Add FluxCD Copilot prompt for deployment instructions in README

2026-07-12 18:01:21 +02:00
parent 9ab31a9827
commit 4548aa161f
1 changed files with 41 additions and 0 deletions
@@ -229,6 +229,47 @@ Referenzbeispiele fuer lokale Verifikation liegen unter:
 Diese Manifeste sind bewusst minimal und nicht als produktive FluxCD-Quelle gedacht.
 ## FluxCD Copilot Prompt
 The following prompt can be used to instruct GitHub Copilot in your FluxCD repository about this service:
 ---
 > **Prompt for FluxCD repo Copilot:**
 >
 > I am deploying `gitea-mcp-auth-proxy`, a Traefik ForwardAuth service that validates `Authorization: Bearer <token>` headers for gitea-mcp access control.
 >
 > **Image:** `gitea.nehmer.net/torben/gitea-mcp-auth-proxy:<tag>`
 > Published to the Gitea container registry at `gitea.nehmer.net`. Stable releases use `vX.Y.Z` tags; `latest` is only updated for stable releases, never for pre-releases.
 >
 > **How it works:**
 > - Returns `200` for a valid bearer token, `401` otherwise.
 > - `GET /healthz` is always reachable without auth (use for readiness/liveness probes).
 > - Token validation uses SHA-256 hashes only — never plaintext tokens.
 >
 > **Required configuration (env):**
 > - `AUTH_PROXY_LISTEN_ADDR` — default `:8080`
 > - `AUTH_PROXY_TOKEN_HASHES_DIR` — path to a directory where each file contains one SHA-256 token hash; ideal for a Kubernetes Secret volume mount (e.g. `/var/run/secrets/auth-proxy`)
 > - `AUTH_PROXY_TOKEN_HASHES` — alternative: comma-separated list of SHA-256 hashes (64 hex chars each, optionally prefixed with `sha256:`)
 > - At least one of the two hash sources must be configured; the service exits on startup if no tokens are loaded.
 > - `AUTH_PROXY_LOG_LEVEL` — optional, default `info`
 >
 > **Secret:** Create a Kubernetes Secret named `gitea-mcp-auth-proxy-tokens` containing one file per allowed token, where each file contains the SHA-256 hash of the token (not the token itself). Mount it at `/var/run/secrets/auth-proxy` as a read-only volume.
 >
 > Generate a hash with: `echo -n "my-token" | sha256sum | awk '{print $1}'`
 >
 > **Deployment constraints:**
 > - Service must be `ClusterIP` only — do not expose externally.
 > - Do not create a public Ingress route for `/healthz`.
 > - The service is consumed by Traefik as a ForwardAuth middleware; only Traefik and internal probes need network access.
 > - Apply a NetworkPolicy that allows ingress only from Traefik (by namespace/pod label) and the kubelet (for probes).
 > - Image pull requires credentials for `gitea.nehmer.net`; configure an `imagePullSecret` referencing a Secret with registry credentials.
 >
 > **Reference manifests** (minimal, non-authoritative) are available at:
 > `https://gitea.nehmer.net/torben/gitea-mcp-forward-auth/src/branch/main/deploy/k3s/`
 ---
 ## Annahmen
 - Annahme: Go-Version ist `1.26`.