feat: add control panel

2026-07-08 19:07:35 +09:00
parent a07b15e489
commit 3be9970c15
104 changed files with 3639 additions and 461 deletions
@@ -0,0 +1,23 @@
+# Copy to /opt/casan-control-panel/oauth2-proxy.env on the host.
+# Values below are placeholders; do not commit real secrets.
+
+OAUTH2_PROXY_PROVIDER=oidc
+OAUTH2_PROXY_OIDC_ISSUER_URL=https://idp.example.com/realms/casan
+OAUTH2_PROXY_CLIENT_ID=casan-control-panel
+OAUTH2_PROXY_CLIENT_SECRET=replace-with-secret
+OAUTH2_PROXY_COOKIE_SECRET=replace-with-32-byte-base64-secret
+OAUTH2_PROXY_COOKIE_SECURE=true
+OAUTH2_PROXY_EMAIL_DOMAINS=*
+OAUTH2_PROXY_SCOPE=openid email profile groups
+OAUTH2_PROXY_OIDC_GROUPS_CLAIM=groups
+OAUTH2_PROXY_REDIRECT_URL=https://control-panel.example.com/oauth2/callback
+
+# Required so nginx can pass verified identity to the API.
+OAUTH2_PROXY_SET_XAUTHREQUEST=true
+OAUTH2_PROXY_PASS_ACCESS_TOKEN=false
+OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER=false
+
+# Recommended: restrict to groups that map through rbac-check.py map-claim:
+# casan-org-admin, casan-project-admin, casan-approver, casan-operator,
+# casan-viewer, casan-auditor.
+# OAUTH2_PROXY_ALLOWED_GROUPS=casan-org-admin,casan-project-admin,casan-approver,casan-operator,casan-viewer,casan-auditor