Aleksandr BogomiakovandClaude
4764f3545f
Workspaces, group mappings and sign-in methods now come from a configuration file synchronized at startup; workspaces dropped from it are disabled, never deleted. Instance administrators (a new role) see and help every workspace and may delete disabled ones; workspace administrators and employees are derived from the user's groups at every SSO sign-in or administrator edit, and the employee permission set belongs to the workspace. Self-registration is gone: users come from SSO (only when their groups map) or from the administrator. Break-glass bootstrap accounts get an HMAC-derived hourly password that all replicas agree on. First SSO sign-in links a matching email contact to the user. The demo runs on the same model with a generated per-start password. Co-Authored-By: Claude <noreply@anthropic.com>
64 lines
3.3 KiB
YAML
64 lines
3.3 KiB
YAML
# Meguri instance configuration. The process refuses to start without it (MEGURI_CONFIG_FILE).
|
|
# This file is the only place that defines workspaces and which identity-provider groups give
|
|
# which role; there is no UI or API for either. The OIDC client secret is NOT stored here: set
|
|
# MEGURI_OIDC_CLIENT_SECRET in the deployment secret store.
|
|
#
|
|
# Applied by the migrate Job (or a single process without MEGURI_SKIP_MIGRATIONS) at every release.
|
|
# Unknown fields and invalid values are rejected at startup.
|
|
|
|
auth:
|
|
# Lets ordinary password accounts (created by an instance administrator) sign in.
|
|
# Keep false in production where everyone signs in through SSO.
|
|
password_login: false
|
|
|
|
# Break-glass instance administrators. Omit this whole block in production; add it only to get
|
|
# back in when SSO is broken, then remove it again. While present, the generated password is
|
|
# written to the log of the process that synchronized the configuration (the migrate Job), and
|
|
# anyone who can read that log can sign in as an instance administrator. The password is derived
|
|
# from a database-held secret, the username and the current UTC hour; it rotates every hour.
|
|
# bootstrap_admin:
|
|
# usernames: [rescue]
|
|
|
|
# OpenID Connect provider. Confidential client, authorization-code flow with PKCE.
|
|
# Redirect URI to register: {MEGURI_PUBLIC_URL}/api/oidc/callback
|
|
oidc:
|
|
issuer: https://sso.example.internal/realms/corp # HTTPS; discovery is read from <issuer>/.well-known/openid-configuration
|
|
client_id: meguri
|
|
scopes: [openid, profile, email] # default; must include openid; email links people planned by email
|
|
# Where the groups are. A dotted path into the token claims (for example realm_access.roles).
|
|
# Keycloak: add a "Group Membership" mapper with this claim name, "Add to ID token" and
|
|
# "Add to userinfo" on. Matching below is by exact string, so "Full group path" decides
|
|
# whether values look like /payments/leads or leads.
|
|
groups_claim: groups
|
|
groups_sources: [id_token, userinfo] # searched in this order
|
|
|
|
# Groups whose members are instance administrators: they see and may act in every enabled
|
|
# workspace, manage password users and delete disabled workspaces. Not tied to any workspace.
|
|
instance_admin_groups:
|
|
- /meguri/admins
|
|
|
|
# Workspaces. `key` is the permanent identifier (3-64 characters: a-z, 0-9, hyphen); never reuse
|
|
# it for something else. `name` is unique and is what people see; changing it renames the
|
|
# workspace. A workspace that exists without a key and has exactly this name is adopted.
|
|
# Removing an entry here DISABLES the workspace (nobody can open it, nothing is published, data is
|
|
# kept); listing it again re-enables it. Deleting it for good is a manual action on the
|
|
# instance administrator's page.
|
|
workspaces:
|
|
- key: payments
|
|
name: Payments
|
|
# Workspace administrators (team leads): every permission in this workspace only. At least one group.
|
|
admin_groups:
|
|
- /payments/leads
|
|
# Employees: the workspace's employee permission set, by default calendar, schedule editing
|
|
# and replacement requests. Administrators change that set in the workspace settings.
|
|
member_groups:
|
|
- /payments/team
|
|
|
|
- key: customer-support
|
|
name: Customer Support
|
|
admin_groups:
|
|
- /support/leads
|
|
member_groups:
|
|
- /support/team
|
|
- /support/contractors
|