Chris Coutinho
04140d671e
Adds multi-user-basic authentication mode to the helm chart alongside
existing basic (single-user) and oauth modes.
Multi-user BasicAuth mode enables:
- Pass-through authentication (credentials in request headers)
- Optional background operations using app passwords via Astrolabe
- Optional OAuth client credentials (uses DCR if not provided)
- Token encryption and persistent storage for background sync
Changes:
- values.yaml: Add auth.multiUserBasic configuration section
- deployment.yaml: Add ENABLE_MULTI_USER_BASIC_AUTH and related env vars
- secret.yaml: Add secret template for token encryption key and OAuth credentials
- pvc.yaml: Add PVC template for token database persistence
- _helpers.tpl: Add helper functions for secret/PVC names
Tested with:
helm template --set auth.mode=multi-user-basic \
--set auth.multiUserBasic.enableOfflineAccess=true \
--set auth.multiUserBasic.tokenEncryptionKey=... \
--set vectorSync.enabled=true
Related: Multi-user deployment support (ADR-020)
54 lines
2.0 KiB
YAML
54 lines
2.0 KiB
YAML
{{- if and (eq .Values.auth.mode "oauth") .Values.auth.oauth.persistence.enabled (not .Values.auth.oauth.persistence.existingClaim) }}
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: {{ include "nextcloud-mcp-server.fullname" . }}-oauth-storage
|
|
labels:
|
|
{{- include "nextcloud-mcp-server.labels" . | nindent 4 }}
|
|
spec:
|
|
accessModes:
|
|
- {{ .Values.auth.oauth.persistence.accessMode }}
|
|
{{- if .Values.auth.oauth.persistence.storageClass }}
|
|
storageClassName: {{ .Values.auth.oauth.persistence.storageClass }}
|
|
{{- end }}
|
|
resources:
|
|
requests:
|
|
storage: {{ .Values.auth.oauth.persistence.size }}
|
|
{{- end }}
|
|
---
|
|
{{- if and (eq .Values.auth.mode "multi-user-basic") .Values.auth.multiUserBasic.enableOfflineAccess .Values.auth.multiUserBasic.persistence.enabled (not .Values.auth.multiUserBasic.persistence.existingClaim) }}
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: {{ include "nextcloud-mcp-server.fullname" . }}-token-storage
|
|
labels:
|
|
{{- include "nextcloud-mcp-server.labels" . | nindent 4 }}
|
|
spec:
|
|
accessModes:
|
|
- {{ .Values.auth.multiUserBasic.persistence.accessMode }}
|
|
{{- if .Values.auth.multiUserBasic.persistence.storageClass }}
|
|
storageClassName: {{ .Values.auth.multiUserBasic.persistence.storageClass }}
|
|
{{- end }}
|
|
resources:
|
|
requests:
|
|
storage: {{ .Values.auth.multiUserBasic.persistence.size }}
|
|
{{- end }}
|
|
---
|
|
{{- if and (eq .Values.qdrant.mode "persistent") .Values.qdrant.localPersistence.enabled (not .Values.qdrant.localPersistence.existingClaim) }}
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: {{ include "nextcloud-mcp-server.fullname" . }}-qdrant-data
|
|
labels:
|
|
{{- include "nextcloud-mcp-server.labels" . | nindent 4 }}
|
|
spec:
|
|
accessModes:
|
|
- {{ .Values.qdrant.localPersistence.accessMode }}
|
|
{{- if .Values.qdrant.localPersistence.storageClass }}
|
|
storageClassName: {{ .Values.qdrant.localPersistence.storageClass }}
|
|
{{- end }}
|
|
resources:
|
|
requests:
|
|
storage: {{ .Values.qdrant.localPersistence.size }}
|
|
{{- end }}
|