Sienna Meridian Satterwhite
7ffddcafcd
- Fix Hydra postLogoutRedirectUris for docs and people to match the actual URI sent by mozilla_django_oidc v5 (/api/v1.0/logout-callback/) instead of the root URL, resolving 599 logout errors. - Fix docs y-provider WebSocket backend port: use Service port 443 (not pod port 4444 which has no DNAT rule) in Pingora config. - Tighten VSO VaultDynamicSecret rotation sync: add allowStaticCreds:true and reduce refreshAfter from 1h to 5m across all static-creds paths (kratos, hydra, gitea, hive, people, docs) so credential rotation is reflected within 5 minutes instead of up to 1 hour. - Set Hydra token TTLs: access_token and id_token to 5m; refresh_token to 720h (30 days). Kratos session carries silent re-auth so the short access token TTL does not require users to log in manually. - Set SESSION_COOKIE_AGE=3600 (1h) in docs and people backends. After 1h, apps silently re-auth via the active Kratos session. Disabled identities (sunbeam user disable) cannot re-auth on next expiry.
59 lines
1.6 KiB
YAML
59 lines
1.6 KiB
YAML
# Base Ory Hydra Helm values.
|
|
# DOMAIN_SUFFIX is replaced at apply time via sed.
|
|
# secret.enabled: false — we create the "hydra" K8s Secret via seed script.
|
|
# DSN comes from env var via VaultDynamicSecret hydra-db-creds (database static role).
|
|
|
|
hydra:
|
|
automigration:
|
|
enabled: true
|
|
config:
|
|
urls:
|
|
self:
|
|
issuer: https://auth.DOMAIN_SUFFIX/
|
|
consent: https://auth.DOMAIN_SUFFIX/consent
|
|
login: https://auth.DOMAIN_SUFFIX/login
|
|
logout: https://auth.DOMAIN_SUFFIX/logout
|
|
error: https://auth.DOMAIN_SUFFIX/error
|
|
|
|
ttl:
|
|
# Short access tokens — API-level auth window is tight.
|
|
access_token: 5m
|
|
id_token: 5m
|
|
# Refresh tokens last 30 days; Kratos session carries silent re-auth.
|
|
# Revoking a Kratos session (sunbeam user disable) prevents refresh.
|
|
refresh_token: 720h
|
|
|
|
serve:
|
|
cookies:
|
|
same_site_mode: Lax
|
|
public:
|
|
cors:
|
|
enabled: true
|
|
allowed_origins:
|
|
- https://*.DOMAIN_SUFFIX
|
|
|
|
# Disable chart's secret generation — we create the "hydra" secret via seed script
|
|
# with keys: secretsSystem, secretsCookie, pairwise-salt.
|
|
secret:
|
|
enabled: false
|
|
|
|
# Allow Maester to create/update OAuth2Client secrets in the lasuite namespace.
|
|
# 'hydra-maester' is the subchart alias — values flow down under this key.
|
|
hydra-maester:
|
|
enabledNamespaces:
|
|
- lasuite
|
|
|
|
deployment:
|
|
extraEnv:
|
|
- name: DSN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: hydra-db-creds
|
|
key: dsn
|
|
resources:
|
|
limits:
|
|
memory: 64Mi
|
|
requests:
|
|
memory: 32Mi
|
|
cpu: 25m
|