle/README.md @@ -7,23 +7,32 @@ Dozzle is a real-time log viewer for Docker containers running in the Kubernetes - **Namespace**: `dozzle` - **Domain**: `dozzle.basicstack.de` - **Storage**: 1Gi PVC using `hcloud-volumes-encrypted` storage class -- **Authentication**: Pocket ID OIDC integration +- **Authentication**: Pocket ID OIDC via oauth2-proxy sidecar + +## Architecture + +Dozzle doesn't support native OIDC authentication, so we use oauth2-proxy as a sidecar container: + +1. **oauth2-proxy** (port 4180): Handles OIDC authentication with Pocket ID +2. **Dozzle** (port 8080): Receives authenticated requests from oauth2-proxy with user headers + +The oauth2-proxy authenticates users via Pocket ID OIDC and forwards authenticated requests to Dozzle with `X-Forwarded-User`, `X-Forwarded-Email`, and `X-Forwarded-Preferred-Username` headers. Dozzle is configured with `forward-proxy` authentication to trust these headers. ## Files - `namespace.yaml`: Dozzle namespace - `service-account.yaml`: Service account with RBAC for accessing pod logs cluster-wide - `pvc.yaml`: Persistent volume claim for Dozzle settings (1Gi, ReadWriteOnce with Recreate strategy) -- `deployment.yaml`: Dozzle deployment with OIDC authentication -- `service.yaml`: Kubernetes service -- `ingress.yaml`: Traefik ingress with TLS -- `dozzle-oidc-sealed.yaml`: Sealed secret with OIDC credentials +- `deployment.yaml`: Dozzle deployment with oauth2-proxy sidecar +- `service.yaml`: Kubernetes service (routes to oauth2-proxy port 4180) +- `ingress.yaml`: Traefik ingress with TLS (routes to oauth2-proxy) +- `dozzle-oidc-sealed.yaml`: Sealed secret with OIDC client credentials and oauth2-proxy cookie secret ## Pocket ID OIDC Client - **Client ID**: `179c13f2-d251-4e1e-b1a0-c070df350c4e` - **Client Name**: Dozzle -- **Callback URL**: `https://dozzle.basicstack.de/oauth/callback` +- **Callback URL**: `https://dozzle.basicstack.de/oauth2/callback` - **Scopes**: `openid profile email` ## Access diff --git a/apps/dozzle/deployment.yaml b/apps/dozzle/deployment.yaml index ac24cf4..afa4f91 100644 --- a/apps/dozzle/deployment.yaml +++ b/apps/dozzle/deployment.yaml @@ -21,25 +21,19 @@ spec: image: amir20/dozzle:latest ports: - containerPort: 8080 - name: http + name: dozzle-http protocol: TCP env: - name: DOZZLE_LEVEL value: "info" - name: DOZZLE_AUTH_PROVIDER - value: "oidc" - - name: DOZZLE_AUTH_OIDC_PROVIDER_URL - value: "https://auth.basicstack.de" - - name: DOZZLE_AUTH_OIDC_CLIENT_ID - valueFrom: - secretKeyRef: - name: dozzle-oidc - key: client-id - - name: DOZZLE_AUTH_OIDC_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: dozzle-oidc - key: client-secret + value: "forward-proxy" + - name: DOZZLE_AUTH_HEADER_USER + value: "X-Forwarded-User" + - name: DOZZLE_AUTH_HEADER_EMAIL + value: "X-Forwarded-Email" + - name: DOZZLE_AUTH_HEADER_NAME + value: "X-Forwarded-Preferred-Username" volumeMounts: - name: dozzle-data mountPath: /data @@ -50,6 +44,50 @@ spec: requests: cpu: 100m memory: 128Mi + - name: oauth2-proxy + image: quay.io/oauth2-proxy/oauth2-proxy:latest + ports: + - containerPort: 4180 + name: http + protocol: TCP + args: + - --http-address=0.0.0.0:4180 + - --upstream=http://localhost:8080 + - --provider=oidc + - --oidc-issuer-url=https://auth.basicstack.de + - --redirect-url=https://dozzle.basicstack.de/oauth2/callback + - --email-domain=* + - --pass-user-headers=true + - --set-xauthrequest=true + - --pass-access-token=false + - --cookie-secure=true + - --cookie-httponly=true + - --cookie-name=__Host-oauth2-proxy + - --cookie-expire=12h + - --code-challenge-method=S256 + env: + - name: OAUTH2_PROXY_CLIENT_ID + valueFrom: + secretKeyRef: + name: dozzle-oidc + key: client-id + - name: OAUTH2_PROXY_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: dozzle-oidc + key: client-secret + - name: OAUTH2_PROXY_COOKIE_SECRET + valueFrom: + secretKeyRef: + name: dozzle-oidc + key: cookie-secret + resources: + limits: + cpu: 200m + memory: 256Mi + requests: + cpu: 50m + memory: 64Mi volumes: - name: dozzle-data persistentVolumeClaim: diff --git a/apps/dozzle/dozzle-oidc-sealed.yaml b/apps/dozzle/dozzle-oidc-sealed.yaml index 6a23fa1..59d0707 100644 --- a/apps/dozzle/dozzle-oidc-sealed.yaml +++ b/apps/dozzle/dozzle-oidc-sealed.yaml @@ -7,8 +7,9 @@ metadata: namespace: dozzle spec: encryptedData: - client-id: AgAijJ3Jxjath5x5mqYJ8YJYoDm0qEXRPvkShD53wRepXPkIInF/X+DaBfI8SEaqasfLI2j0SGLOB0xFR6j9CbiqSJ5Oy+AgI9pVB9eKLZEgrd0WywhYPW24SOflLxgsBOiQkhx6xy+S3dg7qj9q/CqPajnNQYS/FnJsV4YOzlZekcLnizhqnK2gPykAHMoKQZLecKSScUvMzDwwS21gEuhJK+8onR63i7q+EQWbZMSH/60yAvOAJDECM9ZxAwWziCkGZAhv+Ir+W+D6Hmls6uy53uARtUktVfZM9JDBcqM9M8WltXcQKOh9lV00V3Tu6HBF+3IP1gRMzQyDnli3zG6Zdnq41+wVv4k9nh6obZBeMbx/4aib2w0uwnCBFUXI6QaK3Uy309ZUF/tu6TshQExXTAHLRafOWTKmFlrutDF3gcLZqGhVrFzsant/IRmx3xiIOYphtJyAQA8KrvNJGLXSHOpDmkE96IJPYdAPypBAb9qKEFnDe05btem1ZqyPwjm27HDxmQHsz27Bnhd3o3a7I+cO7mM6J4yJex4zRiN/DEZfmxqfnGI2AwByn+xdxlCdxqjfAVn5NGo24KPLmayxNxSDeF/2tLl8uXaCPn0Q2qALgsMvbTmujLdU9PXsHqM6D5W9OOu1aG2MocIg/uMRXld9PjHG1mpw/81G1B/qVsY5BIlessEksoIARRb7DmVEmf18KjONnQc47VuQWmtjPgPtYdAeekUxxPwnMbtZVA/xYEM= - client-secret: AgBjUlnxkPi0KVwb/lM/C+F72+aU6TTGWk/t3hpYkCApG7lFuFukshwIi2WWf09UMa5HwHLDuF+a4pf88+JYgecE0tU3oAcDHHiL2xN97bjebustcLAM0JqORPW10yMJ0xqLg70SFyp/rR7AdJAIVETvTB/dxheaP7gtbR1m669FrP3MiAIcV2U2b3HUc1iw0tkpNv+lQD33b5pStSlZDdc8eg2xmfiLgsCTzVla3lysAtGwXORsaP9L1HOhCy4GDc3YfeAdbIsNbFy2q/ug6vlytM6rHZgwt9Pmln7CTQGuLkDPPN3qG79TUIUgQ4nK+CxVXZYq044b+2G+mihdEfNe6GwmQus/SsFqhv5+nQcxWJKZwl3VSf3zhWBLRSbnYSvTRnGyqOGnc5isffxNnXWuJ0UUBiV8wcy9l9j2La4isB+GTEIlUZTPxyCwCx3v43ugb0BzhEPpQ5kB/FR0kdQgBcYitxE+sonwe7CUcv+wDtm1JtDwPyTJLKY2JSFGafsJtoTf8VFIyXdXe4I54gRA5c51TW+86spKqCy01UGhOR9wbo/pzf/esG9SHaOZNDPWeXTZneLdeYRf+RVj+eGRusRaGgByKgIDR9UHiJQTPvJC35YB/J7glJN0+kkO2UVrlYeD+o6ukWttfE2oW2aPxHXrMs68iUsgyLg/Lpc0MwzjJqGnBXYHhbbEcg9Oa6p/OxvQhOpzXq0GtIhd70iXsmlrRMCp8YlW+Lq/kExWQA== + client-id: