Dropped authentik TF code
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 7s
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 7s
This commit is contained in:
Ultradesu
Generated
-44
@@ -1,44 +0,0 @@
|
||||
# This file is maintained automatically by "terraform init".
|
||||
# Manual edits may be lost in future updates.
|
||||
|
||||
provider "registry.terraform.io/goauthentik/authentik" {
|
||||
version = "2025.12.1"
|
||||
constraints = ">= 2023.10.0, 2025.12.1"
|
||||
hashes = [
|
||||
"h1:p9AGeRqK50wTHEIp7z7O4MUP83cs+lt7wPajZ9m9TB8=",
|
||||
"zh:0e856d3b13614bc32346a236a8e84ba55ecd17238c2008d4b3e71aa8cb49f515",
|
||||
"zh:2dcc44cd499c18ebbc4f763eff97a7b725763c8ac8fbb5d69c935413ccdc4962",
|
||||
"zh:434100fc75ec7cd6b64cc9497e8273e79325fa8d285e9fd9d341c1a67421643b",
|
||||
"zh:483484f66d2e8ce6fa4bfd91e824ceebf07d10acb5df5f366397c55227c4ae91",
|
||||
"zh:596743a6f1c77a6f103b06ef8d932fe8f2376793b92478853dc84571d17c429f",
|
||||
"zh:5ed2d5eb7db13229baaf042c725d5c64b58ffdcc641370175e0a88900af94bf1",
|
||||
"zh:8aecd4cf782c82bee01098f72fe4ffff83707516007b32a01c7fcb19a9260338",
|
||||
"zh:928c05ecac309287ff7d73ed6e478350fe3003557658ae5dc2be817a4268dba7",
|
||||
"zh:9b9fd36dfb3e75da8b4478485272505ae9a3c67b10db173e1d2d76cfe2b637b8",
|
||||
"zh:ab7cd8c61ab67a045854e32f0be1940a92746770dbf3c17bbe923e0259c4f897",
|
||||
"zh:bb1360ec19a4fc1095d0ef1b7b6c5c3c1a91daac7cd1957d43a4cdbb7356a2e3",
|
||||
"zh:d2186f4063aa1a547b52a53745d472e43f5343bc1674f2bbb91421c61b0fab50",
|
||||
"zh:d74bbb67a77951b18ffd7b2863954e70ac03450ad2023cc305c66a5ff25d8d18",
|
||||
"zh:f5970569ea0a479bbfbf2d452f5962e1c9bd472b82756db822d0e951363daa25",
|
||||
]
|
||||
}
|
||||
|
||||
provider "registry.terraform.io/hashicorp/random" {
|
||||
version = "3.8.1"
|
||||
constraints = ">= 3.5.0"
|
||||
hashes = [
|
||||
"h1:u8AKlWVDTH5r9YLSeswoVEjiY72Rt4/ch7U+61ZDkiQ=",
|
||||
"zh:08dd03b918c7b55713026037c5400c48af5b9f468f483463321bd18e17b907b4",
|
||||
"zh:0eee654a5542dc1d41920bbf2419032d6f0d5625b03bd81339e5b33394a3e0ae",
|
||||
"zh:229665ddf060aa0ed315597908483eee5b818a17d09b6417a0f52fd9405c4f57",
|
||||
"zh:2469d2e48f28076254a2a3fc327f184914566d9e40c5780b8d96ebf7205f8bc0",
|
||||
"zh:37d7eb334d9561f335e748280f5535a384a88675af9a9eac439d4cfd663bcb66",
|
||||
"zh:741101426a2f2c52dee37122f0f4a2f2d6af6d852cb1db634480a86398fa3511",
|
||||
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||
"zh:a902473f08ef8df62cfe6116bd6c157070a93f66622384300de235a533e9d4a9",
|
||||
"zh:b85c511a23e57a2147355932b3b6dce2a11e856b941165793a0c3d7578d94d05",
|
||||
"zh:c5172226d18eaac95b1daac80172287b69d4ce32750c82ad77fa0768be4ea4b8",
|
||||
"zh:dab4434dba34aad569b0bc243c2d3f3ff86dd7740def373f2a49816bd2ff819b",
|
||||
"zh:f49fd62aa8c5525a5c17abd51e27ca5e213881d58882fd42fec4a545b53c9699",
|
||||
]
|
||||
}
|
||||
@@ -1,81 +0,0 @@
|
||||
# Authentik Terraform Configuration
|
||||
|
||||
Root Terraform configuration for managing Authentik SSO — applications (OAuth2/OIDC, Proxy, SAML), groups, outposts, flows, certificates, and property mappings.
|
||||
|
||||
State is stored in Terraform Cloud (organization `ultradesu`, workspace `Authentik`).
|
||||
|
||||
## Structure
|
||||
|
||||
```
|
||||
.
|
||||
├── main.tf # Resources: groups, outposts, policy bindings, module calls
|
||||
├── variables.tf # Input variable definitions
|
||||
├── outputs.tf # Outputs (app details, groups, flows, wiki data)
|
||||
├── providers.tf # Authentik provider (goauthentik/authentik 2025.12.1)
|
||||
├── state.tf # Terraform Cloud backend
|
||||
├── terraform.tfvars # General settings: authentik_url, outposts, flows, tags
|
||||
├── oauth2-apps.auto.tfvars # OAuth2/OIDC application definitions
|
||||
├── proxy-apps.auto.tfvars # Proxy application definitions
|
||||
├── groups.auto.tfvars # Group definitions
|
||||
└── modules/
|
||||
├── oauth-provider/ # OAuth2/OIDC provider + application
|
||||
├── proxy-provider/ # Proxy provider + application
|
||||
└── saml-provider/ # SAML provider + application
|
||||
```
|
||||
|
||||
## Usage
|
||||
|
||||
```bash
|
||||
# Set the API token
|
||||
export TF_VAR_authentik_token="..."
|
||||
|
||||
terraform init
|
||||
terraform plan
|
||||
terraform apply
|
||||
```
|
||||
|
||||
All `*.auto.tfvars` files are loaded automatically — no `-var-file` flags needed.
|
||||
|
||||
## Adding applications
|
||||
|
||||
OAuth2/OIDC — add to `oauth2-apps.auto.tfvars`:
|
||||
|
||||
```hcl
|
||||
oauth_applications = {
|
||||
"my-app" = {
|
||||
name = "My App"
|
||||
slug = "my-app"
|
||||
group = "Tools"
|
||||
redirect_uris = ["https://my-app.example.com/callback"]
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Proxy — add to `proxy-apps.auto.tfvars`:
|
||||
|
||||
```hcl
|
||||
proxy_applications = {
|
||||
"my-proxy" = {
|
||||
name = "My Proxy"
|
||||
slug = "my-proxy"
|
||||
group = "Tools"
|
||||
external_host = "https://my-proxy.example.com"
|
||||
internal_host = "http://my-service.namespace.svc:80"
|
||||
outpost = "kubernetes-outpost"
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## CI/CD
|
||||
|
||||
Managed via Gitea Actions (`.gitea/workflows/authentik-apps.yaml`). Runs `terraform apply` on push to `main` when files in `terraform/authentik/` change. Also generates a wiki page with the applications list.
