Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
d6ec996d3c |
@@ -13,7 +13,6 @@ permissions:
|
||||
jobs:
|
||||
terraform:
|
||||
name: 'Terraform'
|
||||
if: false
|
||||
runs-on: ubuntu-latest
|
||||
environment: production
|
||||
|
||||
|
||||
@@ -13,10 +13,13 @@ ArgoCD homelab project
|
||||
| Application | Status |
|
||||
| :--- | :---: |
|
||||
| **argocd** | [](https://ag.hexor.cy/applications/argocd/argocd) |
|
||||
| **auth-proxy** | [](https://ag.hexor.cy/applications/argocd/auth-proxy) |
|
||||
| **authentik** | [](https://ag.hexor.cy/applications/argocd/authentik) |
|
||||
| **cert-manager** | [](https://ag.hexor.cy/applications/argocd/cert-manager) |
|
||||
| **external-secrets** | [](https://ag.hexor.cy/applications/argocd/external-secrets) |
|
||||
| **gpu** | [](https://ag.hexor.cy/applications/argocd/gpu) |
|
||||
| **kanidm** | [](https://ag.hexor.cy/applications/argocd/kanidm) |
|
||||
| **keycloak** | [](https://ag.hexor.cy/applications/argocd/keycloak) |
|
||||
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
||||
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
||||
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
||||
@@ -62,9 +65,12 @@ ArgoCD homelab project
|
||||
| **sonarr-stack** | [](https://ag.hexor.cy/applications/argocd/sonarr-stack) |
|
||||
| **stirling-pdf** | [](https://ag.hexor.cy/applications/argocd/stirling-pdf) |
|
||||
| **syncthing** | [](https://ag.hexor.cy/applications/argocd/syncthing) |
|
||||
| **teamspeak** | [](https://ag.hexor.cy/applications/argocd/teamspeak) |
|
||||
| **tg-bots** | [](https://ag.hexor.cy/applications/argocd/tg-bots) |
|
||||
| **vaultwarden** | [](https://ag.hexor.cy/applications/argocd/vaultwarden) |
|
||||
| **vpn** | [](https://ag.hexor.cy/applications/argocd/vpn) |
|
||||
| **web-petting** | [](https://ag.hexor.cy/applications/argocd/web-petting) |
|
||||
| **wedding** | [](https://ag.hexor.cy/applications/argocd/wedding) |
|
||||
| **xandikos** | [](https://ag.hexor.cy/applications/argocd/xandikos) |
|
||||
|
||||
</td>
|
||||
|
||||
@@ -22,7 +22,7 @@ spec:
|
||||
claimName: web-petting-data
|
||||
containers:
|
||||
- name: web-petting
|
||||
image: ultradesu/web-petting:v0.1.6
|
||||
image: ultradesu/web-petting:0.1.0
|
||||
imagePullPolicy: Always
|
||||
args:
|
||||
# - "tail"
|
||||
|
||||
@@ -20,21 +20,8 @@ spec:
|
||||
name: web-petting
|
||||
port:
|
||||
number: 80
|
||||
- host: xn--l1acako8eb.xn--p1ai
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: web-petting
|
||||
port:
|
||||
number: 80
|
||||
tls:
|
||||
- secretName: web-petting-tls
|
||||
hosts:
|
||||
- pet.hexor.cy
|
||||
- secretName: web-petting-murnyanya-tls
|
||||
hosts:
|
||||
- xn--l1acako8eb.xn--p1ai
|
||||
|
||||
|
||||
@@ -23,22 +23,14 @@ configs:
|
||||
admin.enabled: false
|
||||
statusbadge.enabled: true
|
||||
timeout.reconciliation: 60s
|
||||
dex.config: |
|
||||
connectors:
|
||||
- type: oidc
|
||||
id: keycloak
|
||||
name: Keycloak
|
||||
config:
|
||||
issuer: https://auth.hexor.cy/auth/realms/hexor
|
||||
clientID: $oidc-creds:id
|
||||
clientSecret: $oidc-creds:secret
|
||||
insecureEnableGroups: true
|
||||
scopes:
|
||||
- openid
|
||||
- profile
|
||||
- email
