0.9.0 (2026-07-22)

Features

• oidc: add server-side Dex reverse proxy so Dex never needs its own public ingress or hostname (7f04a5b)
• helm: add server.oidc.dexProxy.enabled to reverse-proxy /dex/* traffic through the server or UI nginx (bc77ced)

Documentation

• clarify InsecureIssuerURLContext usage per security review (e646280)
• update version references to 0.9.0 and add upgrading guide entry for dexProxy (5d0a642)
• sync version badges and remove stale local OIDC references (9d7a1c7)

Chores

• makefile: use dexProxy for single port-forward local OIDC testing, removing the separate Dex port-forward requirement (44d035c)
• bump chart version and replace the "OpenDepot" text header with the project logo in README (29ea3c6)

Highlights

Dex can now be fully hidden behind the server (or UI) — no separate public ingress or hostname required:

• New server.oidc.dexProxy.enabled values flag (default false, fully backward compatible).
• Server reverse-proxies /dex/* to the in-cluster Dex service; JWKS/discovery are fetched internally while all client-facing URLs (login.v1, device-code verification_uri, etc.) still use the external, path-based issuer URL.
• New Helm chart guards: dexProxy.enabled=true now requires server.oidc.enabled=true, dex.enabled=true, and server.oidc.issuerUrl to be set, or the chart install fails fast with a clear error.
• Local/dev tooling (make ui-setup-oidc, oidc-forward, ui-forward) simplified to a single port-forward instead of separate server + Dex port-forwards.
• See Proxying Dex Through the Server and the v0.9.0 upgrade notes.

Upgrade note: No action required to preserve existing behavior — dexProxy.enabled defaults to false, and existing dex.enabled: true deployments with separately exposed Dex continue to work unchanged.