|
||||
|
||||
## Requirements
|
||||
|
||||
- Terraform >= 1.0
|
||||
- goauthentik/authentik provider 2025.12.1
|
||||
- Authentik API token with admin permissions
|
||||
@@ -1,10 +0,0 @@
|
||||
groups = {
|
||||
"admins" = {
|
||||
name = "Administrators"
|
||||
is_superuser = true
|
||||
attributes = {
|
||||
notes = "Managed by Terraform"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,361 +0,0 @@
|
||||
data "authentik_flow" "default_authorization_flow" {
|
||||
slug = var.default_authorization_flow
|
||||
}
|
||||
|
||||
data "authentik_flow" "default_authentication_flow" {
|
||||
slug = var.default_authentication_flow
|
||||
}
|
||||
|
||||
data "authentik_flow" "default_invalidation_flow" {
|
||||
slug = var.default_invalidation_flow
|
||||
}
|
||||
|
||||
# Root groups (without parent)
|
||||
resource "authentik_group" "root_groups" {
|
||||
for_each = {
|
||||
for k, v in var.groups : k => v
|
||||
if v.parent == null
|
||||
}
|
||||
|
||||
name = each.value.name
|
||||
is_superuser = each.value.is_superuser
|
||||
attributes = jsonencode(each.value.attributes)
|
||||
}
|
||||
|
||||
# Child groups (with parent)
|
||||
resource "authentik_group" "child_groups" {
|
||||
for_each = {
|
||||
for k, v in var.groups : k => v
|
||||
if v.parent != null
|
||||
}
|
||||
|
||||
name = each.value.name
|
||||
is_superuser = each.value.is_superuser
|
||||
parents = authentik_group.root_groups[each.value.parent].id
|
||||
attributes = jsonencode(each.value.attributes)
|
||||
|
||||
depends_on = [authentik_group.root_groups]
|
||||
}
|
||||
|
||||
# Auto-created groups for proxy applications
|
||||
resource "authentik_group" "proxy_app_groups" {
|
||||
for_each = {
|
||||
for k, v in var.proxy_applications : k => v
|
||||
if v.create_group == true
|
||||
}
|
||||
|
||||
name = "TF-${each.value.name} Users"
|
||||
is_superuser = false
|
||||
attributes = jsonencode({
|
||||
notes = "Auto-created for ${each.value.name} application"
|
||||
app_slug = each.value.slug
|
||||
})
|
||||
}
|
||||
|
||||
# Auto-created groups for OAuth applications
|
||||
resource "authentik_group" "oauth_app_groups" {
|
||||
for_each = {
|
||||
for k, v in var.oauth_applications : k => v
|
||||
if v.create_group == true
|
||||
}
|
||||
|
||||
name = "TF-${each.value.name} Users"
|
||||
is_superuser = false
|
||||
attributes = jsonencode({
|
||||
notes = "Auto-created for ${each.value.name} application"
|
||||
app_slug = each.value.slug
|
||||
})
|
||||
}
|
||||
|
||||
resource "authentik_certificate_key_pair" "certificates" {
|
||||
for_each = var.certificates
|
||||
|
||||
name = each.value.name
|
||||
certificate_data = each.value.certificate_data
|
||||
key_data = each.value.key_data
|
||||
}
|
||||
|
||||
|
||||
data "authentik_service_connection_kubernetes" "local_k8s" {
|
||||
name = "Local Kubernetes Cluster"
|
||||
}
|
||||
|
||||
resource "authentik_flow" "flows" {
|
||||
for_each = var.flows
|
||||
|
||||
name = each.value.name
|
||||
title = each.value.title
|
||||
slug = each.value.slug
|
||||
designation = each.value.designation
|
||||
policy_engine_mode = each.value.policy_engine_mode
|
||||
compatibility_mode = each.value.compatibility_mode
|
||||
layout = each.value.layout
|
||||
denied_action = each.value.denied_action
|
||||
}
|
||||
|
||||
resource "authentik_property_mapping_provider_scope" "oidc_mappings" {
|
||||
for_each = {
|
||||
for k, v in var.property_mappings : k => v
|
||||
if v.oidc_scope != null
|
||||
}
|
||||
|
||||
name = each.value.name
|
||||
scope_name = each.value.oidc_scope
|
||||
expression = each.value.expression
|
||||
}
|
||||
|
||||
resource "authentik_property_mapping_provider_saml" "saml_mappings" {
|
||||
for_each = {
|
||||
for k, v in var.property_mappings : k => v
|
||||
if v.saml_name != null
|
||||
}
|
||||
|
||||
name = each.value.name
|
||||
saml_name = each.value.saml_name
|
||||
expression = each.value.expression
|
||||
}
|
||||
|
||||
module "oauth_applications" {
|
||||
source = "./modules/oauth-provider"
|
||||
|
||||
for_each = var.oauth_applications
|
||||
|
||||
name = each.value.name
|
||||
app_name = each.value.name
|
||||
app_slug = each.value.slug
|
||||
app_group = each.value.group
|
||||
client_id = each.value.client_id
|
||||
authorization_flow = try(authentik_flow.flows[each.value.authorization_flow].id, data.authentik_flow.default_authorization_flow.id)
|
||||
invalidation_flow = data.authentik_flow.default_invalidation_flow.id
|
||||
redirect_uris = each.value.redirect_uris
|
||||
client_type = each.value.client_type
|
||||
include_claims_in_id_token = each.value.include_claims_in_id_token
|
||||
access_code_validity = each.value.access_code_validity
|
||||
access_token_validity = each.value.access_token_validity
|
||||
refresh_token_validity = each.value.refresh_token_validity
|
||||
property_mappings = each.value.property_mappings
|
||||
signing_key = each.value.signing_key
|
||||
policy_engine_mode = each.value.policy_engine_mode
|
||||
meta_description = each.value.meta_description
|
||||
meta_launch_url = each.value.meta_launch_url
|
||||
meta_icon = each.value.meta_icon
|
||||
scope_mappings = each.value.scope_mappings
|
||||
|
||||
# Access control - only pass explicitly defined groups
|
||||
access_groups = [
|
||||
for group_key in each.value.access_groups :
|
||||
try(
|
||||
authentik_group.root_groups[group_key].id,
|
||||
authentik_group.child_groups[group_key].id
|
||||
)
|
||||
]
|
||||
}
|
||||
|
||||
module "proxy_applications" {
|
||||
source = "./modules/proxy-provider"
|
||||
|
||||
for_each = var.proxy_applications
|
||||
|
||||
name = each.value.name
|
||||
app_name = each.value.name
|
||||
app_slug = each.value.slug
|
||||
app_group = each.value.group
|
||||
external_host = each.value.external_host
|
||||
internal_host = each.value.internal_host
|
||||
internal_host_ssl_validation = each.value.internal_host_ssl_validation
|
||||
authorization_flow = try(authentik_flow.flows[each.value.authorization_flow].id, data.authentik_flow.default_authorization_flow.id)
|
||||
invalidation_flow = data.authentik_flow.default_invalidation_flow.id
|
||||
mode = each.value.mode
|
||||
intercept_header_auth = each.value.intercept_header_auth
|
||||
basic_auth_enabled = each.value.basic_auth_enabled
|
||||
basic_auth_user_attribute = each.value.basic_auth_username_attribute
|
||||
basic_auth_password_attribute = each.value.basic_auth_password_attribute
|
||||
cookie_domain = each.value.cookie_domain
|
||||
skip_path_regex = each.value.skip_path_regex
|
||||
policy_engine_mode = each.value.policy_engine_mode
|
||||
meta_description = each.value.meta_description
|
||||
meta_launch_url = each.value.meta_launch_url
|
||||
meta_icon = each.value.meta_icon
|
||||
|
||||
# Access control - only pass explicitly defined groups
|
||||
access_groups = [
|
||||
for group_key in each.value.access_groups :
|
||||
try(
|
||||
authentik_group.root_groups[group_key].id,
|
||||
authentik_group.child_groups[group_key].id
|
||||
)
|
||||
]
|
||||
}
|
||||
|
||||
# Binding auto-created groups to their applications
|
||||
resource "authentik_policy_binding" "auto_group_bindings" {
|
||||
for_each = {
|
||||
for k, v in var.proxy_applications : k => v
|
||||
if v.create_group == true
|
||||
}
|
||||
|
||||
target = module.proxy_applications[each.key].application_uuid
|
||||
group = authentik_group.proxy_app_groups[each.key].id
|
||||
order = 100
|
||||
|
||||
depends_on = [
|
||||
module.proxy_applications,
|
||||
authentik_group.proxy_app_groups
|
||||
]
|
||||
}
|
||||
|
||||
# Binding auto-created groups to their OAuth applications
|
||||
resource "authentik_policy_binding" "oauth_auto_group_bindings" {
|
||||
for_each = {
|
||||
for k, v in var.oauth_applications : k => v
|
||||
if v.create_group == true
|
||||
}
|
||||
|
||||
target = module.oauth_applications[each.key].application_uuid
