fix: replace hostname with baseUrl param and add SAML config

Signed-off-by: Thomas Stocker <thomas.stocker.pro@gmail.com>

contrib/helm/README.md

@@ -63,7 +63,7 @@ export TRUST_TOKEN_SECRET=$(openssl rand -base64 32)
 
 ```bash
 helm install my-probo ./charts/probo \
-  --set probo.hostname="probo.example.com" \
+  --set probo.baseUrl="probo.example.com" \
   --set probo.encryptionKey="$ENCRYPTION_KEY" \
   --set probo.auth.cookieSecret="$COOKIE_SECRET" \
   --set probo.auth.passwordPepper="$PASSWORD_PEPPER" \
@@ -316,7 +316,7 @@ spec:
 ## Full Values
 
 | Key                                                     | Type    | Default                                            | Description                                                                                         |
-|-----------------------------------------------| ------- |----------------------------------------------------|-----------------------------------------------------------------------------------------------------|
+|---------------------------------------------------------| ------- |----------------------------------------------------|-----------------------------------------------------------------------------------------------------|
 | replicaCount                                            | int     | `1`                                                | Number of Probo application replicas                                                                |
 | image.repository                                        | string  | `"ghcr.io/getprobo/probo"`                         | Container image repository                                                                          |
 | image.pullPolicy                                        | string  | `"IfNotPresent"`                                   | Image pull policy                                                                                   |
@@ -392,7 +392,7 @@ spec:
 | metrics.serviceMonitor.scrapeTimeout                    | string  | `"10s"`                                            | Scrape timeout for metrics                                                                          |
 | metrics.serviceMonitor.labels                           | object  | `{}`                                               | Labels for the ServiceMonitor                                                                       |
 | metrics.serviceMonitor.relabelings                      | list    | `[]`                                               | Relabeling configs for the ServiceMonitor                                                           |
-| probo.hostname                                | string  | `"probo.example.com"`                              | Public hostname where Probo will be accessible                                                      |
+| probo.baseUrl                                           | string  | `"probo.example.com"`                              | Public hostname where Probo will be accessible                                                      |
 | probo.encryptionKey                                     | string  | `""`                                               | **REQUIRED** Base64-encoded encryption key (generate with: openssl rand -base64 32)                 |
 | probo.service.port                                      | int     | `8080`                                             | Probo application service port                                                                      |
 | probo.metrics.port                                      | int     | `8081`                                             | Probo metrics service port                                                                          |

contrib/helm/charts/probo/README.md

@@ -27,7 +27,7 @@ echo "Save these secrets securely!"
 
 ```bash
 helm install probo . \
-  --set probo.hostname="probo.example.com" \
+  --set probo.baseUrl="probo.example.com" \
   --set probo.encryptionKey="$ENCRYPTION_KEY" \
   --set probo.auth.cookieSecret="$COOKIE_SECRET" \
   --set probo.auth.passwordPepper="$PASSWORD_PEPPER" \
@@ -67,7 +67,7 @@ ingress:
         - probo.example.com
 
 probo:
-  hostname: "probo.example.com"
+  baseUrl: "probo.example.com"
   encryptionKey: "<secret>"
   cors:
     allowedOrigins:
@@ -129,11 +129,11 @@ The following parameters **must** be configured:
 ### Key Configuration Parameters
 
 | Parameter              | Description                     | Default |
-|-----------|-------------|---------|
+|------------------------|---------------------------------|---------|
 | `image.repository`     | Probo image repository          | `ghcr.io/getprobo/probo` |
 | `image.tag`            | Probo image tag                 | Chart appVersion |
 | `replicaCount`         | Number of Probo replicas        | `1` |
-| `probo.hostname` | Public hostname | `probo.example.com` |
+| `probo.baseUrl`        | Public baseUrl                  | `probo.example.com` |
 | `postgresql.host`      | PostgreSQL host                 | `""` (required) |
 | `postgresql.port`      | PostgreSQL port                 | `5432` |
 | `postgresql.database`  | Database name                   | `probod` |

contrib/helm/charts/probo/templates/NOTES.txt

@@ -72,7 +72,7 @@
 📚 Next Steps:
 
