Compare commits
25 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
34fb7cd924 | ||
 Ultradesu
|
9622b7d7bc | ||
|
Ultradesu
|
37c77a899d | ||
|
Ultradesu
|
f84f4ff972 | ||
|
Ultradesu
|
897498eedb | ||
|
Ultradesu
|
6202f0f24c | ||
|
Ultradesu
|
1746d210b1 | ||
|
Ultradesu
|
8ee4d7ebbf | ||
|
Ultradesu
|
ad7fce508f | ||
 ab
|
204f794b5d | ||
|
ab
|
5a7e32336e | ||
|
Ultradesu
|
d3ee23c3de | ||
|
Ultradesu
|
0df274c0b2 | ||
|
Ultradesu
|
658ec19ff1 | ||
|
Ultradesu
|
eb27dcf65b | ||
|
Ultradesu
|
e44cf95bb2 | ||
|
Ultradesu
|
df6ab28165 | ||
|
Ultradesu
|
72cbcc3952 | ||
|
Ultradesu
|
2afe27bfd4 | ||
|
Ultradesu
|
36eb9495ef | ||
|
ab
|
8e2c4f54c4 | ||
|
Ultradesu
|
7a0c536ecc | ||
|
Ultradesu
|
9c1eba2ad0 | ||
|
Ultradesu
|
b9b8463ebf | ||
|
Ultradesu
|
9fe1df4c1a |
@@ -13,11 +13,13 @@ ArgoCD homelab project
|
||||
| Application | Status |
|
||||
| :--- | :---: |
|
||||
| **argocd** | [](https://ag.hexor.cy/applications/argocd/argocd) |
|
||||
| **auth-proxy** | [](https://ag.hexor.cy/applications/argocd/auth-proxy) |
|
||||
| **authentik** | [](https://ag.hexor.cy/applications/argocd/authentik) |
|
||||
| **cert-manager** | [](https://ag.hexor.cy/applications/argocd/cert-manager) |
|
||||
| **external-secrets** | [](https://ag.hexor.cy/applications/argocd/external-secrets) |
|
||||
| **gpu** | [](https://ag.hexor.cy/applications/argocd/gpu) |
|
||||
| **kanidm** | [](https://ag.hexor.cy/applications/argocd/kanidm) |
|
||||
| **keycloak** | [](https://ag.hexor.cy/applications/argocd/keycloak) |
|
||||
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
||||
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
||||
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
||||
|
||||
@@ -70,7 +70,7 @@ kind: Deployment
|
||||
metadata:
|
||||
name: gitea-runner
|
||||
spec:
|
||||
replicas: 1
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: gitea-runner
|
||||
@@ -79,11 +79,19 @@ spec:
|
||||
labels:
|
||||
app: gitea-runner
|
||||
spec:
|
||||
dnsConfig:
|
||||
options:
|
||||
- name: ndots
|
||||
value: "2"
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: desktop
|
||||
effect: NoSchedule
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
volumes:
|
||||
- name: docker-sock
|
||||
hostPath:
|
||||
@@ -93,6 +101,12 @@ spec:
|
||||
emptyDir:
|
||||
sizeLimit: 30Gi
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app: gitea-runner
|
||||
topologyKey: kubernetes.io/hostname
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
@@ -102,6 +116,7 @@ spec:
|
||||
operator: In
|
||||
values:
|
||||
- uk-desktop.tail2fe2d.ts.net
|
||||
- ai.tail2fe2d.ts.net
|
||||
- weight: 50
|
||||
preference:
|
||||
matchExpressions:
|
||||
@@ -109,22 +124,7 @@ spec:
|
||||
operator: In
|
||||
values:
|
||||
- home.homenet
|
||||
- weight: 30
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- master.tail2fe2d.ts.net
|
||||
- weight: 10
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- it.tail2fe2d.ts.net
|
||||
- ch.tail2fe2d.ts.net
|
||||
- us.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: gitea-runner
|
||||
image: gitea/act_runner:nightly
|
||||
@@ -144,13 +144,18 @@ spec:
|
||||
mountPath: /data
|
||||
env:
|
||||
- name: GITEA_INSTANCE_URL
|
||||
#value: "http://gitea.gitea.svc.cluster.local"
|
||||
value: "https://gt.hexor.cy"
|
||||
- name: GITEA_RUNNER_REGISTRATION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-runner-act-runner-secrets
|
||||
key: token
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: GITEA_RUNNER_NAME
|
||||
value: "k8s-runner"
|
||||
value: "$(NODE_NAME)"
|
||||
- name: GITEA_RUNNER_LABELS
|
||||
value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
|
||||
|
||||
@@ -12,4 +12,5 @@ resources:
|
||||
- ./telemt-servicemonitor.yaml
|
||||
- ./service.yaml
|
||||
- ./secret-reader.yaml
|
||||
- ./secret-reader-ingress.yaml
|
||||
# - ./storage.yaml
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: auth-proxy