|
||||
group = authentik_group.oauth_app_groups[each.key].id
|
||||
order = 100
|
||||
|
||||
depends_on = [
|
||||
module.oauth_applications,
|
||||
authentik_group.oauth_app_groups
|
||||
]
|
||||
}
|
||||
|
||||
module "saml_applications" {
|
||||
source = "./modules/saml-provider"
|
||||
|
||||
for_each = var.saml_applications
|
||||
|
||||
name = each.value.name
|
||||
app_name = each.value.name
|
||||
app_slug = each.value.slug
|
||||
app_group = each.value.group
|
||||
authorization_flow = try(authentik_flow.flows[each.value.authorization_flow].id, data.authentik_flow.default_authorization_flow.id)
|
||||
invalidation_flow = data.authentik_flow.default_invalidation_flow.id
|
||||
acs_url = each.value.acs_url
|
||||
issuer = each.value.issuer
|
||||
audience = each.value.audience
|
||||
sp_binding = each.value.sp_binding
|
||||
signing_key = each.value.signing_key
|
||||
property_mappings = [for pm in each.value.property_mappings : authentik_property_mapping_provider_saml.saml_mappings[pm].id]
|
||||
name_id_mapping = each.value.name_id_mapping != null ? authentik_property_mapping_provider_saml.saml_mappings[each.value.name_id_mapping].id : null
|
||||
assertion_valid_not_before = each.value.assertion_valid_not_before
|
||||
assertion_valid_not_on_or_after = each.value.assertion_valid_not_on_or_after
|
||||
session_valid_not_on_or_after = each.value.session_valid_not_on_or_after
|
||||
policy_engine_mode = each.value.policy_engine_mode
|
||||
meta_description = each.value.meta_description
|
||||
meta_launch_url = each.value.meta_launch_url
|
||||
meta_icon = each.value.meta_icon
|
||||
}
|
||||
|
||||
locals {
|
||||
oauth_outpost_assignments = {
|
||||
for app_key, app in var.oauth_applications : app_key => app.outpost
|
||||
if app.outpost != null
|
||||
}
|
||||
|
||||
proxy_outpost_assignments = {
|
||||
for app_key, app in var.proxy_applications : app_key => app.outpost
|
||||
if app.outpost != null
|
||||
}
|
||||
|
||||
outpost_providers = {
|
||||
for outpost_key, outpost in var.outposts : outpost_key => concat(
|
||||
[for app_key, app_outpost in local.oauth_outpost_assignments :
|
||||
module.oauth_applications[app_key].provider_id if app_outpost == outpost_key],
|
||||
[for app_key, app_outpost in local.proxy_outpost_assignments :
|
||||
module.proxy_applications[app_key].provider_id if app_outpost == outpost_key]
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
resource "authentik_outpost" "outposts" {
|
||||
for_each = {
|
||||
for k, v in var.outposts : k => v
|
||||
if length(lookup(local.outpost_providers, k, [])) > 0
|
||||
}
|
||||
|
||||
name = each.value.name
|
||||
type = "proxy"
|
||||
protocol_providers = local.outpost_providers[each.key]
|
||||
service_connection = data.authentik_service_connection_kubernetes.local_k8s.id
|
||||
config = jsonencode({
|
||||
log_level = "info"
|
||||
docker_labels = null
|
||||
authentik_host = var.authentik_url
|
||||
docker_network = null
|
||||
container_image = null
|
||||
docker_map_ports = true
|
||||
refresh_interval = "minutes=5"
|
||||
kubernetes_replicas = 1
|
||||
kubernetes_namespace = "authentik"
|
||||
authentik_host_browser = ""
|
||||
object_naming_template = "ak-outpost-%(name)s"
|
||||
authentik_host_insecure = false
|
||||
kubernetes_json_patches = {
|
||||
deployment = [
|
||||
{
|
||||
op = "add"
|
||||
path = "/spec/template/spec/containers/0/env/-"
|
||||
value = {
|
||||
name = "AUTHENTIK_POSTGRESQL__HOST"
|
||||
value = "psql.psql.svc"
|
||||
}
|
||||
},
|
||||
{
|
||||
op = "add"
|
||||
path = "/spec/template/spec/containers/0/env/-"
|
||||
value = {
|
||||
name = "AUTHENTIK_POSTGRESQL__PORT"
|
||||
value = "5432"
|
||||
}
|
||||
},
|
||||
{
|
||||
op = "add"
|
||||
path = "/spec/template/spec/containers/0/env/-"
|
||||
value = {
|
||||
name = "AUTHENTIK_POSTGRESQL__NAME"
|
||||
value = "authentik"
|
||||
}
|
||||
},
|
||||
{
|
||||
op = "add"
|
||||
path = "/spec/template/spec/containers/0/env/-"
|
||||
value = {
|
||||
name = "AUTHENTIK_POSTGRESQL__USER"
|
||||
valueFrom = {
|
||||
secretKeyRef = {
|
||||
name = "authentik-creds"
|
||||
key = "AUTHENTIK_POSTGRESQL__USER"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
op = "add"
|
||||
path = "/spec/template/spec/containers/0/env/-"
|
||||
value = {
|
||||
name = "AUTHENTIK_POSTGRESQL__PASSWORD"
|
||||
valueFrom = {
|
||||
secretKeyRef = {
|
||||
name = "authentik-creds"
|
||||
key = "AUTHENTIK_POSTGRESQL__PASSWORD"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
kubernetes_service_type = "ClusterIP"
|
||||
kubernetes_image_pull_secrets = []
|
||||
kubernetes_ingress_class_name = null
|
||||
kubernetes_disabled_components = []
|
||||
kubernetes_ingress_annotations = {}
|
||||
kubernetes_ingress_secret_name = "idm-tls"
|
||||
})
|
||||
|
||||
depends_on = [
|
||||
module.oauth_applications,
|
||||
module.proxy_applications
|
||||
]
|
||||
}
|
||||
@@ -1,103 +0,0 @@
|
||||
terraform {
|
||||
required_providers {
|
||||
authentik = {
|
||||
source = "goauthentik/authentik"
|
||||
version = ">= 2023.10.0"
|
||||
}
|
||||
random = {
|
||||
source = "hashicorp/random"
|
||||
version = ">= 3.5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Get all available scope mappings
|
||||
data "authentik_property_mapping_provider_scope" "all_scopes" {
|
||||
managed_list = [
|
||||
"goauthentik.io/providers/oauth2/scope-email",
|
||||
"goauthentik.io/providers/oauth2/scope-openid",
|
||||
"goauthentik.io/providers/oauth2/scope-profile"
|
||||
]
|
||||
}
|
||||
|
||||
# Filter scope mappings based on requested scopes
|
||||
locals {
|
||||
scope_name_mapping = {
|
||||
"openid" = "goauthentik.io/providers/oauth2/scope-openid"
|
||||
"profile" = "goauthentik.io/providers/oauth2/scope-profile"
|
||||
"email" = "goauthentik.io/providers/oauth2/scope-email"
|
||||
}
|
||||
|
||||
selected_scope_ids = [
|
||||
for scope in var.scope_mappings :
|
||||
data.authentik_property_mapping_provider_scope.all_scopes.ids[index(data.authentik_property_mapping_provider_scope.all_scopes.managed_list, local.scope_name_mapping[scope])]
|
||||
if contains(keys(local.scope_name_mapping), scope)
|
||||
]
|
||||
}
|
||||
|
||||
resource "random_password" "client_secret" {
|
||||
count = var.client_secret == null ? 1 : 0
|
||||
length = 40
|
||||
special = true
|
||||
}
|
||||
|
||||
resource "authentik_provider_oauth2" "provider" {
|
||||
name = var.name
|
||||
client_id = var.client_id != null ? var.client_id : random_id.client_id[0].hex
|
||||
client_secret = var.client_secret != null ? var.client_secret : random_password.client_secret[0].result
|
||||
client_type = var.client_type
|
||||
authorization_flow = var.authorization_flow
|
||||
invalidation_flow = var.invalidation_flow
|
||||
include_claims_in_id_token = var.include_claims_in_id_token
|
||||
access_code_validity = var.access_code_validity
|
||||
access_token_validity = var.access_token_validity
|
||||
refresh_token_validity = var.refresh_token_validity
|
||||
signing_key = var.signing_key
|
||||
|
||||
allowed_redirect_uris = [
|
||||
for uri in var.redirect_uris : {
|
||||
matching_mode = "strict"
|
||||
url = uri
|
||||
}
|
||||
]
|
||||
|
||||
property_mappings = length(var.property_mappings) > 0 ? var.property_mappings : local.selected_scope_ids
|
||||
}
|
||||
|
||||
resource "random_id" "client_id" {
|
||||
count = var.client_id == null ? 1 : 0
|
||||
byte_length = 20
|
||||
}
|
||||
|
||||
resource "authentik_application" "app" {
|
||||
name = var.app_name
|
||||
slug = var.app_slug
|
||||
protocol_provider = authentik_provider_oauth2.provider.id
|
||||
group = var.app_group
|
||||
policy_engine_mode = var.policy_engine_mode
|
||||
meta_description = var.meta_description
|
||||
meta_launch_url = var.meta_launch_url
|
||||
meta_icon = var.meta_icon
|
||||
}
|
||||
|
||||
resource "authentik_policy_binding" "app_access" {
