Remove the coolify client and label auth pods

README.md

@@ -40,7 +40,7 @@ Groups decide access. Each OIDC client names one group in `metadata.required_gro
 
 | Group | Grants |
 |---|---|
-| `infra-admins` | Mesh admin UIs (forward-auth), Coolify, the admin page |
+| `infra-admins` | Mesh admin UIs (forward-auth), Grafana, Flux web UI, the admin page |
 | `site-admins` | The bulbashenko.com admin panel |
 | `mail-users` | Mail clients and the Stalwart web UI |
 | `vpn-users` | Joining the VPN mesh (Headscale) |
@@ -72,7 +72,7 @@ The deploying side provides the namespace, the image tag and a Secret `auth` wit
    | `KRATOS_CIPHER_SECRET` | exactly 32 characters: `openssl rand -hex 16` |
    | `SMTP_CONNECTION_URI` | `smtps://noreply%40example.com:<url-encoded password>@host.docker.internal:465/?server_name=mail.example.com` |
    | `SMTP_SENDER` | `noreply@example.com` |
-   | `OIDC_SITE_CLIENT_SECRET`, `OIDC_COOLIFY_CLIENT_SECRET`, `OIDC_HEADSCALE_CLIENT_SECRET` | `scripts/new-client-secret.sh`; the app gets the same value |
+   | `OIDC_SITE_CLIENT_SECRET`, `OIDC_HEADSCALE_CLIENT_SECRET`, `OIDC_FLUXWEB_CLIENT_SECRET`, `OIDC_GRAFANA_CLIENT_SECRET` | `scripts/new-client-secret.sh`; the app gets the same value |
 
    Optional: `AUTH_LOG_LEVEL` (`info`), `AUTH_RATE_LIMIT_PER_CLIENT` (10 per minute), `AUTH_RATE_LIMIT_TOTAL` (120 per minute).
    For another domain, change the domains in `ory/*/*.yml`, `ory/hydra/clients/` and the defaults of `AUTH_HOST`, `AUTH_PUBLIC_URL` and `AUTH_ADMIN_HOST`.

compose.yml

@@ -263,7 +263,6 @@ services:
     environment:
       HYDRA_ADMIN_URL: http://hydra:4445
       OIDC_SITE_CLIENT_SECRET: ${OIDC_SITE_CLIENT_SECRET:?}
-      OIDC_COOLIFY_CLIENT_SECRET: ${OIDC_COOLIFY_CLIENT_SECRET:?}
       OIDC_HEADSCALE_CLIENT_SECRET: ${OIDC_HEADSCALE_CLIENT_SECRET:?}
       OIDC_FLUXWEB_CLIENT_SECRET: ${OIDC_FLUXWEB_CLIENT_SECRET:?}
       OIDC_GRAFANA_CLIENT_SECRET: ${OIDC_GRAFANA_CLIENT_SECRET:?}

deploy/k8s/ui.yaml

@@ -84,7 +84,6 @@ spec:
           env:
             - { name: HYDRA_ADMIN_URL, value: "http://hydra:4445" }
             - { name: OIDC_SITE_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_SITE_CLIENT_SECRET } } }
-            - { name: OIDC_COOLIFY_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_COOLIFY_CLIENT_SECRET } } }
             - { name: OIDC_HEADSCALE_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_HEADSCALE_CLIENT_SECRET } } }
             - { name: OIDC_FLUXWEB_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_FLUXWEB_CLIENT_SECRET } } }
             - { name: OIDC_GRAFANA_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_GRAFANA_CLIENT_SECRET } } }

e2e/test.env

@@ -14,7 +14,6 @@ SERVICE_PASSWORD_64_HYDRAPAGINATION=test-hydra-pagination-secret-0123456789
 SMTP_CONNECTION_URI=smtp://mailpit:1025/?disable_starttls=true
 SMTP_SENDER=noreply@bulbashenko.test
 OIDC_SITE_CLIENT_SECRET=test-site-secret
-OIDC_COOLIFY_CLIENT_SECRET=test-coolify-secret
 OIDC_HEADSCALE_CLIENT_SECRET=test-headscale-secret
 OIDC_FLUXWEB_CLIENT_SECRET=test-fluxweb-secret
 OIDC_GRAFANA_CLIENT_SECRET=test-grafana-secret

kustomization.yaml

@@ -3,6 +3,14 @@
 # and the auth-ui image tag (same commit as this repo).
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+# Ownership labels on pods (infra README: Labels). Flux commonMetadata labels the objects but not their pod
+# templates; selectors are left alone so existing Deployments stay valid.
+labels:
+  - pairs:
+      bulbashenko.com/layer: app
+      bulbashenko.com/app: auth
+    includeSelectors: false
+    includeTemplates: true
 resources:
   - deploy/k8s/ory.yaml
   - deploy/k8s/ui.yaml
@@ -32,7 +40,6 @@ configMapGenerator:
   - name: hydra-clients
     files:
       - ory/hydra/clients/bulbashenko-site.json
-      - ory/hydra/clients/coolify.json
       - ory/hydra/clients/flux-web.json
       - ory/hydra/clients/grafana.json
       - ory/hydra/clients/headscale.json