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://auth-proxy.auth-proxy.svc:80/auth
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-Auth-Request-User
|
||||
- X-Auth-Request-Email
|
||||
- X-Auth-Request-Groups
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: secret-reader
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`secret-reader.hexor.cy`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: auth-proxy
|
||||
services:
|
||||
- name: secret-reader
|
||||
port: 80
|
||||
tls:
|
||||
secretName: secret-reader-tls
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: secret-reader-tls
|
||||
spec:
|
||||
secretName: secret-reader-tls
|
||||
issuerRef:
|
||||
name: letsencrypt
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- secret-reader.hexor.cy
|
||||
@@ -0,0 +1,21 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: auth-proxy
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: core
|
||||
destination:
|
||||
namespace: auth-proxy
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/core/auth-proxy
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ServerSideApply=true
|
||||
@@ -0,0 +1,79 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: auth-proxy
|
||||
labels:
|
||||
app: auth-proxy
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: auth-proxy
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: auth-proxy
|
||||
spec:
|
||||
containers:
|
||||
- name: auth-proxy
|
||||
image: ultradesu/rsauth2-proxy:0.1.0
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: auth-proxy-creds
|
||||
env:
|
||||
- name: AUTH_PROXY_OIDC_ISSUER
|
||||
value: "https://auth.hexor.cy/auth/realms/hexor"
|
||||
- name: AUTH_PROXY_COOKIE_DOMAIN
|
||||
value: ".hexor.cy"
|
||||
- name: AUTH_PROXY_CALLBACK_URL
|
||||
value: "https://oauth.hexor.cy/callback"
|
||||
- name: AUTH_PROXY_ROUTES_FILE
|
||||
value: "/config/routes.yaml"
|
||||
- name: AUTH_PROXY_LOG_LEVEL
|
||||
value: "info"
|
||||
volumeMounts:
|
||||
- name: routes
|
||||
mountPath: /config
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 64Mi
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8080
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8080
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 30
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
volumes:
|
||||
- name: routes
|
||||
configMap:
|
||||
name: auth-proxy-routes
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
@@ -0,0 +1,40 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: auth-proxy-creds
|
||||
spec:
|
||||
target:
|
||||
name: auth-proxy-creds
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
AUTH_PROXY_CLIENT_ID: rsauth2-proxy
|
||||
AUTH_PROXY_CLIENT_SECRET: |-
|
||||
{{ .client_secret }}
|
||||
AUTH_PROXY_COOKIE_SECRET: |-
|
||||
{{ .cookie_secret }}
|
||||
data:
|
||||
- secretKey: client_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
|
||||
property: login.password
|
||||
- secretKey: cookie_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
|
||||
property: fields[0].value
|
||||
@@ -0,0 +1,28 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: auth-proxy
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`oauth.hexor.cy`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: auth-proxy
|
||||
port: 80
|
||||
tls:
|
||||
secretName: auth-proxy-tls
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: auth-proxy-tls
|
||||
spec:
|
||||
secretName: auth-proxy-tls
|
||||
issuerRef:
|
||||
name: letsencrypt
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- oauth.hexor.cy
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- external-secrets.yaml
|
||||
- routes.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: auth-proxy-routes
|
||||
data:
|
||||
routes.yaml: |
|
||||
routes:
|
||||
secret-reader.hexor.cy:
|
||||
allowed_groups: []
|
||||
@@ -0,0 +1,15 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: auth-proxy