|
||||
for_each = var.access_policies
|
||||
|
||||
target = authentik_application.app.id
|
||||
policy = each.value.policy_id
|
||||
order = each.value.order
|
||||
|
||||
enabled = lookup(each.value, "enabled", true)
|
||||
timeout = lookup(each.value, "timeout", 30)
|
||||
negate = lookup(each.value, "negate", false)
|
||||
failure_result = lookup(each.value, "failure_result", true)
|
||||
}
|
||||
|
||||
# Binding groups to the application
|
||||
resource "authentik_policy_binding" "group_bindings" {
|
||||
for_each = { for idx, group_id in var.access_groups : idx => group_id }
|
||||
|
||||
target = authentik_application.app.uuid
|
||||
group = each.value
|
||||
order = 10 + each.key
|
||||
}
|
||||
@@ -1,30 +0,0 @@
|
||||
output "provider_id" {
|
||||
description = "ID of the OAuth2 provider"
|
||||
value = authentik_provider_oauth2.provider.id
|
||||
}
|
||||
|
||||
output "application_id" {
|
||||
description = "ID of the application"
|
||||
value = authentik_application.app.id
|
||||
}
|
||||
|
||||
output "application_uuid" {
|
||||
description = "UUID of the application"
|
||||
value = authentik_application.app.uuid
|
||||
}
|
||||
|
||||
output "client_id" {
|
||||
description = "OAuth2 Client ID"
|
||||
value = authentik_provider_oauth2.provider.client_id
|
||||
}
|
||||
|
||||
output "client_secret" {
|
||||
description = "OAuth2 Client Secret"
|
||||
value = authentik_provider_oauth2.provider.client_secret
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
output "application_slug" {
|
||||
description = "Application slug"
|
||||
value = authentik_application.app.slug
|
||||
}
|
||||
@@ -1,150 +0,0 @@
|
||||
variable "name" {
|
||||
description = "Name of the OAuth2 provider"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "app_name" {
|
||||
description = "Name of the application"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "app_slug" {
|
||||
description = "Slug of the application"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "app_group" {
|
||||
description = "Group for the application"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "client_id" {
|
||||
description = "OAuth2 Client ID"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "client_secret" {
|
||||
description = "OAuth2 Client Secret"
|
||||
type = string
|
||||
default = null
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "client_type" {
|
||||
description = "OAuth2 Client type (confidential or public)"
|
||||
type = string
|
||||
default = "confidential"
|
||||
|
||||
validation {
|
||||
condition = contains(["confidential", "public"], var.client_type)
|
||||
error_message = "Client type must be either 'confidential' or 'public'."
|
||||
}
|
||||
}
|
||||
|
||||
variable "authorization_flow" {
|
||||
description = "Authorization flow UUID"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "invalidation_flow" {
|
||||
description = "Invalidation flow UUID"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "redirect_uris" {
|
||||
description = "List of allowed redirect URIs"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "access_code_validity" {
|
||||
description = "Access code validity duration"
|
||||
type = string
|
||||
default = "minutes=1"
|
||||
}
|
||||
|
||||
variable "access_token_validity" {
|
||||
description = "Access token validity duration"
|
||||
type = string
|
||||
default = "minutes=5"
|
||||
}
|
||||
|
||||
variable "refresh_token_validity" {
|
||||
description = "Refresh token validity duration"
|
||||
type = string
|
||||
default = "days=30"
|
||||
}
|
||||
|
||||
variable "include_claims_in_id_token" {
|
||||
description = "Include claims in ID token"
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "signing_key" {
|
||||
description = "Signing key UUID"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "property_mappings" {
|
||||
description = "List of property mapping UUIDs"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "policy_engine_mode" {
|
||||
description = "Policy engine mode"
|
||||
type = string
|
||||
default = "all"
|
||||
|
||||
validation {
|
||||
condition = contains(["all", "any"], var.policy_engine_mode)
|
||||
error_message = "Policy engine mode must be either 'all' or 'any'."
|
||||
}
|
||||
}
|
||||
|
||||
variable "meta_description" {
|
||||
description = "Application meta description"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "meta_launch_url" {
|
||||
description = "Application launch URL"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "meta_icon" {
|
||||
description = "Application icon URL"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "access_policies" {
|
||||
description = "Access policies for the application"
|
||||
type = map(object({
|
||||
policy_id = string
|
||||
order = number
|
||||
enabled = optional(bool, true)
|
||||
timeout = optional(number, 30)
|
||||
negate = optional(bool, false)
|
||||
failure_result = optional(bool, true)
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "access_groups" {
|
||||
description = "List of group IDs that have access to the application"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "scope_mappings" {
|
||||
description = "List of scope mappings for the OAuth provider"
|
||||
type = list(string)
|
||||
default = ["openid", "profile", "email"]
|
||||
}
|
||||
@@ -1,58 +0,0 @@
|
||||
terraform {
|
||||
required_providers {
|
||||
authentik = {
|
||||
source = "goauthentik/authentik"
|
||||
version = ">= 2023.10.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "authentik_provider_proxy" "provider" {
|
||||
name = var.name
|
||||
external_host = var.external_host
|
||||
internal_host = var.internal_host
|
||||
internal_host_ssl_validation = var.internal_host_ssl_validation
|
||||
authorization_flow = var.authorization_flow
|
||||
invalidation_flow = var.invalidation_flow
|
||||
mode = var.mode
|
||||
cookie_domain = var.cookie_domain
|
||||
skip_path_regex = var.skip_path_regex
|
||||
intercept_header_auth = var.intercept_header_auth
|
||||
basic_auth_enabled = var.basic_auth_enabled
|
||||
basic_auth_password_attribute = var.basic_auth_password_attribute
|
||||
|
||||
property_mappings = var.property_mappings
|
||||
}
|
||||
|
||||
resource "authentik_application" "app" {
|
||||
name = var.app_name
|
||||
slug = var.app_slug
|
||||
protocol_provider = authentik_provider_proxy.provider.id
|
||||
group = var.app_group
|
||||
policy_engine_mode = var.policy_engine_mode
|
||||
meta_description = var.meta_description
|
||||
meta_launch_url = var.meta_launch_url
|
||||
meta_icon = var.meta_icon
|
||||
}
|
||||
|
||||
resource "authentik_policy_binding" "app_access" {
|
||||
for_each = var.access_policies
|
||||
|
||||
target = authentik_application.app.id
|
||||
policy = each.value.policy_id
|
||||
order = each.value.order
|
||||
|
||||
enabled = lookup(each.value, "enabled", true)
|
||||
timeout = lookup(each.value, "timeout", 30)
|
||||
negate = lookup(each.value, "negate", false)
|
||||
failure_result = lookup(each.value, "failure_result", true)
|
||||
}
|
||||
|
||||
# Binding groups to the application
|
||||
resource "authentik_policy_binding" "group_bindings" {
|
||||
for_each = { for idx, group_id in var.access_groups : idx => group_id }
|
||||
|
||||
target = authentik_application.app.uuid
|
||||
group = each.value
|
||||
order = 10 + each.key
|
||||
}
|
||||
@@ -1,35 +0,0 @@
|
||||
output "provider_id" {
|
||||
description = "ID of the Proxy provider"
|
||||
value = authentik_provider_proxy.provider.id
|
||||
}
|
||||
|
||||
output "application_id" {
|
||||
description = "ID of the application"
|
||||
value = authentik_application.app.id
|
||||
}
|
||||
|
||||
output "application_uuid" {
|
||||
description = "UUID of the application"
|
||||
value = authentik_application.app.uuid
|
||||
}
|
||||
|
||||
output "application_slug" {
