not-yet-awesome-embedded-rust VS vouch-proxy

And a list of things missing: https://github.com/rust-embedded/not-yet-awesome-embedded-ru...

Building a portfolio is a great idea. Also you can find various areas to contribute to Rust. That would give you great exposure. Check out the not yet awesome rust repo (https://github.com/rust-embedded/not-yet-awesome-embedded-rust) for ideas. Also take a look at the rust foundation grant program, it’s open for applications now. There’s also the “this week in Rust” newsletter (https://this-week-in-rust.org) where job openings relative to Rust are also listed. Lastly, you can check my bio for a link where I provide a list of project ideas for different areas in embedded including Rust.

See Not Yet Awesome Embedded Rust for some ongoing work to build out the ecosystem, it's not ready yet. (this is a play on various "Awesome XYZ Rust" lists that have resources for different topics)

Not Yet Awesome Embedded Rust

Here's an interesting discussion, consolidated here. My view is you should use a restricted scope atomic (as best as can be supported) and interact with that through a handler struct. I.e. no global state.

Look into vouch proxy

Vouch proxy is designed for this usage: https://github.com/vouch/vouch-proxy I don't think there are any nice UIs to configure it though so you'll need to be familiar with running it yourself.

Not sure this is a "best practice", but it lets me keep control of the Ingress resources inside their YAML configs. I've also layered Vouch Proxy into the ingress configurations to require SSO/MFA auth to access the resources behind the Ingress. Cloudflare has the ability to do this, but I found it cumbersome to keep track of the configs outside the K8s cluster.

I've used vouch proxy for my own stuff previously, before more recently moving to Cloudflare Access. vouch can be slightly janky at times to get working right, but once set up, it's been solid.

For example: nginx -> Vouch proxy -> KeyCloak -> Jellyfin

While this works, we were hoping to make access a bit easier with say an OpenID Connect SSO and reverse-proxy solution. I've seen Vouch Proxy, https://github.com/vouch/vouch-proxy which is really just SSO on top of nginx, but I'm wondering if there's a simpler way to do this.

You seem to be quite knowledgeable and a minimal provider with just the bare minimum would suffice for you. Have a look at Vouch Proxy, it does one thing and it does it well.