142 lines
5.6 KiB
YAML
142 lines
5.6 KiB
YAML
---
|
|
# tasks file for synapse
|
|
- name: Add Small Hack repo
|
|
kubernetes.core.helm_repository:
|
|
name: small-hack-matrix-auth-service
|
|
repo_url: https://small-hack.github.io/matrix-authentication-service-chart
|
|
register: repo
|
|
|
|
- name: Update Helm repos
|
|
command: helm repo update
|
|
when: repo.changed
|
|
|
|
- name: Deploy Matrix Auth Service
|
|
kubernetes.core.helm:
|
|
name: matrix-auth-service
|
|
chart_ref: small-hack-matrix-auth-service/matrix-authentication-service
|
|
release_namespace: matrix-auth-service
|
|
create_namespace: true
|
|
values:
|
|
fullnameOverride: mas
|
|
image:
|
|
pullPolicy: IfNotPresent
|
|
tag: latest
|
|
http:
|
|
public_base: https://matrix-auth-service.eom.dev/
|
|
ingress:
|
|
className: nginx
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: ca-issuer
|
|
hosts:
|
|
- host: matrix-auth-service.eom.dev
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- secretName: mas-tls
|
|
hosts:
|
|
- matrix-auth-service.eom.dev
|
|
postgresql:
|
|
enabled: true
|
|
global:
|
|
auth:
|
|
password: "{{ matrix_auth_service_admin_password }}"
|
|
mas:
|
|
http:
|
|
public_base: https://matrix-auth-service.eom.dev/
|
|
policy:
|
|
client_registration:
|
|
allow_host_mismatch: false
|
|
allow_insecure_uris: false
|
|
clients:
|
|
- client_id: 0000000000000000000SYNAPSE
|
|
client_auth_method: client_secret_basic
|
|
client_secret: 5ZrwKXmKdiQfus2J
|
|
matrix:
|
|
homeserver: synapse.eom.dev
|
|
endpoint: https://synapse.eom.dev
|
|
secret: SacP5rWpci6GMqb2
|
|
email:
|
|
from: Matrix Auth Service <matrix-auth-service@eom.dev>
|
|
reply_to: Matrix Auth Service <matrix-auth-service@eom.dev>
|
|
transport: smtp
|
|
mode: tls
|
|
hostname: postfix.eom.dev
|
|
port: 587
|
|
username: matrix-auth-service
|
|
password: "{{ matrix_auth_service_admin_password }}"
|
|
upstream_oauth2:
|
|
providers:
|
|
- id: 01JG22H4F0G8PYCZ5HVTQVHBC4
|
|
issuer: https://google.com/
|
|
human_name: Google
|
|
brand_name: google
|
|
pkce_method: auto
|
|
client_id: "{{ matrix_google_oidc_client_id }}"
|
|
client_secret: "{{ matrix_google_oidc_client_secret }}"
|
|
token_endpoint_auth_method: client_secret_basic
|
|
scope: "openid email profile"
|
|
discovery_mode: oidc
|
|
claims_imports:
|
|
subject:
|
|
template: "{{ '{{ user.sub }}' | quote }}"
|
|
|
|
# -- The localpart is the local part of the user's Matrix ID.
|
|
# For example, on the `example.com` server, if the localpart is `alice`,
|
|
# the user's Matrix ID will be `@alice:example.com`.
|
|
localpart:
|
|
action: require
|
|
template: "{{ '{{ user.preferred_username }}' | quote }}"
|
|
|
|
# -- The display name is the user's display name.
|
|
displayname:
|
|
action: suggest
|
|
template: "{{ '{{ user.name }}' | quote }}"
|
|
|
|
# -- An email address to import.
|
|
email:
|
|
action: suggest
|
|
template: "{{ '{{ user.email }}' | quote }}"
|
|
# -- Whether the email address must be marked as verified.
|
|
# Possible values are:
|
|
# - `import`: mark the email address as verified if the upstream provider
|
|
# has marked it as verified, using the `email_verified` claim.
|
|
# This is the default.
|
|
# - `always`: mark the email address as verified
|
|
# - `never`: mark the email address as not verified
|
|
set_email_verification: import
|
|
# - id: 01JG2B7DBS6RQRH1TFVZ4BP7H8
|
|
# issuer: https://github.com/
|
|
# client_id: "{{ matrix_github_oidc_client_id }}"
|
|
# client_secret: "{{ matrix_github_oidc_client_secret }}"
|
|
# token_endpoint_auth_method: client_secret_basic
|
|
# discovery_mode: oidc
|
|
# claims_imports:
|
|
# subject:
|
|
# template: "{{ '{{ user.sub }}' | quote }}"
|
|
#
|
|
# # -- The localpart is the local part of the user's Matrix ID.
|
|
# # For example, on the `example.com` server, if the localpart is `alice`,
|
|
# # the user's Matrix ID will be `@alice:example.com`.
|
|
# localpart:
|
|
# action: require
|
|
# template: "{{ '{{ user.preferred_username }}' | quote }}"
|
|
#
|
|
# # -- The display name is the user's display name.
|
|
# displayname:
|
|
# action: suggest
|
|
# template: "{{ '{{ user.name }}' | quote }}"
|
|
#
|
|
# # -- An email address to import.
|
|
# email:
|
|
# action: suggest
|
|
# template: "{{ '{{ user.email }}' | quote }}"
|
|
# # -- Whether the email address must be marked as verified.
|
|
# # Possible values are:
|
|
# # - `import`: mark the email address as verified if the upstream provider
|
|
# # has marked it as verified, using the `email_verified` claim.
|
|
# # This is the default.
|
|
# # - `always`: mark the email address as verified
|
|
# # - `never`: mark the email address as not verified
|
|
# set_email_verification: import
|