|
||||
description = "Application slug"
|
||||
value = authentik_application.app.slug
|
||||
}
|
||||
|
||||
output "launch_url" {
|
||||
description = "Application launch URL"
|
||||
value = authentik_application.app.meta_launch_url
|
||||
}
|
||||
|
||||
output "external_host" {
|
||||
description = "External host URL"
|
||||
value = authentik_provider_proxy.provider.external_host
|
||||
}
|
||||
|
||||
output "internal_host" {
|
||||
description = "Internal host URL"
|
||||
value = authentik_provider_proxy.provider.internal_host
|
||||
}
|
||||
|
||||
@@ -1,151 +0,0 @@
|
||||
variable "name" {
|
||||
description = "Name of the Proxy provider"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "app_name" {
|
||||
description = "Name of the application"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "app_slug" {
|
||||
description = "Slug of the application"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "app_group" {
|
||||
description = "Group for the application"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "external_host" {
|
||||
description = "External hostname for the proxy"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "internal_host" {
|
||||
description = "Internal hostname for the proxy"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "internal_host_ssl_validation" {
|
||||
description = "Enable SSL validation for internal host"
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "authorization_flow" {
|
||||
description = "Authorization flow UUID"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "invalidation_flow" {
|
||||
description = "Invalidation flow UUID"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "mode" {
|
||||
description = "Proxy mode (proxy, forward_single, forward_domain)"
|
||||
type = string
|
||||
default = "proxy"
|
||||
|
||||
validation {
|
||||
condition = contains(["proxy", "forward_single", "forward_domain"], var.mode)
|
||||
error_message = "Mode must be one of: proxy, forward_single, forward_domain."
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
variable "cookie_domain" {
|
||||
description = "Cookie domain for the proxy"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
|
||||
variable "skip_path_regex" {
|
||||
description = "Regular expression for paths to skip authentication"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "intercept_header_auth" {
|
||||
description = "Intercept header authentication"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "basic_auth_enabled" {
|
||||
description = "Enable basic authentication"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "basic_auth_password_attribute" {
|
||||
description = "Attribute for basic auth password"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "basic_auth_user_attribute" {
|
||||
description = "Attribute for basic auth username"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "property_mappings" {
|
||||
description = "List of property mapping UUIDs"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "policy_engine_mode" {
|
||||
description = "Policy engine mode"
|
||||
type = string
|
||||
default = "all"
|
||||
|
||||
validation {
|
||||
condition = contains(["all", "any"], var.policy_engine_mode)
|
||||
error_message = "Policy engine mode must be either 'all' or 'any'."
|
||||
}
|
||||
}
|
||||
|
||||
variable "meta_description" {
|
||||
description = "Application meta description"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "meta_launch_url" {
|
||||
description = "Application launch URL"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "meta_icon" {
|
||||
description = "Application icon URL"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
|
||||
variable "access_policies" {
|
||||
description = "Access policies for the application"
|
||||
type = map(object({
|
||||
policy_id = string
|
||||
order = number
|
||||
enabled = optional(bool, true)
|
||||
timeout = optional(number, 30)
|
||||
negate = optional(bool, false)
|
||||
failure_result = optional(bool, true)
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "access_groups" {
|
||||
description = "List of group IDs that have access to the application"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
@@ -1,53 +0,0 @@
|
||||
terraform {
|
||||
required_providers {
|
||||
authentik = {
|
||||
source = "goauthentik/authentik"
|
||||
version = ">= 2023.10.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
data "authentik_certificate_key_pair" "default" {
|
||||
name = "authentik Self-signed Certificate"
|
||||
}
|
||||
|
||||
resource "authentik_provider_saml" "provider" {
|
||||
name = var.name
|
||||
authorization_flow = var.authorization_flow
|
||||
invalidation_flow = var.invalidation_flow
|
||||
acs_url = var.acs_url
|
||||
issuer = var.issuer
|
||||
audience = var.audience
|
||||
sp_binding = var.sp_binding
|
||||
signing_kp = var.signing_key != null ? var.signing_key : data.authentik_certificate_key_pair.default.id
|
||||
property_mappings = var.property_mappings
|
||||
name_id_mapping = var.name_id_mapping
|
||||
|
||||
assertion_valid_not_before = var.assertion_valid_not_before
|
||||
assertion_valid_not_on_or_after = var.assertion_valid_not_on_or_after
|
||||
session_valid_not_on_or_after = var.session_valid_not_on_or_after
|
||||
}
|
||||
|
||||
resource "authentik_application" "app" {
|
||||
name = var.app_name
|
||||
slug = var.app_slug
|
||||
protocol_provider = authentik_provider_saml.provider.id
|
||||
group = var.app_group
|
||||
policy_engine_mode = var.policy_engine_mode
|
||||
meta_description = var.meta_description
|
||||
meta_launch_url = var.meta_launch_url
|
||||
meta_icon = var.meta_icon
|
||||
}
|
||||
|
||||
resource "authentik_policy_binding" "app_access" {
|
||||
for_each = var.access_policies
|
||||
|
||||
target = authentik_application.app.id
|
||||
policy = each.value.policy_id
|
||||
order = each.value.order
|
||||
|
||||
enabled = lookup(each.value, "enabled", true)
|
||||
timeout = lookup(each.value, "timeout", 30)
|
||||
negate = lookup(each.value, "negate", false)
|
||||
failure_result = lookup(each.value, "failure_result", true)
|
||||
}
|
||||
@@ -1,24 +0,0 @@
|
||||
output "provider_id" {
|
||||
description = "ID of the SAML provider"
|
||||
value = authentik_provider_saml.provider.id
|
||||
}
|
||||
|
||||
output "application_id" {
|
||||
description = "ID of the application"
|
||||
value = authentik_application.app.id
|
||||
}
|
||||
|
||||
output "provider_name" {
|
||||
description = "Name of the SAML provider"
|
||||
value = authentik_provider_saml.provider.name
|
||||
}
|
||||
|
||||
output "acs_url" {
|
||||
description = "Assertion Consumer Service URL"
|
||||
value = authentik_provider_saml.provider.acs_url
|
||||
}
|
||||
|
||||
output "issuer" {
|
||||
description = "SAML Issuer"
|
||||
value = authentik_provider_saml.provider.issuer
|
||||
}
|
||||
@@ -1,124 +0,0 @@
|
||||
variable "name" {
|
||||
description = "Name of the SAML provider"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "app_name" {
|
||||
description = "Name of the application"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "app_slug" {
|
||||
description = "Slug of the application"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "app_group" {
|
||||
description = "Group of the application"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "authorization_flow" {
|
||||
description = "Authorization flow ID"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "invalidation_flow" {
|
||||
description = "Invalidation flow ID"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "acs_url" {
|
||||
description = "Assertion Consumer Service URL"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "issuer" {
|
||||
description = "SAML Issuer"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "audience" {
|
||||
