Fix Dozzle authentication with oauth2-proxy sidecar

Switch from direct OIDC (not supported by Dozzle) to forward-proxy authentication using oauth2-proxy as a sidecar container.

Changes:
- Add oauth2-proxy sidecar container for OIDC authentication
- Configure Dozzle to use forward-proxy auth with user headers
- Update service and ingress to route to oauth2-proxy (port 4180)
- Add cookie-secret to sealed secret for oauth2-proxy session management
- Update documentation to reflect oauth2-proxy architecture

The oauth2-proxy authenticates users via Pocket ID and forwards requests to Dozzle with X-Forwarded-User, X-Forwarded-Email, and X-Forwarded-Preferred-Username headers.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/dozzle/README.md

@@ -7,23 +7,32 @@ Dozzle is a real-time log viewer for Docker containers running in the Kubernetes
 - **Namespace**: `dozzle`
 - **Domain**: `dozzle.basicstack.de`
 - **Storage**: 1Gi PVC using `hcloud-volumes-encrypted` storage class
-- **Authentication**: Pocket ID OIDC integration
+- **Authentication**: Pocket ID OIDC via oauth2-proxy sidecar
+
+## Architecture
+
+Dozzle doesn't support native OIDC authentication, so we use oauth2-proxy as a sidecar container:
+
+1. **oauth2-proxy** (port 4180): Handles OIDC authentication with Pocket ID
+2. **Dozzle** (port 8080): Receives authenticated requests from oauth2-proxy with user headers
+
+The oauth2-proxy authenticates users via Pocket ID OIDC and forwards authenticated requests to Dozzle with `X-Forwarded-User`, `X-Forwarded-Email`, and `X-Forwarded-Preferred-Username` headers. Dozzle is configured with `forward-proxy` authentication to trust these headers.
 
 ## Files
 
 - `namespace.yaml`: Dozzle namespace
 - `service-account.yaml`: Service account with RBAC for accessing pod logs cluster-wide
 - `pvc.yaml`: Persistent volume claim for Dozzle settings (1Gi, ReadWriteOnce with Recreate strategy)
-- `deployment.yaml`: Dozzle deployment with OIDC authentication
+- `deployment.yaml`: Dozzle deployment with oauth2-proxy sidecar
-- `service.yaml`: Kubernetes service
+- `service.yaml`: Kubernetes service (routes to oauth2-proxy port 4180)
-- `ingress.yaml`: Traefik ingress with TLS
+- `ingress.yaml`: Traefik ingress with TLS (routes to oauth2-proxy)
-- `dozzle-oidc-sealed.yaml`: Sealed secret with OIDC credentials
+- `dozzle-oidc-sealed.yaml`: Sealed secret with OIDC client credentials and oauth2-proxy cookie secret
 
 ## Pocket ID OIDC Client
 
 - **Client ID**: `179c13f2-d251-4e1e-b1a0-c070df350c4e`
 - **Client Name**: Dozzle
-- **Callback URL**: `https://dozzle.basicstack.de/oauth/callback`
+- **Callback URL**: `https://dozzle.basicstack.de/oauth2/callback`
 - **Scopes**: `openid profile email`
 
