kevinveenbirkenbach/computer-playbook
1
0
Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2025-08-29 15:06:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Solved oauth2 proxy configuration bugs

Browse Source
This commit is contained in:
Kevin Veen-Birkenbach
2025-05-13 09:16:34 +02:00
parent 9ea92ea9ec
commit 7ce480bd5c
7 changed files with 112 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
roles/docker-central-database/tasks/main.yml
View File

@@ -1,4 +1,4 @@
- name: "set _tmp_database_application_id (Needed due to lazzy loading issue)"
- name: "set database_application_id (Needed due to lazzy loading issue)"
set_fact:
database_application_id: "{{ application_id }}"

2
roles/docker-oauth2-proxy/tasks/main.yml
View File

@@ -1,6 +1,6 @@
- name: "Transfering oauth2-proxy-keycloak.cfg.j2 to {{docker_compose.directories.volumes}}"
template:
src: oauth2-proxy-keycloak.cfg.j2
dest: "{{docker_compose.directories.volumes}}{{applications.oauth2_proxy.configuration_file}}"
dest: "{{docker_compose.directories.volumes}}{{applications[application_id].configuration_file}}"
notify:
- docker compose project setup

18
roles/docker-oauth2-proxy/templates/oauth2-proxy-keycloak.cfg.j2
View File

@@ -1,20 +1,20 @@
http_address = "0.0.0.0:4180"
cookie_secret = "{{ applications[application_id].credentials.oauth2_proxy_cookie_secret }}"
email_domains = "{{primary_domain}}"
cookie_secret = "{{ applications[oauth2_proxy_application_id].credentials.oauth2_proxy_cookie_secret }}"
email_domains = "{{ primary_domain }}"
cookie_secure = "true" # True is necessary to force the cookie set via https
upstreams = "http://{{applications[application_id].oauth2_proxy.application}}:{{applications[application_id].oauth2_proxy.port}}"
cookie_domains = ["{{domain}}", "{{domains.keycloak}}"] # Required so cookie can be read on all subdomains.
whitelist_domains = [".{{primary_domain}}"] # Required to allow redirection back to original requested target.
upstreams = "http://{{ applications[oauth2_proxy_application_id].oauth2_proxy.application }}:{{ applications[oauth2_proxy_application_id].oauth2_proxy.port }}"
cookie_domains = ["{{ domain }}", "{{ domains.keycloak }}"] # Required so cookie can be read on all subdomains.
whitelist_domains = [".{{ primary_domain }}"] # Required to allow redirection back to original requested target.
# keycloak provider
client_secret = "{{oidc.client.secret}}"
client_id = "{{oidc.client.id}}"
client_secret = "{{ oidc.client.secret }}"
client_id = "{{ oidc.client.id }}"
redirect_url = "{{ web_protocol }}://{{domain}}/oauth2/callback"
oidc_issuer_url = "{{oidc.client.issuer_url}}"
oidc_issuer_url = "{{ oidc.client.issuer_url }}"
provider = "oidc"
provider_display_name = "Keycloak"
# role restrictions
#cookie_roles = "realm_access.roles"
#allowed_groups = "{{applications.oauth2_proxy.allowed_roles}}" # This is not correct here. needs to be placed in applications @todo move there when implementing
#allowed_groups = "{{ applications[oauth2_proxy_application_id].allowed_roles }}" # This is not correct here. needs to be placed in applications @todo move there when implementing
# @see https://chatgpt.com/share/67f42607-bf68-800f-b587-bd56fe9067b5

1
roles/docker-oauth2-proxy/vars/main.yml Normal file
View File

@@ -0,0 +1 @@
application_id: oauth2-proxy

9
roles/nginx-domain-setup/tasks/main.yml
View File

@@ -7,8 +7,13 @@
src: "{{ vhost_template_src }}"
dest: "{{ configuration_destination }}"
notify: restart nginx
- name: "set oauth2_proxy_application_id (Needed due to lazzy loading issue)"
set_fact:
oauth2_proxy_application_id: "{{ application_id }}"
when: "{{applications[application_id].get('features', {}).get('oauth2', False)}}"
- name: "include the docker-oauth2-proxy role {{domain}}"
include_role:
name: docker-oauth2-proxy
when: final_oauth2_enabled | bool
when: "{{applications[application_id].get('features', {}).get('oauth2', False)}}"

3
roles/nginx-domain-setup/vars/main.yml
View File

@@ -1,2 +1 @@
configuration_destination: "{{nginx.directories.http.servers}}{{domain}}.conf"
final_oauth2_enabled: "{{applications[application_id].get('features', {}).get('oauth2', False)}}"
configuration_destination: "{{nginx.directories.http.servers}}{{domain}}.conf"