description = "SAML Audience"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "sp_binding" {
|
||||
description = "Service Provider binding (post or redirect)"
|
||||
type = string
|
||||
default = "post"
|
||||
}
|
||||
|
||||
variable "signing_key" {
|
||||
description = "Certificate key pair ID for signing"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "property_mappings" {
|
||||
description = "List of property mapping IDs"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "name_id_mapping" {
|
||||
description = "Property mapping ID for NameID"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "assertion_valid_not_before" {
|
||||
description = "Assertion valid not before"
|
||||
type = string
|
||||
default = "minutes=-5"
|
||||
}
|
||||
|
||||
variable "assertion_valid_not_on_or_after" {
|
||||
description = "Assertion valid not on or after"
|
||||
type = string
|
||||
default = "minutes=5"
|
||||
}
|
||||
|
||||
variable "session_valid_not_on_or_after" {
|
||||
description = "Session valid not on or after"
|
||||
type = string
|
||||
default = "minutes=86400"
|
||||
}
|
||||
|
||||
variable "policy_engine_mode" {
|
||||
description = "Policy engine mode"
|
||||
type = string
|
||||
default = "all"
|
||||
}
|
||||
|
||||
variable "meta_description" {
|
||||
description = "Application description"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "meta_launch_url" {
|
||||
description = "Application launch URL"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "meta_icon" {
|
||||
description = "Application icon URL"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "access_policies" {
|
||||
description = "Access policies for the application"
|
||||
type = map(object({
|
||||
policy_id = string
|
||||
order = number
|
||||
enabled = optional(bool, true)
|
||||
timeout = optional(number, 30)
|
||||
negate = optional(bool, false)
|
||||
failure_result = optional(bool, true)
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
@@ -1,232 +0,0 @@
|
||||
oauth_applications = {
|
||||
"paperless" = {
|
||||
name = "Paperless-NGX"
|
||||
slug = "paperless"
|
||||
group = "Tools"
|
||||
meta_description = "Document management system"
|
||||
meta_icon = "https://img.icons8.com/fluency/48/documents.png"
|
||||
redirect_uris = ["https://docs.hexor.cy/accounts/oidc/authentik/login/callback/"]
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
"gitea" = {
|
||||
name = "Gitea"
|
||||
slug = "gitea"
|
||||
group = "Tools"
|
||||
meta_description = "Git repository hosting"
|
||||
meta_icon = "https://img.icons8.com/?size=100&id=20906&format=png&color=000000"
|
||||
redirect_uris = ["https://gt.hexor.cy/user/oauth2/Authentik/callback"]
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=10"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
"jellyfin" = {
|
||||
name = "Jellyfin"
|
||||
slug = "jellyfin"
|
||||
group = "Media and Storage"
|
||||
meta_description = "Media streaming server"
|
||||
meta_icon = "https://img.icons8.com/plasticine/100/jellyfin.png"
|
||||
redirect_uris = [
|
||||
"https://jf.hexor.cy/sso/OID/r/authentik",
|
||||
"https://jf.hexor.cy/sso/OID/redirect/authentik"
|
||||
]
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=10"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
"argocd" = {
|
||||
name = "ArgoCD"
|
||||
slug = "argocd"
|
||||
group = "Core"
|
||||
meta_description = "GitOps deployment tool"
|
||||
meta_icon = "https://img.icons8.com/color-glass/48/octopus.png"
|
||||
redirect_uris = ["https://ag.hexor.cy/auth/callback"]
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
"grafana" = {
|
||||
name = "Grafana"
|
||||
slug = "grafana"
|
||||
group = "Core"
|
||||
meta_description = "Monitoring and observability"
|
||||
meta_icon = "https://img.icons8.com/fluency/48/grafana.png"
|
||||
redirect_uris = ["https://gf.hexor.cy/login/generic_oauth"]
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
"immich" = {
|
||||
name = "Immich"
|
||||
slug = "immich"
|
||||
group = "Media and Storage"
|
||||
meta_description = "Photo and video management"
|
||||
meta_icon = "https://img.icons8.com/fluency/48/photos.png"
|
||||
redirect_uris = [
|
||||
"https://photos.hexor.cy/auth/login",
|
||||
"https://photos.hexor.cy/user-settings",
|
||||
"app.immich:///oauth-callback",
|
||||
"http://photos.homenet:30283/auth/login",
|
||||
"http://photos.homenet:30283/user-settings"
|
||||
]
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
access_groups = ["admins"]
|
||||
create_group = true
|
||||
}
|
||||
|
||||
"pgadmin" = {
|
||||
name = "Postgres WEB Admin"
|
||||
slug = "pgadmin"
|
||||
group = "Core"
|
||||
meta_description = "PostgreSQL WEB administration"
|
||||
meta_icon = "https://img.icons8.com/?size=100&id=JRnxU7ZWP4mi&format=png&color=000000"
|
||||
redirect_uris = ["https://pg.hexor.cy/oauth2/authorize"]
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = ["admins"]
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
}
|
||||
|
||||
"home-assistant-lms" = {
|
||||
name = "Home Assistant LMS"
|
||||
slug = "home-assistant-lms"
|
||||
group = "Internal"
|
||||
meta_description = "Home Assistant Limassol"
|
||||
meta_icon = "https://img.icons8.com/stickers/100/smart-home-automation.png"
|
||||
redirect_uris = [
|
||||
"http://ha-lms:8123/auth/oidc/callback",
|
||||
"http://ha-lms.homenet:8123/auth/oidc/callback",
|
||||
]
|
||||
meta_launch_url = "http://ha-lms:8123/auth/oidc/welcome"
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = ["admins"]
|
||||
create_group = true
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
}
|
||||
"home-assistant-london" = {
|
||||
name = "Home Assistant London"
|
||||
slug = "home-assistant-london"
|
||||
group = "Internal"
|
||||
meta_description = "Home Assistant London"
|
||||
meta_icon = "https://img.icons8.com/stickers/100/smart-home-automation.png"
|
||||
redirect_uris = [
|
||||
"http://ha-london:8123/auth/oidc/callback",
|
||||
"http://ha-london.tail2fe2d.ts.net:8123/auth/oidc/callback",
|
||||
]
|
||||
meta_launch_url = "http://ha-london:8123/auth/oidc/welcome"
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = ["admins"]
|
||||
create_group = true
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
}
|
||||
|
||||
"openwebui" = {
|
||||
name = "OpenWeb UI"
|
||||
slug = "openwebui"
|
||||
group = "Tools"
|
||||
meta_description = "OpenWeb UI"
|
||||
meta_icon = "https://ollama.com/public/ollama.png"
|
||||
redirect_uris = [
|
||||
"https://ai.hexor.cy/oauth/oidc/callback",
|
||||
]
|
||||
meta_launch_url = "https://ai.hexor.cy"
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = ["admins"]
|
||||
create_group = true
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
}
|
||||
"matrix" = {
|
||||
name = "Matrix Chat"
|
||||
slug = "matrix"
|
||||
group = "Tools"
|
||||
meta_description = "Matrix Chat"
|
||||
meta_icon = "https://img.icons8.com/ios/100/40C057/matrix-logo.png"
|
||||
redirect_uris = [
|
||||
"https://auth.matrix.hexor.cy/upstream/callback/001KKV4EKY7KG98W2M9T806K6A",
|
||||
]
|
||||
meta_launch_url = "https://chat.matrix.hexor.cy"
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = []
|
||||
create_group = false
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
}
|
||||
"furumi-ng-web" = {
|
||||
name = "Furumi Web Player"
|
||||
slug = "furumi-ng-web"
|
||||
group = "Tools"
|
||||
meta_description = "Furumi Web Player"
|
||||
meta_icon = "https://img.icons8.com/pulsar-color/48/music.png"
|
||||
redirect_uris = [
|
||||
"https://music.hexor.cy/auth/callback",
|
||||
]
|
||||
meta_launch_url = "https://music.hexor.cy"
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = []
|
||||
create_group = true
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,124 +0,0 @@
|
||||
output "oauth_applications" {
|
||||
description = "OAuth2/OpenID applications details"
|
||||
value = {
|
