From 79648879abb5ae54e7bce2390938a635dd7524a5 Mon Sep 17 00:00:00 2001 From: Ian Fijolek Date: Thu, 29 Aug 2024 14:07:49 -0700 Subject: [PATCH] Use new oidc module for setting up oidc with Authelia --- core/authelia.tf | 23 ++++++++++- core/authelia.yml | 16 +++++++- core/grafana.nomad | 5 ++- core/grafana/grafana.ini | 2 +- core/metrics.tf | 24 +++++++++++ services/gitea.tf | 54 ++++++++++++++++++++++++- services/photoprism.tf | 16 ++++++-- services/service/main.tf | 20 +++++++++ services/service/service_template.nomad | 3 ++ services/service/vars.tf | 13 ++++++ 10 files changed, 167 insertions(+), 9 deletions(-) diff --git a/core/authelia.tf b/core/authelia.tf index aeda0db..4cf126a 100644 --- a/core/authelia.tf +++ b/core/authelia.tf @@ -114,6 +114,9 @@ namespace "default" { path "authelia/*" { capabilities = ["read"] } + path "secrets/authelia/*" { + capabilities = ["read"] + } } } EOH @@ -142,6 +145,22 @@ EOH } } +# Enable oidc for nomad clients +module "nomad_oidc_client" { + source = "./oidc_client" + + name = "nomad" + oidc_client_config = { + description = "Nomad" + authorization_policy = "two_factor" + redirect_uris = [ + "https://nomad.${var.base_hostname}/oidc/callback", + "https://nomad.${var.base_hostname}/ui/settings/tokens", + ] + scopes = ["openid", "groups"] + } +} + resource "nomad_acl_auth_method" "nomad_authelia" { name = "authelia" type = "OIDC" @@ -151,8 +170,8 @@ resource "nomad_acl_auth_method" "nomad_authelia" { config { oidc_discovery_url = "https://authelia.${var.base_hostname}" - oidc_client_id = "nomad" - oidc_client_secret = yamldecode(file("${path.module}/../ansible_playbooks/vars/nomad_vars.yml"))["nomad/oidc"]["secret"] + oidc_client_id = module.nomad_oidc_client.client_id + oidc_client_secret = module.nomad_oidc_client.secret bound_audiences = ["nomad"] oidc_scopes = [ "groups", diff --git a/core/authelia.yml b/core/authelia.yml index e1498dc..6f44985 100644 --- a/core/authelia.yml +++ b/core/authelia.yml @@ -249,4 +249,18 @@ identity_providers: # hmac_secret: # issuer_private_key: - clients: {{ with nomadVar "nomad/jobs/authelia" }}{{ .oidc_clients.Value }}{{ end }} + clients: +{{ range nomadVarList "authelia/access_control/oidc_clients" -}} +{{- $name := (sprig_last (sprig_splitList "/" .Path)) -}} + {{ "-" | indent 6 }} +{{ with nomadVar .Path }} + +{{- $im := .ItemsMap -}} +{{- $im = sprig_set $im "redirect_uris" (.redirect_uris.Value | parseYAML) -}} +{{- $im = sprig_set $im "scopes" (.scopes.Value | parseYAML) -}} +{{- with nomadVar (printf "secrets/authelia/%s" $name) -}} +{{- $im = sprig_set $im "secret" .secret_hash.Value -}} +{{- end -}} +{{ $im | toYAML | indent 8 }} +{{ end }} +{{ end }} diff --git a/core/grafana.nomad b/core/grafana.nomad index 5a5f100..fbdebd0 100644 --- a/core/grafana.nomad +++ b/core/grafana.nomad @@ -155,7 +155,6 @@ GF_SECURITY_ADMIN_PASSWORD={{ .admin_pw }} GF_EXTERNAL_IMAGE_STORAGE_S3_ACCESS_KEY={{ .minio_access_key }} GF_EXTERNAL_IMAGE_STORAGE_S3_SECRET_KEY={{ .minio_secret_key }} GRAFANA_ALERT_EMAIL_ADDRESSES={{ .alert_email_addresses }} -GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET={{ .oidc_secret }} {{ if .db_name -}} # Database storage GF_DATABASE_TYPE=mysql @@ -167,6 +166,10 @@ GF_DATABASE_PASSWORD={{ .db_pass }} SLACK_BOT_URL={{ .slack_bot_url }} SLACK_BOT_TOKEN={{ .slack_bot_token }} SLACK_HOOK_URL={{ .slack_hook_url }} +{{ end -}} +{{ with nomadVar "secrets/authelia/grafana" -}} +GF_AUTH_GENERIC_OAUTH_CLIENT_ID={{ .client_id }} +GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET={{ .secret }} {{ end -}} EOF env = true diff --git a/core/grafana/grafana.ini b/core/grafana/grafana.ini index 3745bda..a688061 100644 --- a/core/grafana/grafana.ini +++ b/core/grafana/grafana.ini @@ -261,7 +261,7 @@ log_queries = enabled = true name = Authelia ;allow_sign_up = true -client_id = grafana +client_id = from_env client_secret = from_env scopes = openid profile email groups auth_url = https://authelia.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{{ end }}/api/oidc/authorization diff --git a/core/metrics.tf b/core/metrics.tf index 98094ae..1265f53 100644 --- a/core/metrics.tf +++ b/core/metrics.tf @@ -93,3 +93,27 @@ EOH task = "stunnel" } } + +module "grafana_oidc" { + source = "./oidc_client" + + name = "grafana" + oidc_client_config = { + description = "Grafana" + scopes = [ + "openid", + "groups", + "email", + "profile", + ] + redirect_uris = [ + "https://grafana.thefij.rocks/login/generic_oauth", + ] + } + + job_acl = { + job_id = "grafana" + group = "grafana" + task = "grafana" + } +} diff --git a/services/gitea.tf b/services/gitea.tf index 896a313..943d2c7 100644 --- a/services/gitea.tf +++ b/services/gitea.tf @@ -42,10 +42,19 @@ module "gitea" { ] use_smtp = true + mysql_bootstrap = { enabled = true } + oidc_client_config = { + description = "Gitea" + redirect_uris = [ + "https://git.thefij.rocks/user/oauth2/authelia/callback", + ] + scopes = ["openid", "email", "profile"] + } + host_volumes = [ { name = "gitea-data" @@ -111,6 +120,49 @@ GITEA__mailer__PASSWD={{ .password }} mount = false dest = "env" dest_prefix = "$${NOMAD_SECRETS_DIR}" - } + }, + { + data = <