config

docs/REFERENCE.md

@@ -986,15 +986,18 @@ ignore:
 - Dynamic plugins: loads `dynamic-plugins.default.yaml` (all 27+ bundled plugins)
 - Catalog rules: Component, System, API, Resource, Location, Template, Group, User, Domain
 
-**Dynamic Plugins**:
-Add plugins at runtime via `global.dynamic.plugins` in values — no image rebuild:
-```yaml
-global:
-  dynamic:
-    plugins:
-    - package: "@scope/my-plugin@1.0.0"
-      integrity: "sha512-..."
-```
+**Authentication** (Keycloak OIDC):
+- Uses the self-service registrar pattern (see [Keycloak Client Registrar](#keycloak-client-registrar))
+- Config Secret: `cluster-resources/backstage-keycloak-client-config.yaml`
+- Kyverno clones it → registrar creates `backstage-oidc-credentials` Secret in `backstage` namespace
+- Credential keys: `AUTH_OIDC_CLIENT_ID`, `AUTH_OIDC_CLIENT_SECRET` (loaded via `extraEnvVarsSecrets`)
+- Redirect URI: `https://backstage.forteapps.net/api/auth/oidc/handler/frame`
+- Sign-in resolver: `emailMatchingUserEntityProfileEmail`
+
+**Catalog Discovery** (Gitea):
+- Auto-discovers `catalog-info.yaml` from all repos in the `Forte` organization
+- Scans every 30 minutes via the Gitea catalog provider plugin
+- Gitea SCM integration configured for URL resolution (`git.forteapps.net`)
 
 **Catalog Registration**:
 Teams register services by adding a `catalog-info.yaml` to their repo root:
@@ -1012,22 +1015,31 @@ spec:
   owner: team-name
 ```
 
-Then add the location to `backstage-values.yaml` under `upstream.backstage.appConfig.catalog.locations`.
+Repos with this file are auto-discovered — no manual registration needed.
 
-**Per-cluster Configuration**:
-To set the ingress hostname, create a per-cluster overlay values file (e.g., `infra/values/upc-dev/backstage-values.yaml`) with:
+**Dynamic Plugins**:
+Add plugins at runtime via `global.dynamic.plugins` in values — no image rebuild:
 ```yaml
 global:
-  host: backstage.example.com
+  dynamic:
+    plugins:
+    - package: "@scope/my-plugin@1.0.0"
+      integrity: "sha512-..."
+```
+
+**Per-cluster Configuration** (`infra/values/upc-dev/backstage-values.yaml`):
+```yaml
+global:
+  host: backstage.forteapps.net
 upstream:
   backstage:
     appConfig:
       app:
-        baseUrl: https://backstage.example.com
+        baseUrl: https://backstage.forteapps.net
       backend:
-        baseUrl: https://backstage.example.com
+        baseUrl: https://backstage.forteapps.net
   ingress:
-    host: backstage.example.com
+    host: backstage.forteapps.net
 ```
 
 ### Keycloak Client Registrar