|
||||
labels:
|
||||
app: auth-proxy
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: auth-proxy
|
||||
@@ -1,25 +1,20 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: kanidm
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
traefik.ingress.kubernetes.io/service.serversscheme: https
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`auth.hexor.cy`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: kanidm
|
||||
port: 443
|
||||
scheme: https
|
||||
serversTransport: kanidm-transport
|
||||
tls:
|
||||
- hosts:
|
||||
- auth.hexor.cy
|
||||
secretName: kanidm-ingress-tls
|
||||
rules:
|
||||
- host: auth.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: kanidm
|
||||
port:
|
||||
number: 443
|
||||
secretName: kanidm-ingress-tls
|
||||
|
||||
@@ -8,3 +8,4 @@ resources:
|
||||
- statefulset.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
- servers-transport.yaml
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: ServersTransport
|
||||
metadata:
|
||||
name: kanidm-transport
|
||||
spec:
|
||||
insecureSkipVerify: true
|
||||
@@ -16,6 +16,10 @@ spec:
|
||||
labels:
|
||||
app: kanidm
|
||||
spec:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
containers:
|
||||
- name: kanidm
|
||||
image: kanidm/server:1.9.3
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: keycloak
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: core
|
||||
destination:
|
||||
namespace: keycloak
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/core/keycloak
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ServerSideApply=true
|
||||
@@ -0,0 +1,41 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: keycloak-creds
|
||||
spec:
|
||||
target:
|
||||
name: keycloak-creds
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
KC_DB_USERNAME: keycloak
|
||||
KC_DB_PASSWORD: |-
|
||||
{{ .db_password }}
|
||||
KC_BOOTSTRAP_ADMIN_USERNAME: admin
|
||||
KC_BOOTSTRAP_ADMIN_PASSWORD: |-
|
||||
{{ .admin_password }}
|
||||
data:
|
||||
- secretKey: db_password
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[18].value
|
||||
- secretKey: admin_password
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 9422b636-a91d-40e4-bf98-925b2a3f831d
|
||||
property: login.password
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- external-secrets.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: keycloakx
|
||||
repo: https://codecentric.github.io/helm-charts
|
||||
version: 7.1.11
|
||||
releaseName: keycloak
|
||||
namespace: keycloak
|
||||
valuesFile: values.yaml
|
||||
@@ -0,0 +1,67 @@
|
||||
replicas: 1
|
||||
|
||||
image:
|
||||
repository: quay.io/keycloak/keycloak
|
||||
tag: "26.5.6"
|
||||
|
||||
command:
|
||||
- "/opt/keycloak/bin/kc.sh"
|
||||
- "start"
|
||||
- "--http-port=8080"
|
||||
- "--hostname-strict=false"
|
||||
- "--proxy-headers=xforwarded"
|
||||
|
||||
extraEnvFrom: |
|
||||
- secretRef:
|
||||
name: keycloak-creds
|
||||
|
||||
extraEnv: |
|
||||
- name: KC_HOSTNAME
|
||||
value: auth.hexor.cy
|
||||
- name: JAVA_OPTS_APPEND
|
||||
value: "-Djgroups.dns.query=keycloak-headless.keycloak.svc"
|
||||
|
||||
dbchecker:
|
||||
enabled: true
|
||||
|
||||
database:
|
||||
vendor: postgres
|
||||
hostname: psql.psql.svc
|
||||
port: 5432
|
||||
database: keycloak
|
||||
existingSecret: keycloak-creds
|
||||
existingSecretKey: KC_DB_PASSWORD
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
ingressClassName: traefik
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
rules:
|
||||
- host: auth.hexor.cy
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: keycloak-tls
|
||||
hosts:
|
||||
- auth.hexor.cy
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
@@ -135,6 +135,8 @@ spec:
|
||||
{{ .furumi }}
|
||||
USER_furumi_dev: |-
|
||||
{{ .furumi_dev }}
|
||||
USER_keycloak: |-
|
||||
{{ .keycloak }}
|
||||
data:
|
||||
- secretKey: authentik
|
||||
sourceRef:
|
||||
@@ -323,4 +325,14 @@ spec:
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[17].value
|
||||
|
||||
- secretKey: keycloak
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[18].value
|
||||
|
||||
Generated
+27
@@ -0,0 +1,27 @@
|
||||
# This file is maintained automatically by "terraform init".
|
||||
# Manual edits may be lost in future updates.
|
||||
|
||||
provider "registry.terraform.io/keycloak/keycloak" {
|
||||
version = "5.7.0"
|
||||
constraints = ">= 5.0.0"
|
||||
hashes = [
|
||||
"h1:3DuKdVeOxwULh7l6bvJKWZvsgSZo92rtnrdvyp+X2Lc=",
|
||||
"zh:19be4505b17e4818db121a82917cb6723019cf379cfb82b720eaa2886f15bede",
|
||||
"zh:2bd1565ed22db6a9fb50d60626e22c277f3b034a71f65e6c0011e42f56cad2bb",
|
||||
"zh:34a9e2dfb06331dc6146491c4a0721001195c6a769cdc2d4546edb2acf2b39bd",
|
||||
"zh:3f86bf9eac6d73eeaa926471826b6888da77950f68e6a3a95dc2d9201a4a88fa",
|
||||
"zh:4b9053fde2c8dee6469c8b273bf5491a27228a1df28e30b86714118f0f876baf",
|
||||
"zh:522aa6bcecc6b8d517415237f4ec079488ef7de0e980a634bf6a8b481c13effc",
|
||||
"zh:52f85208815ca65b8d3cd5465b28005ba63f854122bc61fbf04925c986d48e78",
|
||||
"zh:636555042a6051d2e1113e5f945edb9f432e2d09b81cf6e50a59a534819d98dd",
|
||||
"zh:73a1fecfb3d9666bf87c2eb7d001281b8cfcd7132573b8c3d4febc2db55f0a2f",
|
||||
"zh:76fa26d055ceeb0869a50e4b63871f4b07f55045af6b46b83686016531e9fb22",
|
||||
"zh:8df147e619d7ac3d3f9840ba0d1895d34bde179e818863e2e7b52e2c05c12f58",
|
||||
"zh:9c830253990e13ec284d0d312fea562938e4a8fc664dacb3af5f1eb16dcae1ae",
|
||||
"zh:abd0bd630b362cd6f77fbb33625bc6f515782eb58cb096b4ce69dea252254aef",
|
||||
"zh:d1474a67ffc3288b2d0c99f6e8edc937ac8ef54afed0306e3c6f033aa836a5f6",
|
||||
"zh:ed19408f15667bfb572120858bdde929a20ce2d1f29468973905980c03299767",
|
||||
"zh:ef8bc311f7d1ad821b65ba43af92e2ce835e739d391098b13e01a61747b5c648",
|
||||
"zh:f57319d9a7ac387d5070c909fd0084ccfc296f1f3193efde995ae24aa1729a39",
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,133 @@
|
||||
# =============================================================================
|
||||
# Realm
|
||||
# =============================================================================
|
||||
|
||||
resource "keycloak_realm" "hexor" {
|
||||
realm = "hexor"
|
||||
enabled = true
|
||||
|
||||
display_name = "Hexor"
|
||||
|
||||
login_theme = "keycloak"
|
||||
account_theme = "keycloak.v3"
|
||||
|
||||
registration_allowed = false
|
||||
reset_password_allowed = true
|
||||
remember_me = true
|
||||
verify_email = false
|
||||
login_with_email_allowed = true
|
||||
duplicate_emails_allowed = false
|
||||
|
||||
ssl_required = "external"
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# Google Identity Provider
|
||||
# =============================================================================
|
||||
|
||||
resource "keycloak_oidc_google_identity_provider" "google" {
|
||||
realm = keycloak_realm.hexor.id
|
||||
client_id = var.google_client_id
|
||||
client_secret = var.google_client_secret
|
||||
|
||||
trust_email = true
|
||||
sync_mode = "IMPORT"
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# Default groups
|
||||
# =============================================================================
|
||||
|
||||
resource "keycloak_group" "users" {
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
name = "users"
|
||||
}
|
||||
|
||||
resource "keycloak_default_groups" "default" {
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
group_ids = [keycloak_group.users.id]
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# rsauth2-proxy client (production)
|
||||
# =============================================================================
|
||||
|
||||
resource "keycloak_openid_client" "rsauth2_proxy" {
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
client_id = "rsauth2-proxy"
|
||||
|
||||
name = "rsauth2-proxy"
|
||||
enabled = true
|
||||
access_type = "CONFIDENTIAL"
|
||||
standard_flow_enabled = true
|
||||
direct_access_grants_enabled = false
|
||||
|
||||
valid_redirect_uris = [
|
||||
"https://oauth.hexor.cy/callback",
|
||||
]
|
||||
|
||||
web_origins = [
|
||||
"https://oauth.hexor.cy",
|
||||
]
|
||||
}
|
||||
|
||||
