mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-07-18 14:34:24 +02:00
24 lines
2.0 KiB
Django/Jinja
24 lines
2.0 KiB
Django/Jinja
http_address = "0.0.0.0:4180"
|
|
cookie_secret = "{{ applications | get_app_conf(oauth2_proxy_application_id, 'credentials.oauth2_proxy_cookie_secret', True) }}"
|
|
cookie_secure = "true" # True is necessary to force the cookie set via https
|
|
upstreams = "http://{{ applications | get_app_conf(oauth2_proxy_application_id, 'oauth2_proxy.application', True) }}:{{ applications | get_app_conf(oauth2_proxy_application_id, 'oauth2_proxy.port', True) }}"
|
|
cookie_domains = ["{{ domains | get_domain(oauth2_proxy_application_id) }}", "{{ domains | get_domain('keycloak') }}"] # Required so cookie can be read on all subdomains.
|
|
whitelist_domains = [".{{ primary_domain }}"] # Required to allow redirection back to original requested target.
|
|
|
|
# keycloak provider
|
|
client_secret = "{{ oidc.client.secret }}"
|
|
client_id = "{{ oidc.client.id }}"
|
|
redirect_url = "{{ web_protocol }}://{{ domains | get_domain(oauth2_proxy_application_id) }}/oauth2/callback"
|
|
oidc_issuer_url = "{{ oidc.client.issuer_url }}"
|
|
provider = "oidc"
|
|
provider_display_name = "{{ oidc.button_text }}"
|
|
|
|
{% if applications | get_app_conf(oauth2_proxy_application_id, 'oauth2_proxy.allowed_groups', False) %}
|
|
{# role based restrictions #}
|
|
scope = "openid email profile {{ oidc.claims.groups }}"
|
|
oidc_groups_claim = "{{ oidc.claims.groups }}"
|
|
allowed_groups = {{ applications | get_app_conf(oauth2_proxy_application_id, 'oauth2_proxy.allowed_groups', True) | tojson }}
|
|
email_domains = ["*"]
|
|
{% else %}
|
|
email_domains = "{{ primary_domain }}"
|
|
{% endif %} |