feat: add production deployment handoff controls

2026-07-10 16:41:14 +09:00
parent 7cea023dce
commit aa284e9bd4
14 changed files with 408 additions and 109 deletions
@@ -0,0 +1,13 @@
+# Enterprise OIDC values. Keep the real file at /opt/casan-control-panel with chmod 0600.
+OAUTH2_PROXY_PROVIDER=oidc
+OAUTH2_PROXY_OIDC_ISSUER_URL=https://id.example.internal/realms/casan
+OAUTH2_PROXY_CLIENT_ID=casan-control-panel
+OAUTH2_PROXY_CLIENT_SECRET=replace-from-secret-manager
+OAUTH2_PROXY_COOKIE_SECRET=replace-with-32-byte-base64-secret
+OAUTH2_PROXY_COOKIE_SECURE=true
+OAUTH2_PROXY_REDIRECT_URL=https://control.casan.company.internal/oauth2/callback
+OAUTH2_PROXY_OIDC_GROUPS_CLAIM=groups
+OAUTH2_PROXY_SET_XAUTHREQUEST=true
+OAUTH2_PROXY_PASS_ACCESS_TOKEN=false
+OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER=false
+OAUTH2_PROXY_SCOPE="openid profile email groups"