|
||||
- offline_access
|
||||
getUserInfo: true
|
||||
oidc.config: |
|
||||
name: Keycloak
|
||||
issuer: https://auth.hexor.cy/auth/realms/hexor
|
||||
clientID: $oidc-creds:id
|
||||
clientSecret: $oidc-creds:secret
|
||||
requestedScopes: ["openid", "profile", "email", "offline_access"]
|
||||
requestedIDTokenClaims: {"groups": {"essential": true}}
|
||||
refreshTokenThreshold: 2m
|
||||
rbac:
|
||||
create: true
|
||||
policy.default: ""
|
||||
@@ -72,7 +64,7 @@ dex:
|
||||
replicas: 1
|
||||
nodeSelector:
|
||||
<<: *nodeSelector
|
||||
enabled: true
|
||||
enabled: false
|
||||
|
||||
# Standard Redis disabled because Redis HA is enabled
|
||||
redis:
|
||||
|
||||
@@ -35,6 +35,4 @@ spec:
|
||||
dnsZones:
|
||||
- "*.hexor.cy"
|
||||
- "hexor.cy"
|
||||
- "*.xn--l1acako8eb.xn--p1ai"
|
||||
- "xn--l1acako8eb.xn--p1ai"
|
||||
|
||||
|
||||
@@ -109,26 +109,17 @@ grafana:
|
||||
grafana.ini:
|
||||
auth:
|
||||
signout_redirect_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/logout?post_logout_redirect_uri=https%3A%2F%2Fgf.hexor.cy%2Flogin&client_id=Grafana
|
||||
oauth_allow_insecure_email_lookup: true
|
||||
auth.generic_oauth:
|
||||
name: Keycloak
|
||||
enabled: true
|
||||
scopes: "openid profile email"
|
||||
allow_sign_up: true
|
||||
auth_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/auth
|
||||
token_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/token
|
||||
api_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/userinfo
|
||||
email_attribute_path: email
|
||||
login_attribute_path: preferred_username
|
||||
name_attribute_path: name
|
||||
# #contains(groups, 'Grafana Editors') && 'Editor' ||
|
||||
role_attribute_path: >-
|
||||
contains(groups[*], 'hexor-admin') && 'Admin' ||
|
||||
contains(groups[*], 'hexor-guest') && 'Viewer' ||
|
||||
'Viewer'
|
||||
role_attribute_strict: false
|
||||
log:
|
||||
level: debug
|
||||
filters: "oauth.generic_oauth:debug"
|
||||
contains(groups, 'hexor-admin') && 'Admin' ||
|
||||
contains(groups, 'hexor-guest') && 'Viewer'
|
||||
database:
|
||||
type: postgres
|
||||
host: psql.psql.svc:5432
|
||||
|
||||
@@ -43,6 +43,23 @@ proxy_applications = {
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
"kubernetes-secrets" = {
|
||||
name = "kubernetes-secrets"
|
||||
slug = "k8s-secret"
|
||||
group = "Core"
|
||||
external_host = "https://pass.hexor.cy"
|
||||
internal_host = "http://secret-reader.k8s-secret.svc:80"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = ""
|
||||
skip_path_regex = <<-EOT
|
||||
/webhook
|
||||
EOT
|
||||
meta_icon = "https://img.icons8.com/ios-filled/50/password.png"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
"mtproxy-links" = {
|
||||
name = "mtproxy-links"
|
||||
slug = "mtproxy-links"
|
||||
|
||||
@@ -167,7 +167,9 @@ resource "keycloak_openid_client_optional_scopes" "oauth2_app" {
|
||||
}
|
||||
|
||||
resource "keycloak_group" "oauth2_app" {
|
||||
for_each = var.oauth2_applications
|
||||
for_each = {
|
||||
for k, v in var.oauth2_applications : k => v if length(v.allowed_groups) > 0
|
||||
}
|
||||
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
name = "app-${each.key}"
|
||||
|
||||
Reference in New Issue
Block a user