39 lines
1.3 KiB
Bash
39 lines
1.3 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# forgejo-oauth-source.sh — keep the Forgejo OAuth login source aligned with
|
||
|
|
# ZITADEL.
|
||
|
|
#
|
||
|
|
# Forgejo stores login sources in its database, not in GitOps, and its REST API
|
||
|
|
# does not expose them. `tea` has no auth-source command either (tea admin only
|
||
|
|
# manages users), so the supported writer is the in-pod CLI:
|
||
|
|
# gitea admin auth update-oauth
|
||
|
|
#
|
||
|
|
# The source name is the label on the "Sign in with ..." button AND the callback
|
||
|
|
# path (/user/oauth2/<name>/callback), so a rename changes the registered
|
||
|
|
# redirect URI. Register both spellings in ZITADEL (zitadel-provision.py does)
|
||
|
|
# before renaming.
|
||
|
|
#
|
||
|
|
# Usage:
|
||
|
|
# scripts/iam/forgejo-oauth-source.sh status
|
||
|
|
# scripts/iam/forgejo-oauth-source.sh rename zitadel
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
NS="${FORGEJO_NAMESPACE:-cicd}"
|
||
|
|
SEL="${FORGEJO_SELECTOR:-app.kubernetes.io/name=forgejo}"
|
||
|
|
|
||
|
|
pod() {
|
||
|
|
kubectl -n "$NS" get pods -l "$SEL" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null \
|
||
|
|
|| kubectl -n "$NS" get pods -o name | grep -m1 forgejo-gitea | cut -d/ -f2
|
||
|
|
}
|
||
|
|
|
||
|
|
run() { kubectl -n "$NS" exec "$(pod)" -c gitea -- gitea admin auth "$@"; }
|
||
|
|
|
||
|
|
case "${1:-status}" in
|
||
|
|
status) run list ;;
|
||
|
|
rename)
|
||
|
|
name="${2:?usage: $0 rename <name>}"
|
||
|
|
run update-oauth --id 1 --name "$name"
|
||
|
|
run list
|
||
|
|
;;
|
||
|
|
*) echo "usage: $0 [status|rename <name>]" >&2; exit 2 ;;
|
||
|
|
esac
|