From 41729bf256b979620529f3786e53516682bcc2f8 Mon Sep 17 00:00:00 2001
From: Aleksandr Bogomiakov <git@hexor.cy>
Date: Tue, 6 Oct 2026 00:42:40 +0100
Subject: [PATCH] NG: enable sso for VW

---
 terraform/keycloak/.terraform.lock.hcl |  2 ++
 terraform/keycloak/main.tf             |  3 ++-
 terraform/keycloak/providers.tf        |  3 ++-
 terraform/keycloak/terraform.tfvars    | 14 +++++++++++---
 terraform/keycloak/variables.tf        |  1 +
 5 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/terraform/keycloak/.terraform.lock.hcl b/terraform/keycloak/.terraform.lock.hcl
index 25c9123..a07afad 100644
--- a/terraform/keycloak/.terraform.lock.hcl
+++ b/terraform/keycloak/.terraform.lock.hcl
@@ -7,6 +7,7 @@ provider "registry.terraform.io/hashicorp/kubernetes" {
   hashes = [
     "h1:G9QqKNpcztBRqrywtlNylFJSpGzDfRFtO8hcWLdkvRY=",
     "h1:iDIPyL9K9FXc8ievR5vRmXsgT1/I9Vq9CFDKm1Zo8bQ=",
+    "h1:oodIAuFMikXNmEtil5MQgP4dfSctUBYQiGJfjbsF3NY=",
     "zh:0215c5c60be62028c09a2f22458e89cda3ef5830a632299f1d401eb3538874b0",
     "zh:09ebb9f442431e278a310a9423f32caf467cb4b3cad3fe59573ca71fa7b14e20",
     "zh:0c4e5912f83bb35846ae0a9ae54fc320706ee61894cd21cc6b4181b1c5a2fa5c",
@@ -27,6 +28,7 @@ provider "registry.terraform.io/keycloak/keycloak" {
   constraints = ">= 5.0.0"
   hashes = [
     "h1:3DuKdVeOxwULh7l6bvJKWZvsgSZo92rtnrdvyp+X2Lc=",
+    "h1:VSlrHkPQm4mczl+5ttuj6jAh2eVvupaoeymEn9Qi5vo=",
     "h1:reFEBcuBZf2SVqDa1YIaNLuIW72uEVsOu5hHhQgfHi0=",
     "zh:19be4505b17e4818db121a82917cb6723019cf379cfb82b720eaa2886f15bede",
     "zh:2bd1565ed22db6a9fb50d60626e22c277f3b034a71f65e6c0011e42f56cad2bb",
diff --git a/terraform/keycloak/main.tf b/terraform/keycloak/main.tf
index 8fe3d02..44956f5 100644
--- a/terraform/keycloak/main.tf
+++ b/terraform/keycloak/main.tf
@@ -243,6 +243,7 @@ resource "keycloak_openid_client" "oauth2_app" {
   valid_redirect_uris             = each.value.redirect_uris
   valid_post_logout_redirect_uris = each.value.post_logout_redirect_uris
   web_origins                     = each.value.web_origins
+  access_token_lifespan           = each.value.access_token_lifespan
 }
 
 resource "keycloak_openid_group_membership_protocol_mapper" "oauth2_app_groups" {
@@ -292,7 +293,7 @@ resource "keycloak_group" "oauth2_app" {
 resource "kubernetes_config_map_v1" "auth_proxy_routes" {
   metadata {
     name      = "auth-proxy-routes"
-    namespace = "auth-proxy"
+    namespace = "keycloak"
   }
 
   data = {
diff --git a/terraform/keycloak/providers.tf b/terraform/keycloak/providers.tf
index 3799cd2..3d15b54 100644
--- a/terraform/keycloak/providers.tf
+++ b/terraform/keycloak/providers.tf
@@ -19,5 +19,6 @@ provider "keycloak" {
 }
 
 provider "kubernetes" {
-  config_path = "~/.kube/config"
+  config_path    = "~/.kube/config"
+  config_context = "hexor-lab"
 }
diff --git a/terraform/keycloak/terraform.tfvars b/terraform/keycloak/terraform.tfvars
index 2f850c5..12554ac 100644
--- a/terraform/keycloak/terraform.tfvars
+++ b/terraform/keycloak/terraform.tfvars
@@ -37,11 +37,19 @@ oauth2_applications = {
     post_logout_redirect_uris = ["https://gt.hexor.cy/*"]
   }
   ArgoCD = {
-    redirect_uris             = ["https://ag.hexor.cy/api/dex/callback"]
-    web_origins               = ["https://ag.hexor.cy"]
-    post_logout_redirect_uris = ["https://ag.hexor.cy/*"]
+    redirect_uris             = ["https://ag.hexor.cy/api/dex/callback", "https://ag.btwiusearch.net/api/dex/callback"]
+    web_origins               = ["https://ag.hexor.cy", "https://ag.btwiusearch.net"]
+    post_logout_redirect_uris = ["https://ag.hexor.cy/*", "https://ag.btwiusearch.net/*"]
     extra_optional_scopes     = ["offline_access"]
   }
+  Vaultwarden = {
+    redirect_uris             = ["https://vw.btwiusearch.net/identity/connect/oidc-signin"]
+    web_origins               = ["https://vw.btwiusearch.net"]
+    post_logout_redirect_uris = ["https://vw.btwiusearch.net/*"]
+    extra_optional_scopes     = ["offline_access"]
+    # Bitwarden clients treat tokens shorter than ~10 minutes as expired.
+    access_token_lifespan = "900"
+  }
   PGAdmin = {
     redirect_uris             = ["https://pg.hexor.cy/oauth2/authorize"]
     web_origins               = ["https://pg.hexor.cy"]
diff --git a/terraform/keycloak/variables.tf b/terraform/keycloak/variables.tf
index 7681e36..b0d91cb 100644
--- a/terraform/keycloak/variables.tf
+++ b/terraform/keycloak/variables.tf
@@ -51,6 +51,7 @@ variable "oauth2_applications" {
     extra_default_scopes      = optional(list(string), [])
     extra_optional_scopes     = optional(list(string), [])
     allowed_groups            = optional(list(string), [])
+    access_token_lifespan     = optional(string) # seconds; null keeps the realm default
   }))
   default = {}
 }