Initial commit

2026-10-23 18:15:49 -04:00
commit 935b3e9f4c
18 changed files with 909 additions and 0 deletions
@@ -0,0 +1,135 @@
+replicaCount: 1
+image:
+  tag: {{ dex_image_tag | to_json }}
+imagePullSecrets: {{ dex_image_pull_secrets | to_json }}
+rbac:
+  create: false
+resources: {{ dex_resources | to_json }}
+securityContext:
+  runAsNonRoot: true
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+  capabilities:
+    drop: [ALL]
+podAnnotations:
+  theme/revision: {{ (lookup('ansible.builtin.file', role_path ~ '/files/styles.css') ~ lookup('ansible.builtin.file', role_path ~ '/files/logo.svg') ~ (dex_theme_enabled | string) ~ dex_env_secret_name ~ dex_ca_secret_name) | hash('sha256') | to_json }}
+{% if dex_env_secret_name %}
+envFrom:
+  - secretRef:
+      name: {{ dex_env_secret_name | to_json }}
+{% endif %}
+config:
+  issuer: {{ dex_issuer | to_json }}
+  logger:
+    level: info
+    format: json
+{% if dex_theme_enabled %}
+  frontend:
+    issuer: {{ dex_brand_name | to_json }}
+    dir: /srv/dex/web
+    theme: light
+    logoURL: theme/logo.svg
+{% endif %}
+  storage:
+    type: postgres
+    config:
+      host: {{ dex_postgres_host | to_json }}
+      port: {{ dex_postgres_port }}
+      database: {{ dex_postgres_database | to_json }}
+      user: {{ dex_postgres_user | to_json }}
+      password: {{ dex_postgres_password | to_json }}
+      ssl:
+        mode: {{ dex_postgres_ssl_mode | to_json }}
+  staticClients:{% if not dex_matrix_client_enabled and not dex_static_clients %} []{% endif %}
+
+{% if dex_matrix_client_enabled %}
+    - id: {{ matrix_dex_oidc_client_id | to_json }}
+      name: Matrix Auth Service
+      secret: {{ matrix_dex_oidc_client_secret | to_json }}
+      redirectURIs: {{ dex_matrix_redirect_uris | to_json }}
+{% endif %}
+{% for client in dex_static_clients %}
+    - {{ client | to_json }}
+{% endfor %}
+  connectors:
+    - type: ldap
+      id: {{ dex_ldap_connector_id | to_json }}
+      name: {{ dex_ldap_connector_name | to_json }}
+      config:
+        host: {{ dex_ldap_host | to_json }}
+        insecureNoSSL: {{ dex_ldap_insecure_no_ssl | bool | to_json }}
+        startTLS: {{ dex_ldap_start_tls | bool | to_json }}
+        insecureSkipVerify: false
+{% if dex_ldap_root_ca %}
+        rootCA: {{ dex_ldap_root_ca | to_json }}
+{% endif %}
+        bindDN: {{ dex_ldap_bind_dn | to_json }}
+        bindPW: {{ dex_ldap_bind_password | to_json }}
+        userSearch:
+          baseDN: {{ dex_ldap_user_base_dn | to_json }}
+          filter: {{ dex_ldap_user_filter | to_json }}
+          username: uid
+          idAttr: {{ dex_ldap_id_attribute | to_json }}
+          emailAttr: mail
+          nameAttr: {{ dex_ldap_name_attribute | to_json }}
+          preferredUsernameAttr: uid
+        groupSearch:
+          baseDN: {{ dex_ldap_group_base_dn | to_json }}
+          filter: {{ dex_ldap_group_filter | to_json }}
+          userMatchers:
+            - userAttr: {{ dex_ldap_group_user_attribute | to_json }}
+              groupAttr: uniqueMember
+          nameAttr: cn
+{% for connector in dex_additional_connectors %}
+    - {{ connector | to_json }}
+{% endfor %}
+volumes:{% if not dex_theme_enabled and not dex_ca_secret_name and not dex_extra_volumes %} []{% endif %}
+
+{% if dex_theme_enabled %}
+  - name: theme
+    configMap:
+      name: {{ dex_theme_configmap_name }}
+{% endif %}
+{% if dex_ca_secret_name %}
+  - name: ca
+    secret:
+      secretName: {{ dex_ca_secret_name }}
+{% endif %}
+{% for volume in dex_extra_volumes %}
+  - {{ volume | to_json }}
+{% endfor %}
+volumeMounts:{% if not dex_theme_enabled and not dex_ca_secret_name and not dex_extra_volume_mounts %} []{% endif %}
+
+{% if dex_theme_enabled %}
+  - name: theme
+    mountPath: /srv/dex/web/themes/light/styles.css
+    subPath: styles.css
+    readOnly: true
+  - name: theme
+    mountPath: /srv/dex/web/themes/light/logo.svg
+    subPath: logo.svg
+    readOnly: true
+{% endif %}
+{% if dex_ca_secret_name %}
+  - name: ca
+    mountPath: /etc/dex-ca
+    readOnly: true
+{% endif %}
+{% for mount in dex_extra_volume_mounts %}
+  - {{ mount | to_json }}
+{% endfor %}
+ingress:
+  enabled: true
+  className: {{ dex_ingress_class | to_json }}
+  annotations:
+    cert-manager.io/cluster-issuer: {{ dex_cluster_issuer | to_json }}
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/enable-access-log: "false"
+  hosts:
+    - host: {{ dex_hostname }}
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts: [{{ dex_hostname }}]
+      secretName: {{ dex_tls_secret_name }}