||||
for k, v in module.oauth_applications : k => {
|
||||
application_id = v.application_id
|
||||
application_uuid = v.application_uuid
|
||||
client_id = v.client_id
|
||||
client_secret = v.client_secret
|
||||
slug = v.application_slug
|
||||
}
|
||||
}
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
output "proxy_applications" {
|
||||
description = "Proxy applications details"
|
||||
value = {
|
||||
for k, v in module.proxy_applications : k => {
|
||||
application_id = v.application_id
|
||||
application_uuid = v.application_uuid
|
||||
external_host = v.external_host
|
||||
internal_host = v.internal_host
|
||||
slug = v.application_slug
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
output "outposts" {
|
||||
description = "Outposts details"
|
||||
value = {
|
||||
for k, v in authentik_outpost.outposts : k => {
|
||||
id = v.id
|
||||
name = v.name
|
||||
type = v.type
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
output "groups" {
|
||||
description = "Groups details"
|
||||
value = merge(
|
||||
{
|
||||
for k, v in authentik_group.root_groups : k => {
|
||||
id = v.id
|
||||
name = v.name
|
||||
}
|
||||
},
|
||||
{
|
||||
for k, v in authentik_group.child_groups : k => {
|
||||
id = v.id
|
||||
name = v.name
|
||||
}
|
||||
},
|
||||
{
|
||||
for k, v in authentik_group.proxy_app_groups : k => {
|
||||
id = v.id
|
||||
name = v.name
|
||||
auto_created = true
|
||||
type = "proxy"
|
||||
}
|
||||
},
|
||||
{
|
||||
for k, v in authentik_group.oauth_app_groups : k => {
|
||||
id = v.id
|
||||
name = v.name
|
||||
auto_created = true
|
||||
type = "oauth"
|
||||
}
|
||||
}
|
||||
)
|
||||
}
|
||||
|
||||
output "flows" {
|
||||
description = "Custom flows details"
|
||||
value = {
|
||||
for k, v in authentik_flow.flows : k => {
|
||||
id = v.id
|
||||
slug = v.slug
|
||||
name = v.name
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
output "certificates" {
|
||||
description = "Certificates details"
|
||||
value = {
|
||||
for k, v in authentik_certificate_key_pair.certificates : k => {
|
||||
id = v.id
|
||||
name = v.name
|
||||
fingerprint_sha256 = v.fingerprint_sha256
|
||||
fingerprint_sha1 = v.fingerprint_sha1
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Output for applications table generation
|
||||
output "applications_for_wiki" {
|
||||
description = "Applications data formatted for wiki table generation"
|
||||
value = {
|
||||
proxy_apps = {
|
||||
for k, v in var.proxy_applications : k => {
|
||||
name = v.name
|
||||
type = "Proxy"
|
||||
url = v.external_host
|
||||
internal_url = v.internal_host
|
||||
group = v.group
|
||||
description = v.meta_description
|
||||
icon = v.meta_icon
|
||||
slug = v.slug
|
||||
}
|
||||
}
|
||||
oauth_apps = {
|
||||
for k, v in var.oauth_applications : k => {
|
||||
name = v.name
|
||||
type = "OAuth2/OpenID"
|
||||
url = length(v.redirect_uris) > 0 ? "https://${split("/", replace(v.redirect_uris[0], "https://", ""))[0]}" : ""
|
||||
group = v.group
|
||||
description = v.meta_description
|
||||
icon = v.meta_icon
|
||||
slug = v.slug
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
terraform {
|
||||
required_providers {
|
||||
authentik = {
|
||||
source = "goauthentik/authentik"
|
||||
version = "2025.12.1"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "authentik" {
|
||||
url = var.authentik_url
|
||||
token = var.authentik_token
|
||||
}
|
||||
@@ -1,193 +0,0 @@
|
||||
proxy_applications = {
|
||||
"k8s-dashboard" = {
|
||||
name = "K8S dashboard"
|
||||
slug = "k8s-dashboard-ns"
|
||||
group = "Core"
|
||||
external_host = "https://k8s.hexor.cy"
|
||||
internal_host = "http://kubernetes-dashboard.kubernetes-dashboard.svc"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = "K8S dashboard chart"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
meta_icon = "https://img.icons8.com/color/48/kubernetes.png"
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
"filemanager" = {
|
||||
name = "FM filemanager"
|
||||
slug = "fm-filemanager"
|
||||
group = "Core"
|
||||
external_host = "https://fm.hexor.cy"
|
||||
internal_host = "http://fb-filemanager-filebrowser.syncthing.svc"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = "K8S dashboard chart"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
meta_icon = "https://img.icons8.com/external-anggara-flat-anggara-putra/32/external-folder-basic-user-interface-anggara-flat-anggara-putra.png"
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
"prometheus" = {
|
||||
name = "Prometheus"
|
||||
slug = "prometheus"
|
||||
group = "Core"
|
||||
external_host = "https://prom.hexor.cy"
|
||||
internal_host = "http://prometheus-kube-prometheus-prometheus.prometheus.svc:9090"
|
||||
meta_description = ""
|
||||
meta_icon = "https://img.icons8.com/fluency/48/prometheus-app.png"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
internal_host_ssl_validation = false
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
"mtproxy-links" = {
|
||||
name = "mtproxy-links"
|
||||
slug = "mtproxy-links"
|
||||
group = "Core"
|
||||
external_host = "https://proxy.hexor.cy"
|
||||
internal_host = "http://secret-reader.mtproxy.svc:80"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = ""
|
||||
skip_path_regex = <<-EOT
|
||||
/webhook
|
||||
EOT
|
||||
meta_icon = "https://img.icons8.com/ios-filled/50/password.png"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
# Tools applications
|
||||
"qbittorrent" = {
|
||||
name = "qBittorent"
|
||||
slug = "qbittorent"
|
||||
group = "Tools"
|
||||
external_host = "https://qbt.hexor.cy"
|
||||
internal_host = "http://qbittorrent.jellyfin.svc"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = ""
|
||||
meta_icon = "https://img.icons8.com/nolan/64/qbittorrent--v2.png"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
# Media and Storage applications
|
||||
"kopia" = {
|
||||
name = "Kopia"
|
||||
slug = "kopia"
|
||||
group = "Media and Storage"
|
||||
external_host = "https://backup.hexor.cy"
|
||||
internal_host = "http://100.72.135.2:51515"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = ""
|
||||
meta_icon = "https://img.icons8.com/external-flaticons-lineal-color-flat-icons/64/external-backup-productivity-flaticons-lineal-color-flat-icons.png"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
"syncthing-router" = {
|
||||
name = "Syncthing"
|
||||
slug = "syncthing"
|
||||
group = "Media and Storage"
|
||||
external_host = "https://ss.hexor.cy"
|
||||
internal_host = "http://syncthing-router.syncthing.svc:80"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = ""
|
||||
meta_icon = "https://img.icons8.com/?size=100&id=Id4NcEcXcYzF&format=png&color=000000"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
"truenas" = {
|
||||
name = "TrueNAS"
|
||||
slug = "truenas-proxy"
|
||||
group = "Media and Storage"
|
||||
external_host = "https://nas.hexor.cy"
|
||||
internal_host = "http://10.0.5.107:81"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = ""
|
||||
meta_icon = "https://img.icons8.com/dusk/64/nas.png"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
"khm" = {
|
||||
name = "KHM"
|
||||
slug = "khm"
|
||||
group = "Media and Storage"
|
||||
external_host = "https://khm.hexor.cy"
|
||||
internal_host = "http://khm.khm.svc:8080"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = ""
|
||||
meta_icon = "https://img.icons8.com/liquid-glass/48/key.png"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
access_groups = ["admins", "khm"]
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
"minecraft" = {
|
||||
name = "Minecraft"
|
||||
slug = "minecraft"
|
||||
group = "Media and Storage"
|
||||
external_host = "https://minecraft.hexor.cy"
|
||||
internal_host = "http://minecraft-dynmap.minecraft.svc"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = ""
|
||||
