kevinveenbirkenbach/computer-playbook
1
0
Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2025-06-28 05:05:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added SSH Pub Key implementation in Gitea

Browse Source
This commit is contained in:
Kevin Veen-Birkenbach 2025-06-27 17:25:12 +02:00
parent 40edaa52ad
commit b3e82fa457
No known key found for this signature in database
GPG Key ID: 44D8F11FD62F878E
3 changed files with 20 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
group_vars/all/12_iam.yml
View File

@ -93,6 +93,7 @@ ldap:
fullname: "cn" fullname: "cn"
firstname: "givenname" firstname: "givenname"
surname: "sn" surname: "sn"
ssh_public_key: "sshPublicKey"
# Password to access dn.bind # Password to access dn.bind
bind_credential: "{{applications.ldap.credentials.administrator_database_password}}" bind_credential: "{{applications.ldap.credentials.administrator_database_password}}"
server: server:

28
roles/docker-gitea/tasks/setup/ldap.yml
View File

@ -3,19 +3,7 @@
docker-compose -f "{{ docker_compose.directories.instance }}/docker-compose.yml" \ docker-compose -f "{{ docker_compose.directories.instance }}/docker-compose.yml" \
exec -T --user git application \ exec -T --user git application \
gitea admin auth add-ldap \ gitea admin auth add-ldap \
--name "LDAP ({{ primary_domain }})" \ {{ gitea_ldap_auth_args | join(' ') }}
--host "{{ ldap.server.domain }}" \
--port {{ ldap.server.port }} \
--security-protocol "{{ ldap.server.security | trim or 'unencrypted' }}" \
--bind-dn "{{ ldap.dn.administrator.data }}" \
--bind-password "{{ ldap.bind_credential }}" \
--user-search-base "{{ ldap.dn.users }}" \
--user-filter "{{ ldap.filters.users.login }}" \
--username-attribute "{{ ldap.attributes.user_id }}" \
--firstname-attribute "{{ ldap.attributes.firstname }}" \
--surname-attribute "{{ ldap.attributes.surname }}" \
--email-attribute "{{ ldap.attributes.mail }}" \
--synchronize-users # turns on per-login sync
args: args:
chdir: "{{ docker_compose.directories.instance }}" chdir: "{{ docker_compose.directories.instance }}"
register: ldap_manage register: ldap_manage
@ -47,19 +35,7 @@
exec -T --user git application \ exec -T --user git application \
gitea admin auth update-ldap \ gitea admin auth update-ldap \
--id {{ ldap_source_id }} \ --id {{ ldap_source_id }} \
--name "LDAP ({{ primary_domain }})" \ {{ gitea_ldap_auth_args | join(' ') }}
--host "{{ ldap.server.domain }}" \
--port {{ ldap.server.port }} \
--security-protocol "{{ ldap.server.security | trim or 'unencrypted' }}" \
--bind-dn "{{ ldap.dn.administrator.data }}" \
--bind-password "{{ ldap.bind_credential }}" \
--user-search-base "{{ ldap.dn.users }}" \
--user-filter "(&(objectClass=inetOrgPerson)(uid=%s))" \
--username-attribute "{{ ldap.attributes.user_id }}" \
--firstname-attribute "{{ ldap.attributes.firstname }}" \
--surname-attribute "{{ ldap.attributes.surname }}" \
--email-attribute "{{ ldap.attributes.mail }}" \
--synchronize-users
args: args:
chdir: "{{ docker_compose.directories.instance }}" chdir: "{{ docker_compose.directories.instance }}"
register: ldap_manage register: ldap_manage

15
roles/docker-gitea/vars/main.yml
View File

@ -1,2 +1,17 @@
application_id: "gitea" application_id: "gitea"
database_type: "mariadb" database_type: "mariadb"
gitea_ldap_auth_args:
- '--name "LDAP ({{ primary_domain }})"'
- '--host "{{ ldap.server.domain }}"'
- '--port {{ ldap.server.port }}'
- '--security-protocol "{{ ldap.server.security | trim or "unencrypted" }}"'
- '--bind-dn "{{ ldap.dn.administrator.data }}"'
- '--bind-password "{{ ldap.bind_credential }}"'
- '--user-search-base "{{ ldap.dn.users }}"'
- '--user-filter "(&(objectClass=inetOrgPerson)(uid=%s))"'
- '--username-attribute "{{ ldap.attributes.user_id }}"'
- '--firstname-attribute "{{ ldap.attributes.firstname }}"'
- '--surname-attribute "{{ ldap.attributes.surname }}"'
- '--email-attribute "{{ ldap.attributes.mail }}"'
- '--public-ssh-key-attribute "{{ ldap.attributes.ssh_public_key }}"'
- '--synchronize-users'