From 7e99cf3206ccf05e9019a292adefb9b0db9f0fe5 Mon Sep 17 00:00:00 2001 From: alkatrazz Date: Tue, 7 Jul 2026 16:12:33 +0200 Subject: [PATCH] feat(guacamole): SSO OIDC sur le domaine HTTPS (auth./portail.funklab.online) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bascule des endpoints OIDC de kaya.freeboxos.fr:9080/9081 vers les URLs publiques HTTPS. Les ports restent un chemin réseau valide mais le SSO est désormais canonique sur le domaine. Co-Authored-By: Claude Fable 5 --- k8s/apps/guacamole/deployment.yaml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/k8s/apps/guacamole/deployment.yaml b/k8s/apps/guacamole/deployment.yaml index 86df0e9..c99364e 100644 --- a/k8s/apps/guacamole/deployment.yaml +++ b/k8s/apps/guacamole/deployment.yaml @@ -43,19 +43,18 @@ spec: - name: WEBAPP_CONTEXT value: "ROOT" # --- SSO OIDC → Authentik (app « guacamole » dans l'UI Authentik) --- - # Endpoints navigateur : URL publique kaya.freeboxos.fr (une seule URL - # canonique, LAN inclus — hairpin NAT Freebox) ; JWKS : appel - # serveur→serveur via le Service interne + # URL canonique = domaine HTTPS (auth./portail.funklab.online), LAN inclus + # (split-horizon dnsmasq). JWKS : appel serveur→serveur via le Service interne. - name: OPENID_AUTHORIZATION_ENDPOINT - value: "http://kaya.freeboxos.fr:9081/application/o/authorize/" + value: "https://auth.funklab.online/application/o/authorize/" - name: OPENID_JWKS_ENDPOINT value: "http://authentik.auth.svc.cluster.local:9000/application/o/guacamole/jwks/" - name: OPENID_ISSUER - value: "http://kaya.freeboxos.fr:9081/application/o/guacamole/" + value: "https://auth.funklab.online/application/o/guacamole/" - name: OPENID_CLIENT_ID value: "guacamole" - name: OPENID_REDIRECT_URI - value: "http://kaya.freeboxos.fr:9080/" + value: "https://portail.funklab.online/" - name: OPENID_USERNAME_CLAIM_TYPE value: "preferred_username" - name: OPENID_SCOPE