 1. Update the hostname to match your domain:
-   probo.hostname: "{{ .Values.probo.hostname }}"
+   probo.baseUrl: "{{ .Values.probo.baseUrl }}"
 
 2. Configure email delivery:
    Update probo.mailer.smtp settings with your SMTP server details

contrib/helm/charts/probo/templates/deployment.yaml

@@ -56,7 +56,7 @@ spec:
             {{- end }}
             # Application Configuration
             - name: PROBOD_BASE_URL
-              value: {{ printf "https://%s" .Values.probo.hostname | quote }}
+              value: {{ printf "https://%s" .Values.probo.baseUrl | quote }}
             - name: PROBOD_ENCRYPTION_KEY
               valueFrom:
                 secretKeyRef:
@@ -106,6 +106,27 @@ spec:
                   key: password-pepper
             - name: AUTH_PASSWORD_ITERATIONS
               value: {{ .Values.probo.auth.passwordIterations | quote }}
+            {{- if .Values.probo.saml.enabled }}
+            # SAML Authentication
+            - name: SAML_SESSION_DURATION
+              value: {{ .Values.probo.saml.sessionDuration | quote }}
+            - name: SAML_CLEANUP_INTERVAL_SECONDS
+              value: {{ .Values.probo.saml.cleanupIntervalSeconds | quote }}
+            {{- if .Values.probo.saml.certificate }}
+            - name: SAML_CERTIFICATE
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "probo.fullname" . }}
+                  key: saml-certificate
+            {{- end }}
+            {{- if .Values.probo.saml.privateKey }}
+            - name: SAML_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "probo.fullname" . }}
+                  key: saml-private-key
+            {{- end }}
+            {{- end }}
             # Trust Center Authentication
             - name: TRUST_AUTH_COOKIE_NAME
               value: {{ .Values.probo.trustAuth.cookieName | quote }}

contrib/helm/charts/probo/templates/secret.yaml

@@ -32,6 +32,14 @@ stringData:
   openai-api-key: {{ .Values.probo.openai.apiKey | quote }}
   {{- end }}
 
+  # Optional SAML secrets
+  {{- if and .Values.probo.saml.enabled .Values.probo.saml.certificate }}
+  saml-certificate: {{ .Values.probo.saml.certificate | quote }}
+  {{- end }}
+  {{- if and .Values.probo.saml.enabled .Values.probo.saml.privateKey }}
+  saml-private-key: {{ .Values.probo.saml.privateKey | quote }}
+  {{- end }}
+
   # Optional Connector secrets
   {{- range .Values.probo.connectors }}
   {{- if eq .name "slack" }}

contrib/helm/charts/probo/values-production.yaml.example

@@ -95,7 +95,7 @@ ingress:
 # Probo application configuration
 probo:
   # Must match your ingress hostname
-  hostname: "probo.example.com"
+  baseUrl: "probo.example.com"
 
   # REQUIRED: Generate with: openssl rand -base64 32
   encryptionKey: "CHANGE_ME_ENCRYPTION_KEY"

contrib/helm/charts/probo/values.yaml

@@ -169,7 +169,7 @@ metrics:
 probo:
   # Public hostname where Probo will be accessible
   # This should match your ingress host
-  hostname: probo.example.com
+  baseUrl: probo.example.com
 
   # Base64-encoded encryption key (REQUIRED)
   # Generate with: openssl rand -base64 32
@@ -221,6 +221,19 @@ probo:
     passwordPepper: ""
     passwordIterations: 1000000
 
+  # SAML authentication (optional)
+  saml:
+    # Enable SAML authentication
+    enabled: false
+    # SAML session validity duration in seconds (default: 604800 = 7 days)
+    sessionDuration: 604800
+    # Cleanup interval in seconds for expired SAML sessions (0 = disabled)
+    cleanupIntervalSeconds: 0
+    # SAML service provider certificate in PEM format
+    certificate: ""
+    # SAML service provider private key in PEM format
+    privateKey: ""
+
   # Trust center authentication
   trustAuth:
     cookieName: "TCT"