meta_icon = "https://img.icons8.com/color/48/minecraft-grass-cube.png"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
skip_path_regex = <<-EOT
|
||||
/clients
|
||||
EOT
|
||||
}
|
||||
"pasarguard" = {
|
||||
name = "PasarGuard"
|
||||
slug = "pasarguard"
|
||||
group = "Tools"
|
||||
external_host = "https://ps.hexor.cy"
|
||||
internal_host = "https://pasarguard.pasarguard.svc:80"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = ""
|
||||
skip_path_regex = <<-EOT
|
||||
/
|
||||
/sub/
|
||||
/dashboard/
|
||||
/api/
|
||||
EOT
|
||||
meta_icon = "https://img.icons8.com/?size=100&id=fqAD3lAB6zTe&format=png&color=000000"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
"ollama-public" = {
|
||||
name = "Ollama Public"
|
||||
slug = "ollama-public"
|
||||
group = "AI"
|
||||
external_host = "https://ollama.hexor.cy"
|
||||
internal_host = "http://ollama.ollama.svc:11434"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = ""
|
||||
meta_icon = "https://img.icons8.com/external-icongeek26-outline-icongeek26/64/external-llama-animal-head-icongeek26-outline-icongeek26.png"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
intercept_header_auth = true
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,8 +0,0 @@
|
||||
terraform {
|
||||
cloud {
|
||||
organization = "ultradesu"
|
||||
workspaces {
|
||||
name = "Authentik"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,28 +0,0 @@
|
||||
authentik_url = "https://idm.hexor.cy"
|
||||
|
||||
|
||||
flows = {
|
||||
}
|
||||
|
||||
tags = {
|
||||
environment = "production"
|
||||
managed_by = "terraform"
|
||||
project = "homelab"
|
||||
}
|
||||
|
||||
|
||||
|
||||
outposts = {
|
||||
"kubernetes-outpost" = {
|
||||
name = "authentik Embedded Outpost"
|
||||
type = "proxy"
|
||||
service_connection = "k8s-cluster"
|
||||
config = {
|
||||
authentik_host = "https://idm.hexor.cy"
|
||||
authentik_host_insecure = false
|
||||
log_level = "info"
|
||||
error_reporting = true
|
||||
#container_image = null
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,174 +0,0 @@
|
||||
variable "oauth_applications" {
|
||||
description = "Map of OAuth2/OpenID applications"
|
||||
type = map(object({
|
||||
name = string
|
||||
slug = string
|
||||
group = optional(string, "")
|
||||
policy_engine_mode = optional(string, "any")
|
||||
meta_description = optional(string, "")
|
||||
meta_launch_url = optional(string, "")
|
||||
meta_icon = optional(string, "")
|
||||
redirect_uris = list(string)
|
||||
client_type = optional(string, "confidential")
|
||||
client_id = optional(string, null)
|
||||
include_claims_in_id_token = optional(bool, true)
|
||||
access_code_validity = optional(string, "minutes=1")
|
||||
access_token_validity = optional(string, "minutes=5")
|
||||
refresh_token_validity = optional(string, "days=30")
|
||||
property_mappings = optional(list(string), [])
|
||||
authorization_flow = optional(string, null)
|
||||
signing_key = optional(string, null)
|
||||
outpost = optional(string, null)
|
||||
create_group = optional(bool, false)
|
||||
access_groups = optional(list(string), [])
|
||||
scope_mappings = optional(list(string), ["openid", "profile", "email"])
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "proxy_applications" {
|
||||
description = "Map of Proxy applications"
|
||||
type = map(object({
|
||||
name = string
|
||||
slug = string
|
||||
group = optional(string, "")
|
||||
policy_engine_mode = optional(string, "any")
|
||||
meta_description = optional(string, "")
|
||||
meta_launch_url = optional(string, "")
|
||||
meta_icon = optional(string, "")
|
||||
external_host = string
|
||||
internal_host = optional(string, "")
|
||||
internal_host_ssl_validation = optional(bool, true)
|
||||
mode = optional(string, "proxy")
|
||||
intercept_header_auth = optional(bool, false)
|
||||
basic_auth_enabled = optional(bool, false)
|
||||
basic_auth_username_attribute = optional(string, "")
|
||||
basic_auth_password_attribute = optional(string, "")
|
||||
cookie_domain = optional(string, "")
|
||||
authorization_flow = optional(string, null)
|
||||
skip_path_regex = optional(string, "")
|
||||
outpost = optional(string, null)
|
||||
create_group = optional(bool, false)
|
||||
access_groups = optional(list(string), [])
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "saml_applications" {
|
||||
description = "Map of SAML applications"
|
||||
type = map(object({
|
||||
name = string
|
||||
slug = string
|
||||
group = optional(string, "")
|
||||
policy_engine_mode = optional(string, "any")
|
||||
meta_description = optional(string, "")
|
||||
meta_launch_url = optional(string, "")
|
||||
meta_icon = optional(string, "")
|
||||
acs_url = string
|
||||
issuer = string
|
||||
audience = string
|
||||
sp_binding = optional(string, "post")
|
||||
signing_key = optional(string, null)
|
||||
property_mappings = optional(list(string), [])
|
||||
name_id_mapping = optional(string, null)
|
||||
assertion_valid_not_before = optional(string, "minutes=-5")
|
||||
assertion_valid_not_on_or_after = optional(string, "minutes=5")
|
||||
session_valid_not_on_or_after = optional(string, "minutes=86400")
|
||||
authorization_flow = optional(string, null)
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "outposts" {
|
||||
description = "Map of Outposts (only proxy type supported)"
|
||||
type = map(object({
|
||||
name = string
|
||||
config = optional(map(any), {})
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "flows" {
|
||||
description = "Map of authentication flows"
|
||||
type = map(object({
|
||||
name = string
|
||||
title = string
|
||||
slug = string
|
||||
designation = string
|
||||
policy_engine_mode = optional(string, "any")
|
||||
compatibility_mode = optional(bool, false)
|
||||
layout = optional(string, "stacked")
|
||||
denied_action = optional(string, "message_continue")
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "groups" {
|
||||
description = "Map of user groups"
|
||||
type = map(object({
|
||||
name = string
|
||||
is_superuser = optional(bool, false)
|
||||
parent = optional(string, null)
|
||||
attributes = optional(map(any), {})
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "certificates" {
|
||||
description = "Map of certificates for HTTPS"
|
||||
type = map(object({
|
||||
name = string
|
||||
certificate_data = string
|
||||
key_data = string
|
||||
managed = optional(string, null)
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "property_mappings" {
|
||||
description = "Custom property mappings for SAML/OAuth"
|
||||
type = map(object({
|
||||
name = string
|
||||
expression = string
|
||||
saml_name = optional(string, null)
|
||||
oidc_scope = optional(string, null)
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
|
||||
variable "default_authorization_flow" {
|
||||
description = "Default authorization flow slug"
|
||||
type = string
|
||||
default = "default-provider-authorization-implicit-consent"
|
||||
}
|
||||
|
||||
variable "default_authentication_flow" {
|
||||
description = "Default authentication flow slug"
|
||||
type = string
|
||||
default = "default-authentication-flow"
|
||||
}
|
||||
|
||||
variable "default_invalidation_flow" {
|
||||
description = "Default invalidation flow slug"
|
||||
type = string
|
||||
default = "default-provider-invalidation-flow"
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
description = "Tags to apply to all resources"
|
||||
type = map(string)
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "authentik_url" {
|
||||
description = "Authentik URL"
|
||||
type = string
|
||||
default = "https://idm.hexor.cy"
|
||||
}
|
||||
|
||||
variable "authentik_token" {
|
||||
description = "Authentik API token (set via TF_VAR_authentik_token env var)"
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
Reference in New Issue
Block a user