Protected UIs lose the requested page through the SSO login #200

🤖 Generated by the Agentic Engineer

Evidence

The reference platform found that single sign-on loses the page a user was opening (devantler-tech/platform#3169, measured live 2026-09-25): every login finishes on one fixed oauth2-proxy callback host, and routes paper over that with a fixed X-Auth-Request-Redirect naming their service root. This template ships the same shape — a fixed redirect_url in k8s/bases/infrastructure/controllers/oauth2-proxy/helm-release.yaml, and a fixed header on the homepage, Hubble, Coroot, OpenCost, Prometheus and Alertmanager routes.

Who it affects and how

Anyone on a platform created from this template who follows a link into a protected UI while logged out — a shared dashboard, an alert link from Alertmanager, a bookmarked OpenCost report. After signing in they land on the service's front page instead of the page they asked for. Any route that omits the header is worse: the user lands on the oauth2-proxy host, which serves no app.

Expected behaviour

A logged-out deep link returns the user to that exact page after signing in, on every protected host.

Acceptance criteria

• Port the reference platform's change once its three steps are deployed and verified there: register https://<host>/oauth2/callback on the Dex client for every protected host, drop the fixed redirect_url, then drop the per-route header — in that order, so no login points at a callback Dex does not yet accept.
• Port its guard test, which derives the protected hosts from the rendered overlays and fails on a missing or stale callback, a fixed redirect_url, or a fixed per-route header.

Size: S once the reference platform has proven it.