kevinveenbirkenbach/computer-playbook
1
0
Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2025-08-29 15:06:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Implemented OAuth2-Proxy and other security measures for phpmyadmin

Browse Source
This commit is contained in:
Kevin Veen-Birkenbach
2025-01-26 20:57:34 +01:00
parent ec5768f3d4
commit b742ffd476
7 changed files with 45 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
roles/docker-oauth2-proxy/templates/oauth2-proxy-keycloak.cfg.j2
View File

@@ -1,15 +1,19 @@
http_address="0.0.0.0:4180"
cookie_secret="{{oauth2_proxy_cookie_secret}}"
email_domains="{{primary_domain}}"
cookie_secure="false"
upstreams="http://{{oauth2_proxy_upstream_application_and_port}}"
cookie_domains=["{{domain}}", "{{domain_keycloak}}"] # Required so cookie can be read on all subdomains.
whitelist_domains=[".{{primary_domain}}"] # Required to allow redirection back to original requested target.
http_address = "0.0.0.0:4180"
cookie_secret = "{{oauth2_proxy_cookie_secret}}"
email_domains = "{{primary_domain}}"
cookie_secure = "false"
upstreams = "http://{{oauth2_proxy_upstream_application_and_port}}"
cookie_domains = ["{{domain}}", "{{domain_keycloak}}"] # Required so cookie can be read on all subdomains.
whitelist_domains = [".{{primary_domain}}"] # Required to allow redirection back to original requested target.
# keycloak provider
client_secret="{{oauth2_proxy_client_secret}}"
client_id="{{domain}}"
redirect_url="https://{{domain}}/oauth2/callback"
oidc_issuer_url="https://{{domain_keycloak}}/realms/{{primary_domain}}"
provider="oidc"
provider_display_name="Keycloak"
client_secret = "{{oauth2_proxy_client_secret}}"
client_id = "{{domain}}"
redirect_url = "https://{{domain}}/oauth2/callback"
oidc_issuer_url = "https://{{domain_keycloak}}/realms/{{primary_domain}}"
provider = "oidc"
provider_display_name = "Keycloak"
# role restrictions
cookie_roles = "realm_access.roles"
allowed_roles = "{{oauth2_proxy_allowed_roles}}"