mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
48 lines
2.2 KiB
Django/Jinja
48 lines
2.2 KiB
Django/Jinja
<?php
|
|
// Roundcube OAuth2/OIDC against Keycloak. Auto-included by the roundcube image
|
|
// (config/*.php). Client secret comes from ROUNDCUBEMAIL_OAUTH_CLIENT_SECRET so
|
|
// it stays out of this world-readable file. Login -> Keycloak, then XOAUTH2 to
|
|
// Stalwart.
|
|
// Rendered even without SSO (the bind source must exist); the body self-gates.
|
|
{% if STALWART_SSO_ENABLED | bool %}
|
|
|
|
{% if STALWART_WEBMAIL_BASE_URL.startswith('https://') %}
|
|
$_SERVER['HTTPS'] = 'on';
|
|
{% endif %}
|
|
|
|
$config['oauth_provider'] = 'generic';
|
|
$config['oauth_provider_name'] = '{{ OIDC.BUTTON_TEXT }}';
|
|
// Minimal-scope client so the access token stays under Stalwart's 4096-byte
|
|
// XOAUTH2 SASL line limit. See templates/keycloak/clients.json.j2.
|
|
$config['oauth_client_id'] = '{{ STALWART_WEBMAIL_OIDC_CLIENT_ID }}';
|
|
$config['oauth_auth_uri'] = '{{ OIDC.CLIENT.AUTHORIZE_URL }}';
|
|
$config['oauth_token_uri'] = '{{ OIDC.CLIENT.TOKEN_URL }}';
|
|
$config['oauth_identity_uri'] = '{{ OIDC.CLIENT.USER_INFO_URL }}';
|
|
$config['oauth_logout_uri'] = '{{ OIDC.CLIENT.LOGOUT_URL }}';
|
|
$config['oauth_scope'] = 'openid email profile';
|
|
{% if STALWART_OIDC_SOCKS_PROXY %}
|
|
$config['http_client'] = ['proxy' => '{{ STALWART_OIDC_SOCKS_PROXY }}'];
|
|
{% endif %}
|
|
$config['oauth_auth_parameters'] = [];
|
|
$config['oauth_identity_fields'] = ['email', '{{ OIDC.ATTRIBUTES.USERNAME }}'];
|
|
// Auto-redirect the login form straight to Keycloak (single sign-on).
|
|
$config['oauth_login_redirect'] = true;
|
|
|
|
// Accept Stalwart's self-signed cert on the internal IMAP(993)/SMTP(465) TLS hop
|
|
// — Roundcube connects by container name, which won't match the cert SAN.
|
|
$stalwart_tls_conn_options = ['ssl' => [
|
|
'verify_peer' => false,
|
|
'verify_peer_name' => false,
|
|
'allow_self_signed' => true,
|
|
]];
|
|
$config['imap_conn_options'] = $stalwart_tls_conn_options;
|
|
$config['smtp_conn_options'] = $stalwart_tls_conn_options;
|
|
|
|
// Authenticated XOAUTH2 submission over implicit TLS on :465 (this include loads
|
|
// last, so it wins). smtp_user must be non-empty or Stalwart rejects with
|
|
// "5.5.1 You must authenticate first"; the OAuth plugin swaps %p for a token.
|
|
$config['smtp_host'] = 'ssl://stalwart:465';
|
|
$config['smtp_user'] = '%u';
|
|
$config['smtp_pass'] = '%p';
|
|
{% endif %}
|