 ## Access

apps/dozzle/deployment.yaml

@@ -21,25 +21,19 @@ spec:
         image: amir20/dozzle:latest
         ports:
         - containerPort: 8080
-          name: http
+          name: dozzle-http
           protocol: TCP
         env:
         - name: DOZZLE_LEVEL
           value: "info"
         - name: DOZZLE_AUTH_PROVIDER
-          value: "oidc"
+          value: "forward-proxy"
-        - name: DOZZLE_AUTH_OIDC_PROVIDER_URL
+        - name: DOZZLE_AUTH_HEADER_USER
-          value: "https://auth.basicstack.de"
+          value: "X-Forwarded-User"
-        - name: DOZZLE_AUTH_OIDC_CLIENT_ID
+        - name: DOZZLE_AUTH_HEADER_EMAIL
-          valueFrom:
+          value: "X-Forwarded-Email"
-            secretKeyRef:
+        - name: DOZZLE_AUTH_HEADER_NAME
-              name: dozzle-oidc
+          value: "X-Forwarded-Preferred-Username"
-              key: client-id
-        - name: DOZZLE_AUTH_OIDC_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: dozzle-oidc
-              key: client-secret
         volumeMounts:
         - name: dozzle-data
           mountPath: /data
@@ -50,6 +44,50 @@ spec:
           requests:
             cpu: 100m
             memory: 128Mi
+      - name: oauth2-proxy
+        image: quay.io/oauth2-proxy/oauth2-proxy:latest
+        ports:
+        - containerPort: 4180
+          name: http
+          protocol: TCP
+        args:
+        - --http-address=0.0.0.0:4180
+        - --upstream=http://localhost:8080
+        - --provider=oidc
+        - --oidc-issuer-url=https://auth.basicstack.de
+        - --redirect-url=https://dozzle.basicstack.de/oauth2/callback
+        - --email-domain=*
+        - --pass-user-headers=true
+        - --set-xauthrequest=true
+        - --pass-access-token=false
+        - --cookie-secure=true
+        - --cookie-httponly=true
+        - --cookie-name=__Host-oauth2-proxy
+        - --cookie-expire=12h
+        - --code-challenge-method=S256
+        env:
+        - name: OAUTH2_PROXY_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              name: dozzle-oidc
+              key: client-id
+        - name: OAUTH2_PROXY_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: dozzle-oidc
+              key: client-secret
+        - name: OAUTH2_PROXY_COOKIE_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: dozzle-oidc
+              key: cookie-secret
+        resources:
+          limits:
+            cpu: 200m
+            memory: 256Mi
+          requests:
+            cpu: 50m
+            memory: 64Mi
       volumes:
       - name: dozzle-data
         persistentVolumeClaim:

apps/dozzle/dozzle-oidc-sealed.yaml

@@ -7,8 +7,9 @@ metadata:
   namespace: dozzle
 spec:
   encryptedData:
-    client-id: AgAijJ3Jxjath5x5mqYJ8YJYoDm0qEXRPvkShD53wRepXPkIInF/X+DaBfI8SEaqasfLI2j0SGLOB0xFR6j9CbiqSJ5Oy+AgI9pVB9eKLZEgrd0WywhYPW24SOflLxgsBOiQkhx6xy+S3dg7qj9q/CqPajnNQYS/FnJsV4YOzlZekcLnizhqnK2gPykAHMoKQZLecKSScUvMzDwwS21gEuhJK+8onR63i7q+EQWbZMSH/60yAvOAJDECM9ZxAwWziCkGZAhv+Ir+W+D6Hmls6uy53uARtUktVfZM9JDBcqM9M8WltXcQKOh9lV00V3Tu6HBF+3IP1gRMzQyDnli3zG6Zdnq41+wVv4k9nh6obZBeMbx/4aib2w0uwnCBFUXI6QaK3Uy309ZUF/tu6TshQExXTAHLRafOWTKmFlrutDF3gcLZqGhVrFzsant/IRmx3xiIOYphtJyAQA8KrvNJGLXSHOpDmkE96IJPYdAPypBAb9qKEFnDe05btem1ZqyPwjm27HDxmQHsz27Bnhd3o3a7I+cO7mM6J4yJex4zRiN/DEZfmxqfnGI2AwByn+xdxlCdxqjfAVn5NGo24KPLmayxNxSDeF/2tLl8uXaCPn0Q2qALgsMvbTmujLdU9PXsHqM6D5W9OOu1aG2MocIg/uMRXld9PjHG1mpw/81G1B/qVsY5BIlessEksoIARRb7DmVEmf18KjONnQc47VuQWmtjPgPtYdAeekUxxPwnMbtZVA/xYEM=
+    client-id: AgBNals2yE6cxlM9ZRQBj4iWka8F7ldPlmypB9MphG3ywoDkWpPzqlcKmmg3C98s4FwxGuYEr3CcSH46E5DhBsS5Xm5IZ+pJ27VVSdYaJe/3tkSWGTnB56Oq30Gr1pPLToVSp24rSHQVd2VcNdy/lizFGB757b6zKsR+0yVKNETWdXefhbCfZbKmaznGTYd5weGlH9Gz4x79jP2ZaFAgNLL+QYzpmoFHdQTWycyKYj3Hwy4guKxyN1eqNf/70Vk7RbbpiNX/7nF0s3+FaPi/Lqnc3AzrnrCunlGFvwjiKOX4ORAPGJRe8tTybutVAx9I5eAoNyHSuE0nJvobi6PmT9EhFtldRg60Nuw3amIhCty77eyu3tJobw9fJ9c+7Nt7mpS/+pJyKYfYXmyTUzfSX4zRKd/U0+A0VuVTaYjadbyV7s4A2Z0y3trJ+DZlWC2DqgA38FmY59CYt6ZDgFzXooWrapCSy/dW+yzG9XYz2WZQHlYyGSg3mQA3TZETAbg+lunKwZXl+Byc8Dyz2pwIISsFHHrBsr+B7tbx0pBQTvL9cNNAkvJvJ6F8YG+I+6nw5W5WFgB2CN1md/AEITiNB7tqVnC+/BJXXdNLzeUkcXEwLkH9MDQgZBlJrP6kjUlnm5bWZOckv8xy6ZFkbfqtPCdxCv+AhkNa+gCPmRAt1VeR1NsCP+jfzhm8Cu9j3j1CQaPJvmDDiO/r3bWD1ACBwXULa/98BAsEYlENdnl5vpIswKbE1ag=
-    client-secret: AgBjUlnxkPi0KVwb/lM/C+F72+aU6TTGWk/t3hpYkCApG7lFuFukshwIi2WWf09UMa5HwHLDuF+a4pf88+JYgecE0tU3oAcDHHiL2xN97bjebustcLAM0JqORPW10yMJ0xqLg70SFyp/rR7AdJAIVETvTB/dxheaP7gtbR1m669FrP3MiAIcV2U2b3HUc1iw0tkpNv+lQD33b5pStSlZDdc8eg2xmfiLgsCTzVla3lysAtGwXORsaP9L1HOhCy4GDc3YfeAdbIsNbFy2q/ug6vlytM6rHZgwt9Pmln7CTQGuLkDPPN3qG79TUIUgQ4nK+CxVXZYq044b+2G+mihdEfNe6GwmQus/SsFqhv5+nQcxWJKZwl3VSf3zhWBLRSbnYSvTRnGyqOGnc5isffxNnXWuJ0UUBiV8wcy9l9j2La4isB+GTEIlUZTPxyCwCx3v43ugb0BzhEPpQ5kB/FR0kdQgBcYitxE+sonwe7CUcv+wDtm1JtDwPyTJLKY2JSFGafsJtoTf8VFIyXdXe4I54gRA5c51TW+86spKqCy01UGhOR9wbo/pzf/esG9SHaOZNDPWeXTZneLdeYRf+RVj+eGRusRaGgByKgIDR9UHiJQTPvJC35YB/J7glJN0+kkO2UVrlYeD+o6ukWttfE2oW2aPxHXrMs68iUsgyLg/Lpc0MwzjJqGnBXYHhbbEcg9Oa6p/OxvQhOpzXq0GtIhd70iXsmlrRMCp8YlW+Lq/kExWQA==
