Add initial implementation of gitea-mcp-forward-auth microservice

- Create build and release workflows for CI/CD - Implement Dockerfile for multi-stage builds - Add core authentication logic with token validation - Include HTTP handler for authorization checks - Set up Kubernetes deployment and service manifests - Update README with usage instructions and configuration details
2026-07-11 21:58:58 +02:00
parent 75acb3c376
commit ea4aac6641
11 changed files with 603 additions and 1 deletions
@@ -0,0 +1,65 @@
+name: Build and Push Container Image
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:
+
+env:
+  REGISTRY: gitea.nehmer.net/torben
+  IMAGE_NAME: gitea-mcp-auth-proxy
+
+jobs:
+  build-and-push-image:
+    runs-on: container-builder
+    container:
+      image: debian:trixie-slim
+    steps:
+      - name: Install CI Dependencies
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends git nodejs curl docker-cli docker-buildx unzip ca-certificates iproute2 gawk
+
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Load Secrets from 1Password
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          REGISTRY_USER: op://CI-CD/gitea-package-token/username
+          REGISTRY_PAT: op://CI-CD/gitea-package-token/password
+
+      - name: BuildKit Setup (Remote Builder konfigurieren)
+        run: |
+          HOST_IP=$(ip route | awk '/default/ { print $3 }')
+          docker buildx create --name remote-builder --driver remote tcp://$HOST_IP:1234 --use --bootstrap
+
+      - name: Log in to the Container registry
+        run: |
+          echo "$REGISTRY_PAT" | docker login $REGISTRY -u "$REGISTRY_USER" --password-stdin
+
+      - name: Build and Push
+        run: |
+          TAG="${{ gitea.ref_name }}"
+
+          # Note: This repository only builds and pushes images.
+          # FluxCD Image Automation in another repository performs deployment.
+          # Stable tags (vX.Y.Z) may become :latest. Pre-release tags never do.
+          if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            docker buildx build \
+              --platform linux/amd64 \
+              --push \
+              --tag $REGISTRY/$IMAGE_NAME:$TAG \
+              --tag $REGISTRY/$IMAGE_NAME:latest \
+              .
+          else
+            docker buildx build \
+              --platform linux/amd64 \
+              --push \
+              --tag $REGISTRY/$IMAGE_NAME:$TAG \
+              .
+          fi