Platform portal - domain name, TLS, and auth setup

[winkletinkle]

Before we can demo the portal to stakeholders we need:

1. Domain: developer.tcs-platform.io (or client-specific subdomain pattern)
2. TLS: cert-manager with Let's Encrypt, or ACM if on AWS ALB
3. Auth: Backstage supports GitHub OAuth and SAML. For internal deployment, GitHub OAuth for now. For client deployments, SAML against client IdP.
4. Ingress: AWS ALB Ingress Controller with HTTPS redirect

Opening to track these decisions. @arjunmehta-git what's the target hosting environment?

[arjunmehta-git]

Target: EKS in the TCS shared services account. ALB Ingress Controller is already deployed there. Use ACM for TLS (no cert-manager needed). Domain: let's use backstage.platform.tcs-internal.io for the internal instance. Client-specific deployments will use backstage.<client-slug>.tcs-managed.io.

For auth: GitHub OAuth for the TCS internal instance. Document the SAML integration as an addendum for client deployments.

[pontusringblom]

On the SAML setup - Backstage's SAML support via @backstage/plugin-auth-backend is functional but has quirks with some IdPs (especially ADFS). I've done this before - happy to write up the gotchas doc so the next person doesn't spend 2 days debugging attribute mappings.