stack/infra/cloudflared/config.yml at 0ce15f80a521fd333a8018e6e7a0ace258c4f216 - stack - Kris's Experimental Research Tools (KERT)

homelab/stack

Files

kert 982777addb

feat: public SSO — fhirworx.io domain, Gitea OAuth2, Cloudflare tunnel

Migrate from homelab.fhirworx.io (LAN-only, IP allowlist) to
fhirworx.io (public, Gitea SSO via oauth2-proxy).

- Domain: homelab.fhirworx.io → fhirworx.io across all configs
- SSO: oauth2-proxy (OIDC/Gitea) + auth-handler nginx for Traefik
  ForwardAuth (converts 401 → 302 redirect, same as corwins.media
  auth_request pattern)
- Cloudflared: tunnel remote config with 20 hostnames → traefik,
  DNS CNAME records via CF API
- Bootstrap: `docker compose run --rm wire` — idempotent cold-start
  that creates Gitea admin, OAuth2 app, oauth2-proxy credentials,
  clears Cloudflare Access apps, syncs tunnel config + DNS
- Dashboard: rebranded FHIRWORX, HTTPS links, API tile added
- Grafana/Woodpecker/Gitea ROOT_URLs updated to HTTPS

2026-04-09 19:06:33 -04:00

10 lines

291 B

YAML

Raw Blame History

 tunnel: 1389035e-d3ba-4a4f-969d-a369c07ee057
 credentials-file: /home/nonroot/.cloudflared/1389035e-d3ba-4a4f-969d-a369c07ee057.json
 ingress:
   - hostname: "*.fhirworx.io"
     service: http://traefik:80
   - hostname: "fhirworx.io"
     service: http://traefik:80
   - service: http_status:404