84 lines
3.3 KiB
YAML
Executable File
84 lines
3.3 KiB
YAML
Executable File
---
|
|
# Run on the controller with its existing kubeconfig; no SSH target is required.
|
|
# Supply credentials via inventory/group_vars or a Vault-encrypted vars file.
|
|
- name: Deploy eom.dev Dex with Catppuccin branding
|
|
hosts: alpha-control-plane
|
|
become: true
|
|
vars_files:
|
|
- ../secrets.yaml
|
|
vars:
|
|
dex_namespace: dex
|
|
dex_release_name: dex
|
|
dex_chart_version: "0.26.0"
|
|
dex_issuer: https://dex.eom.dev/
|
|
dex_hostname: dex.eom.dev
|
|
dex_ingress_class: nginx
|
|
dex_cluster_issuer: ca-issuer
|
|
dex_tls_secret_name: dex
|
|
dex_theme_enabled: true
|
|
dex_brand_name: eom.dev
|
|
dex_theme_configmap_name: dex-catppuccin
|
|
|
|
# Preserve the existing DB release and data; do not upgrade it by default.
|
|
dex_postgres_manage: false
|
|
dex_postgres_release_name: postgresql
|
|
dex_postgres_host: postgresql
|
|
dex_postgres_port: 5432
|
|
dex_postgres_database: dex
|
|
dex_postgres_user: dex
|
|
dex_postgres_storage_size: 256Gi
|
|
dex_postgres_ssl_mode: disable
|
|
dex_postgres_password: "{{ dex_admin_password }}"
|
|
dex_postgres_admin_password: "{{ postgresql_admin_password | default('') }}"
|
|
|
|
# Explicitly preserve internal plaintext LDAP and legacy OIDC subjects.
|
|
dex_ldap_host: openldap.openldap.svc.cluster.local
|
|
dex_ldap_insecure_no_ssl: true
|
|
dex_ldap_start_tls: false
|
|
dex_ldap_bind_dn: cn=readonly,dc=eom,dc=dev
|
|
dex_ldap_bind_password: "{{ openldap_readonly_password }}"
|
|
dex_ldap_connector_id: ldap
|
|
dex_ldap_connector_name: eom.dev account
|
|
dex_ldap_user_base_dn: dc=eom,dc=dev
|
|
dex_ldap_user_filter: "(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))"
|
|
dex_ldap_id_attribute: uid
|
|
dex_ldap_name_attribute: givenName
|
|
dex_ldap_group_base_dn: dc=eom,dc=dev
|
|
dex_ldap_group_user_attribute: cn
|
|
dex_ldap_group_filter: "(objectClass=groupOfUniqueNames)"
|
|
|
|
dex_matrix_client_enabled: true
|
|
dex_matrix_redirect_uris:
|
|
- https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4
|
|
|
|
# Optional website integration. Set www_dex_client_secret in Vault to enable;
|
|
# it must equal the membership application's DEX_CLIENT_SECRET.
|
|
dex_static_clients: "{{ [{'id': 'www-membership', 'name': 'eom.dev Membership', 'secret': www_dex_client_secret, 'redirectURIs': ['https://www.eom.dev/members/oidc/callback/']}] if (www_dex_client_secret | default('') | length > 0) else [] }}"
|
|
dex_additional_connectors: "{{ [_dex_eom_www_connector] if (www_dex_client_secret | default('') | length > 0) else [] }}"
|
|
_dex_eom_www_connector:
|
|
type: ldap
|
|
id: www-ldap
|
|
name: eom.dev Membership
|
|
config:
|
|
host: openldap.openldap.svc.cluster.local
|
|
insecureNoSSL: true
|
|
bindDN: cn=readonly,dc=eom,dc=dev
|
|
bindPW: "{{ openldap_readonly_password }}"
|
|
userSearch:
|
|
baseDN: ou=people,dc=eom,dc=dev
|
|
filter: "(objectClass=inetOrgPerson)"
|
|
username: uid
|
|
idAttr: entryUUID
|
|
emailAttr: mail
|
|
nameAttr: cn
|
|
preferredUsernameAttr: uid
|
|
groupSearch:
|
|
baseDN: ou=groups,dc=eom,dc=dev
|
|
filter: "(objectClass=groupOfUniqueNames)"
|
|
userMatchers:
|
|
- userAttr: DN
|
|
groupAttr: uniqueMember
|
|
nameAttr: cn
|
|
roles:
|
|
- ericomeehan.dex
|