AgBNals2yE6cxlM9ZRQBj4iWka8F7ldPlmypB9MphG3ywoDkWpPzqlcKmmg3C98s4FwxGuYEr3CcSH46E5DhBsS5Xm5IZ+pJ27VVSdYaJe/3tkSWGTnB56Oq30Gr1pPLToVSp24rSHQVd2VcNdy/lizFGB757b6zKsR+0yVKNETWdXefhbCfZbKmaznGTYd5weGlH9Gz4x79jP2ZaFAgNLL+QYzpmoFHdQTWycyKYj3Hwy4guKxyN1eqNf/70Vk7RbbpiNX/7nF0s3+FaPi/Lqnc3AzrnrCunlGFvwjiKOX4ORAPGJRe8tTybutVAx9I5eAoNyHSuE0nJvobi6PmT9EhFtldRg60Nuw3amIhCty77eyu3tJobw9fJ9c+7Nt7mpS/+pJyKYfYXmyTUzfSX4zRKd/U0+A0VuVTaYjadbyV7s4A2Z0y3trJ+DZlWC2DqgA38FmY59CYt6ZDgFzXooWrapCSy/dW+yzG9XYz2WZQHlYyGSg3mQA3TZETAbg+lunKwZXl+Byc8Dyz2pwIISsFHHrBsr+B7tbx0pBQTvL9cNNAkvJvJ6F8YG+I+6nw5W5WFgB2CN1md/AEITiNB7tqVnC+/BJXXdNLzeUkcXEwLkH9MDQgZBlJrP6kjUlnm5bWZOckv8xy6ZFkbfqtPCdxCv+AhkNa+gCPmRAt1VeR1NsCP+jfzhm8Cu9j3j1CQaPJvmDDiO/r3bWD1ACBwXULa/98BAsEYlENdnl5vpIswKbE1ag= + client-secret: AgBaOMjTwXmqocYK4Xe/i45ByFCVnUiums3hVVxK7xMk8oV+voIsWQRdW8HF6wPfG7T54Ga5AxYj3wousZ/8Z1TIigQTBTD9DIGZfyTndY38cztyNNB0WPgpA2TQ0VHa0OwPC7+V2Pc+IY/eFa9GghkZA5DBjnT7DnyclJcuQwjvdvgOwYP4xtOZ1+nvUq3FSeN6gAyqUH+aVvkhhUAJ44WxqOdL86QlUiSUJaf+Qr9ABQp2Or+76mjt5FW3mxFrHfzDnmbxVq1WOJub8fHlKFw83D5PVnle4ThbVATn2yO7cxuZc/qJc1EB6pPySEIczv62gvbNzZjodXVTk8F+2WanKgBbETJxVo43G+BUJy3IqO4G+2wAhDVR48wugpsT3MQtPvHmDJLiHov5tBzaFN6d8jQZY8ngU9VuZS+grsByVKyEQU7v1lgdIyNTaaWTEn2ppGWmIO+yB6/m5DRa+K6TZHgpQp7jJQqCHSSIevZ0Q0hor8TmdZurJ+20FQX4/QdS2EaNdLPi+wc49hAmCtwBbj0itaGE4DsnP586G9coqD8YLzyPWmiu2HunqFWdenhb+mnw2pFEF+GYQcN+ZGn5KwDJcQAfkE/4pY1SeHpKQVsLiaFah8iydZvK8sW7Ep5+r9tjTUbu9JU8HlwuWwytAEtXXysP9lLMfHLOrHr0EA2J51vfgZT53vMwctE96fsBOR4AVd8Ns7bj/F+snBq7M8+JqPvD3/++5oRWBQtLGA== + cookie-secret: AgArAJOvo7vgt1Gy0mG+5AajPkwJ/vfyV2U193A8NK4NukB2I59ZkqRgWhmEpedbwAxonxtkLlXb8Vu5bdKgeS5No9JhaGYJt0KDtiYhnEx7ov5MCIB4zxAUa+GJixvCAglw0b6awkk7lGT68w09rwQ1DNWdG66nKFNep/RaZFbjWW61MlaIEJ7xjJ8zg797082IyqrcBM6FeHsgOH1Cl/pGAUqtCIX1Oo9NKrp0Qojj0ETc1kNFcixn1hNDLTBDFn3lmceUCz3MADY+0hJEa9AR0kkH5ulGW5hXRCM402W9CZdux/IOweGvWqfg9Jn7f8lhjEx6aUmcUFlumMZRSvAJIvG3Hncjot0Zk5CPm2RCdJ7nr2bibqXKl/LOh9g1qhSRCSM1i7DggcI0qAuCmhwq1zWqatYOVslk5yBYPW2khTfEe4nqf63AjbcORWuZQ4U6fOc1RFD/rb+ISvKDfcIT58cAsT80+NC+2bXQY2wKLrXVV5sv+EksDzUKCP4g1GPLFiTi8paI5R/o6OWe90AX7DD/7pJvXLiw56OhC7GQapTOYk5l6+/Cw+B7U9CzcTAP8E8+b35lWRHYl3iClSUDVlzGvjDju5r6wUVfA1JaaCayN/IXqpf0Xk5p6xeVSU+Tn8hzthh6Ooip6FY2KSBXqNZ+0wCEpBzXlehxzIUXymOgE1ZNpH3MRso+3yMpKG70zGfcziE7llmWb4QhNq7WzZih1CMZuS7mCvsuUnK7+1wiMBYhesnPp9QVrQ== template: metadata: creationTimestamp: null diff --git a/apps/dozzle/ingress.yaml b/apps/dozzle/ingress.yaml index e617348..1859d5b 100644 --- a/apps/dozzle/ingress.yaml +++ b/apps/dozzle/ingress.yaml @@ -19,7 +19,7 @@ spec: service: name: dozzle port: - number: 8080 + number: 4180 tls: - hosts: - dozzle.basicstack.de diff --git a/apps/dozzle/service.yaml b/apps/dozzle/service.yaml index 293d189..7253efa 100644 --- a/apps/dozzle/service.yaml +++ b/apps/dozzle/service.yaml @@ -8,6 +8,6 @@ spec: app: dozzle ports: - name: http - port: 8080 - targetPort: 8080 + port: 4180 + targetPort: 4180 protocol: TCP