Writekit/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Compare commits

base: Writekit:3ec18d5ec4e76ceef80a36aff8cd6e47e3852eb5
Branches Tags
Writekit:main
...
compare: Writekit:04b1a134fbfc8acd2e35f32b2e301f1d3df36bad
Branches Tags
Writekit:main

2 commits
3ec18d5ec4 ... 04b1a134fb

Author SHA1 Message Date
Josh
04b1a134fb fix: oauth2-proxy config and disable CF proxy for staging wildcard
Some checks failed
ci/woodpecker/push/woodpecker Pipeline failed
Details 
- Update oauth2-proxy with working GitHub OAuth config
- Add OAUTH2_PROXY_SCOPE=user for proper user info retrieval
- Add OAUTH2_PROXY_UPSTREAMS to proxy staging traffic
- Route staging.domain through oauth2-proxy
- Set *.staging DNS to non-proxied for Let's Encrypt SSL

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-09 19:47:13 +02:00
Josh
49d84487a7 fix: use correct Traefik v3 HostRegexp syntax 
Go regexp doesn't support negative lookahead (?!...).
Use proper anchored regex with escaped dots.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-09 03:57:32 +02:00
2 changed files with 8 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

20
files/stacks/docker-compose.prod.yml
View file

@ -64,16 +64,16 @@ services:
- OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:4180
- OAUTH2_PROXY_REVERSE_PROXY=true
- OAUTH2_PROXY_SET_XAUTHREQUEST=true
- OAUTH2_PROXY_PASS_ACCESS_TOKEN=true
- OAUTH2_PROXY_WHITELIST_DOMAINS=.${DOMAIN}
- OAUTH2_PROXY_REDIRECT_URL=https://staging-auth.${DOMAIN}/oauth2/callback
- OAUTH2_PROXY_UPSTREAMS=http://writekit-staging:8080
- OAUTH2_PROXY_SCOPE=user
labels:
- traefik.enable=true
- traefik.http.routers.oauth2-proxy.rule=Host(`auth.staging.${DOMAIN}`)
- traefik.http.routers.oauth2-proxy.rule=Host(`staging-auth.${DOMAIN}`) || Host(`staging.${DOMAIN}`)
- traefik.http.routers.oauth2-proxy.tls=true
- traefik.http.routers.oauth2-proxy.tls.certresolver=cloudflare
- traefik.http.services.oauth2-proxy.loadbalancer.server.port=4180
- traefik.http.middlewares.staging-auth.forwardauth.address=http://oauth2-proxy:4180/oauth2/auth
- traefik.http.middlewares.staging-auth.forwardauth.trustForwardHeader=true
- traefik.http.middlewares.staging-auth.forwardauth.authResponseHeaders=X-Auth-Request-User,X-Auth-Request-Email
networks:
- prod
@ -112,7 +112,7 @@ services:
- traefik.http.routers.writekit-prod-platform.tls=true
- traefik.http.routers.writekit-prod-platform.tls.certresolver=cloudflare
- traefik.http.routers.writekit-prod-platform.service=writekit-prod
- traefik.http.routers.writekit-prod-blogs.rule=HostRegexp(`^(?!staging\.).+\.${DOMAIN}$$`)
- traefik.http.routers.writekit-prod-blogs.rule=HostRegexp(`^.+\.${DOMAIN}$`)
- traefik.http.routers.writekit-prod-blogs.priority=10
- traefik.http.routers.writekit-prod-blogs.tls=true
- traefik.http.routers.writekit-prod-blogs.tls.certresolver=cloudflare
@ -157,18 +157,12 @@ services:
- tenants-staging:/data
labels:
- traefik.enable=true
- traefik.http.routers.writekit-staging-platform.rule=Host(`staging.${DOMAIN}`)
- traefik.http.routers.writekit-staging-platform.tls=true
- traefik.http.routers.writekit-staging-platform.tls.certresolver=cloudflare
- traefik.http.routers.writekit-staging-platform.middlewares=staging-auth
- traefik.http.routers.writekit-staging-platform.service=writekit-staging
- traefik.http.routers.writekit-staging-blogs.rule=HostRegexp(`^.+\.staging\.${DOMAIN}$$`)
- traefik.http.routers.writekit-staging-blogs.rule=HostRegexp(`^.+\.staging\.${DOMAIN}$`)
- traefik.http.routers.writekit-staging-blogs.priority=20
- traefik.http.routers.writekit-staging-blogs.tls=true
- traefik.http.routers.writekit-staging-blogs.tls.certresolver=cloudflare
- traefik.http.routers.writekit-staging-blogs.tls.domains[0].main=staging.${DOMAIN}
- traefik.http.routers.writekit-staging-blogs.tls.domains[0].sans=*.staging.${DOMAIN}
- traefik.http.routers.writekit-staging-blogs.middlewares=staging-auth
- traefik.http.routers.writekit-staging-blogs.service=writekit-staging
- traefik.http.services.writekit-staging.loadbalancer.server.port=8080
depends_on:

2
main.tf
View file

@ -238,7 +238,7 @@ resource "cloudflare_record" "staging_wildcard" {
name = "*.staging"
content = hcloud_server.prod.ipv4_address
type = "A"
proxied = true
proxied = false
}
resource "cloudflare_record" "source" {