zot: restore oauth2-proxy front; vault: point ingress to vault-ui

services/vault/ingress.yaml

@@ -21,6 +21,6 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: vault
+                name: vault-ui
                 port:
                   number: 8200

services/zot/ingress.yaml

@@ -8,7 +8,7 @@ metadata:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: zot-zot-resp-headers@kubernetescrd,zot-zot-login-redirect@kubernetescrd
+    traefik.ingress.kubernetes.io/router.middlewares: zot-zot-resp-headers@kubernetescrd,zot-zot-forward-auth@kubernetescrd
 spec:
   ingressClassName: traefik
   tls:
@@ -22,6 +22,6 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: zot
+                name: oauth2-proxy-zot
                 port:
-                  number: 5000
+                  number: 80

services/zot/middleware.yaml

@@ -30,10 +30,14 @@ spec:
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
-  name: zot-login-redirect
+  name: zot-forward-auth
   namespace: zot
 spec:
-  redirectRegex:
+  forwardAuth:
-    regex: "^/$"
+    address: https://auth.bstein.dev/oauth2/auth
-    replacement: "https://registry.bstein.dev/auth/login?provider=oidc&callback_ui=https://registry.bstein.dev/home"
+    trustForwardHeader: true
-    permanent: true
+    authResponseHeaders:
+      - Authorization
+      - X-Auth-Request-Email
+      - X-Auth-Request-User
+      - X-Auth-Request-Groups