# Authelia forward-auth in front of NetBox, enforced at the gateway.
#
# This is what makes AD-group -> NetBox-role mapping possible at all: NetBox has no
# SSO group mapping, but it does have header-based group sync, and this supplies the
# headers from a source the app can trust (see netbox/values.yaml remoteAuth).
#
# Flow: browser -> Envoy -> (extAuth) Authelia -> 200 + Remote-* headers -> NetBox.
# On 401/403 Authelia redirects to https://auth.ddupan.top and back.
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: netbox-authelia
  namespace: netbox
spec:
  # Targets the HTTPRoute the chart generates, so the policy applies to exactly the
  # traffic that reaches NetBox and nothing else on the shared gateway.
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: netbox
  extAuth:
    # HTTP, not gRPC. This is the whole reason the gateway is Envoy Gateway and not
    # Contour: Contour supports only the gRPC ext_authz protocol, and Authelia
    # implements the HTTP ExtAuthz filter.
    http:
      backendRefs:
        - name: authelia
          namespace: authelia      # allowed by ../authelia/referencegrant-extauth.yaml
          # The SERVICE port, not the container port. The Authelia chart publishes
          # port 80 -> targetPort http (9091); referencing 9091 here is rejected with
          # "TCP Port 9091 not found on service authelia/authelia".
          port: 80
      # Authelia's ExtAuthz endpoint. The ORIGINAL request path is appended to this
      # prefix, which is how Authelia learns what was being requested.
      path: /api/authz/ext-authz/

      # Headers Envoy copies from Authelia's response ONTO the upstream request.
      # NOTE this belongs to the `http` service block, not to `extAuth` — the API
      # rejects it one level up (headersToBackend is a field of HTTPExtAuthService).
      #
      # SECURITY: "coexisting headers will be overridden" (Envoy Gateway API docs) —
      # a client-supplied Remote-User is replaced by Authelia's verdict, not merged.
      # This list is the entire trust boundary; do not add anything NetBox reads for
      # authorization that Authelia does not itself vouch for.
      headersToBackend:
        - Remote-User
        - Remote-Groups
        - Remote-Email
        - Remote-Name

    # Headers Envoy forwards TO Authelia. Without cookie there is no session and every
    # request bounces to the portal; without the X-Forwarded-* trio Authelia cannot
    # reconstruct the original URL and answers 400.
    headersToExtAuth:
      - cookie
      - authorization
      - proxy-authorization
      - accept
      - x-forwarded-proto
      - x-forwarded-host
      - x-forwarded-uri
      - x-forwarded-for
      - x-original-method

    # Fail CLOSED. If Authelia is down, refuse traffic rather than admit unauthenticated
    # requests to a service whose entire auth model is "trust the header".
    failOpen: false