resource "keycloak_openid_group_membership_protocol_mapper" "rsauth2_proxy_groups" {
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
client_id = keycloak_openid_client.rsauth2_proxy.id
|
||||
name = "groups"
|
||||
claim_name = "groups"
|
||||
full_path = false
|
||||
}
|
||||
|
||||
resource "keycloak_openid_client_default_scopes" "rsauth2_proxy" {
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
client_id = keycloak_openid_client.rsauth2_proxy.id
|
||||
|
||||
default_scopes = [
|
||||
"openid",
|
||||
"profile",
|
||||
"email",
|
||||
]
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# rsauth2-proxy client (localhost testing)
|
||||
# =============================================================================
|
||||
|
||||
resource "keycloak_openid_client" "rsauth2_proxy_dev" {
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
client_id = "rsauth2-proxy-dev"
|
||||
|
||||
name = "rsauth2-proxy (dev)"
|
||||
enabled = true
|
||||
access_type = "CONFIDENTIAL"
|
||||
standard_flow_enabled = true
|
||||
direct_access_grants_enabled = false
|
||||
|
||||
valid_redirect_uris = [
|
||||
"http://localhost:8080/callback",
|
||||
]
|
||||
|
||||
web_origins = [
|
||||
"http://localhost:8080",
|
||||
]
|
||||
}
|
||||
|
||||
resource "keycloak_openid_group_membership_protocol_mapper" "rsauth2_proxy_dev_groups" {
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
client_id = keycloak_openid_client.rsauth2_proxy_dev.id
|
||||
name = "groups"
|
||||
claim_name = "groups"
|
||||
full_path = false
|
||||
}
|
||||
|
||||
resource "keycloak_openid_client_default_scopes" "rsauth2_proxy_dev" {
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
client_id = keycloak_openid_client.rsauth2_proxy_dev.id
|
||||
|
||||
default_scopes = [
|
||||
"openid",
|
||||
"profile",
|
||||
"email",
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
output "realm_id" {
|
||||
value = keycloak_realm.hexor.id
|
||||
}
|
||||
|
||||
output "google_idp_alias" {
|
||||
value = keycloak_oidc_google_identity_provider.google.alias
|
||||
}
|
||||
|
||||
output "rsauth2_proxy_client_id" {
|
||||
value = keycloak_openid_client.rsauth2_proxy.client_id
|
||||
}
|
||||
|
||||
output "rsauth2_proxy_client_secret" {
|
||||
value = keycloak_openid_client.rsauth2_proxy.client_secret
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
output "rsauth2_proxy_dev_client_id" {
|
||||
value = keycloak_openid_client.rsauth2_proxy_dev.client_id
|
||||
}
|
||||
|
||||
output "rsauth2_proxy_dev_client_secret" {
|
||||
value = keycloak_openid_client.rsauth2_proxy_dev.client_secret
|
||||
sensitive = true
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
terraform {
|
||||
required_providers {
|
||||
keycloak = {
|
||||
source = "keycloak/keycloak"
|
||||
version = ">= 5.0.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "keycloak" {
|
||||
url = var.keycloak_url
|
||||
base_path = "/auth"
|
||||
client_id = var.keycloak_client_id
|
||||
client_secret = var.keycloak_client_secret
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
terraform {
|
||||
cloud {
|
||||
organization = "ultradesu"
|
||||
workspaces {
|
||||
name = "Keycloak"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
variable "keycloak_url" {
|
||||
description = "Keycloak URL (set via TF_VAR_keycloak_url)"
|
||||
type = string
|
||||
default = "https://auth.hexor.cy"
|
||||
}
|
||||
|
||||
variable "keycloak_client_id" {
|
||||
description = "Keycloak Terraform client ID (set via TF_VAR_keycloak_client_id)"
|
||||
type = string
|
||||
default = "terraform"
|
||||
}
|
||||
|
||||
variable "keycloak_client_secret" {
|
||||
description = "Keycloak Terraform client secret (set via TF_VAR_keycloak_client_secret)"
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "google_client_id" {
|
||||
description = "Google OAuth client ID (set via TF_VAR_google_client_id)"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "google_client_secret" {
|
||||
description = "Google OAuth client secret (set via TF_VAR_google_client_secret)"
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
Reference in New Issue
Block a user