99 lines
4.1 KiB
YAML
Executable File
99 lines
4.1 KiB
YAML
Executable File
---
|
|
# Run on the controller with its existing kubeconfig; no SSH target is required.
|
|
# Supply credentials via inventory/group_vars or a Vault-encrypted vars file.
|
|
- name: Deploy eom.dev Dex with Catppuccin branding
|
|
hosts: alpha-control-plane
|
|
vars_files:
|
|
../secrets.yaml
|
|
become: true
|
|
vars:
|
|
dex_namespace: dex
|
|
dex_release_name: dex
|
|
dex_chart_version: "0.26.0"
|
|
dex_issuer: https://dex.eom.dev/
|
|
dex_hostname: dex.eom.dev
|
|
dex_ingress_class: nginx
|
|
dex_cluster_issuer: ca-issuer
|
|
dex_tls_secret_name: dex
|
|
dex_theme_enabled: true
|
|
dex_brand_name: eom.dev
|
|
dex_theme_configmap_name: dex-catppuccin
|
|
|
|
# Preserve the existing DB release and data; do not upgrade it by default.
|
|
dex_postgres_manage: false
|
|
dex_postgres_release_name: postgresql
|
|
dex_postgres_host: postgresql
|
|
dex_postgres_port: 5432
|
|
dex_postgres_database: dex
|
|
dex_postgres_user: dex
|
|
dex_postgres_storage_size: 256Gi
|
|
dex_postgres_ssl_mode: disable
|
|
dex_postgres_password: "{{ dex_admin_password }}"
|
|
dex_postgres_admin_password: "{{ postgresql_admin_password | default('') }}"
|
|
|
|
# Keep the existing connector ID and UID subject mapping. The filter also
|
|
# admits website inetOrgPerson accounts so there is one Dex login option.
|
|
dex_ldap_host: openldap.openldap.svc.cluster.local
|
|
dex_ldap_insecure_no_ssl: true
|
|
dex_ldap_start_tls: false
|
|
dex_ldap_bind_dn: cn=readonly,dc=eom,dc=dev
|
|
dex_ldap_bind_password: "{{ openldap_readonly_password }}"
|
|
dex_ldap_connector_id: ldap
|
|
dex_ldap_connector_name: eom.dev account
|
|
dex_ldap_user_base_dn: dc=eom,dc=dev
|
|
dex_ldap_user_filter: "(|(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))(objectClass=inetOrgPerson))"
|
|
dex_ldap_id_attribute: uid
|
|
dex_ldap_name_attribute: givenName
|
|
dex_ldap_group_base_dn: dc=eom,dc=dev
|
|
dex_ldap_group_user_attribute: cn
|
|
dex_ldap_group_filter: "(objectClass=groupOfUniqueNames)"
|
|
|
|
# All clients are declared once below; don't also emit the convenience client.
|
|
dex_matrix_client_enabled: false
|
|
# Credentials are separate Vault/inventory variables, shared only with the
|
|
# corresponding application. No secret is generated or rotated by this play.
|
|
dex_static_clients:
|
|
- id: "{{ matrix_dex_oidc_client_id }}"
|
|
name: Matrix Auth Service
|
|
secret: "{{ matrix_dex_oidc_client_secret }}"
|
|
redirectURIs:
|
|
- https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4
|
|
- id: www-membership
|
|
name: eom.dev Membership
|
|
secret: "{{ www_dex_client_secret }}"
|
|
redirectURIs:
|
|
- https://www.eom.dev/members/oidc/callback/
|
|
- id: gitea
|
|
name: Gitea
|
|
secret: "{{ gitea_dex_client_secret }}"
|
|
# Authentication source in Gitea must be named exactly "dex".
|
|
redirectURIs:
|
|
- https://gitea.eom.dev/user/oauth2/dex/callback
|
|
- id: discourse
|
|
name: Discourse
|
|
secret: "{{ discourse_dex_client_secret }}"
|
|
# discourse-openid-connect strategy name is oidc.
|
|
redirectURIs:
|
|
- https://discourse.eom.dev/auth/oidc/callback
|
|
- id: peertube
|
|
name: PeerTube
|
|
secret: "{{ peertube_dex_client_secret }}"
|
|
# Requires peertube-plugin-auth-openid-connect.
|
|
redirectURIs:
|
|
- https://peertube.eom.dev/plugins/auth-openid-connect/router/code-cb
|
|
- id: mastodon
|
|
name: Mastodon
|
|
secret: "{{ mastodon_dex_client_secret }}"
|
|
# Matches OIDC_REDIRECT_URI in the existing Mastodon deployment.
|
|
redirectURIs:
|
|
- https://mastodon.eom.dev/auth/auth/openid_connect/callback
|
|
- id: nextcloud
|
|
name: Nextcloud
|
|
secret: "{{ nextcloud_dex_client_secret }}"
|
|
# This chooses the user_oidc app, not oidc_login or the OIDC provider app.
|
|
# Override from its admin screen if your installation rewrites index.php.
|
|
redirectURIs:
|
|
- https://nextcloud.eom.dev/index.php/apps/user_oidc/code
|
|
roles:
|
|
- ansible-role-dex
|