+    client-secret: AgBaOMjTwXmqocYK4Xe/i45ByFCVnUiums3hVVxK7xMk8oV+voIsWQRdW8HF6wPfG7T54Ga5AxYj3wousZ/8Z1TIigQTBTD9DIGZfyTndY38cztyNNB0WPgpA2TQ0VHa0OwPC7+V2Pc+IY/eFa9GghkZA5DBjnT7DnyclJcuQwjvdvgOwYP4xtOZ1+nvUq3FSeN6gAyqUH+aVvkhhUAJ44WxqOdL86QlUiSUJaf+Qr9ABQp2Or+76mjt5FW3mxFrHfzDnmbxVq1WOJub8fHlKFw83D5PVnle4ThbVATn2yO7cxuZc/qJc1EB6pPySEIczv62gvbNzZjodXVTk8F+2WanKgBbETJxVo43G+BUJy3IqO4G+2wAhDVR48wugpsT3MQtPvHmDJLiHov5tBzaFN6d8jQZY8ngU9VuZS+grsByVKyEQU7v1lgdIyNTaaWTEn2ppGWmIO+yB6/m5DRa+K6TZHgpQp7jJQqCHSSIevZ0Q0hor8TmdZurJ+20FQX4/QdS2EaNdLPi+wc49hAmCtwBbj0itaGE4DsnP586G9coqD8YLzyPWmiu2HunqFWdenhb+mnw2pFEF+GYQcN+ZGn5KwDJcQAfkE/4pY1SeHpKQVsLiaFah8iydZvK8sW7Ep5+r9tjTUbu9JU8HlwuWwytAEtXXysP9lLMfHLOrHr0EA2J51vfgZT53vMwctE96fsBOR4AVd8Ns7bj/F+snBq7M8+JqPvD3/++5oRWBQtLGA==
+    cookie-secret: AgArAJOvo7vgt1Gy0mG+5AajPkwJ/vfyV2U193A8NK4NukB2I59ZkqRgWhmEpedbwAxonxtkLlXb8Vu5bdKgeS5No9JhaGYJt0KDtiYhnEx7ov5MCIB4zxAUa+GJixvCAglw0b6awkk7lGT68w09rwQ1DNWdG66nKFNep/RaZFbjWW61MlaIEJ7xjJ8zg797082IyqrcBM6FeHsgOH1Cl/pGAUqtCIX1Oo9NKrp0Qojj0ETc1kNFcixn1hNDLTBDFn3lmceUCz3MADY+0hJEa9AR0kkH5ulGW5hXRCM402W9CZdux/IOweGvWqfg9Jn7f8lhjEx6aUmcUFlumMZRSvAJIvG3Hncjot0Zk5CPm2RCdJ7nr2bibqXKl/LOh9g1qhSRCSM1i7DggcI0qAuCmhwq1zWqatYOVslk5yBYPW2khTfEe4nqf63AjbcORWuZQ4U6fOc1RFD/rb+ISvKDfcIT58cAsT80+NC+2bXQY2wKLrXVV5sv+EksDzUKCP4g1GPLFiTi8paI5R/o6OWe90AX7DD/7pJvXLiw56OhC7GQapTOYk5l6+/Cw+B7U9CzcTAP8E8+b35lWRHYl3iClSUDVlzGvjDju5r6wUVfA1JaaCayN/IXqpf0Xk5p6xeVSU+Tn8hzthh6Ooip6FY2KSBXqNZ+0wCEpBzXlehxzIUXymOgE1ZNpH3MRso+3yMpKG70zGfcziE7llmWb4QhNq7WzZih1CMZuS7mCvsuUnK7+1wiMBYhesnPp9QVrQ==
   template:
     metadata:
       creationTimestamp: null

apps/dozzle/ingress.yaml

@@ -19,7 +19,7 @@ spec:
           service:
             name: dozzle
             port:
-              number: 8080
+              number: 4180
   tls:
   - hosts:
     - dozzle.basicstack.de

apps/dozzle/service.yaml

@@ -8,6 +8,6 @@ spec:
     app: dozzle
   ports:
   - name: http
-    port: 8080
+    port: 4180
-    targetPort: 8080
+    targetPort: 4180
     protocol: TCP