riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

feat(iam): wire all 9 consumer manifests to Zitadel OIDC

Browse Source 
Co-authored-by: rock <[email protected]>
This commit was merged in pull request #71.
This commit is contained in:
rock
2026-10-26 04:34:51 +00:00
committed by rock
parent f9af686c36
commit a02bee50e2
15 changed files with 108 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/iam/zitadel-provision.py
+10 -10
View File
@@ -362,10 +362,14 @@ def phase_apply(_args: argparse.Namespace) -> int:
SECRET_MAP = {
"grafana": [("grafana-oidc-secrets.enc.yaml", "grafana-oidc",
"GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET", "secret")],
"homarr": [("homarr-auth-oidc.enc.yaml", "homarr-oidc",
"client-id", "id"),
("homarr-auth-oidc.enc.yaml", "homarr-oidc",
"client-secret", "secret")],
"minio": [("minio-secrets.enc.yaml", "minio-oidc",
"MINIO_IDENTITY_OPENID_CLIENT_SECRET", "secret")],
"paperless-ai-agent": [("paperless-ai-secrets.enc.yaml", "paperless-ai-config",
"LLM_AUTH_CLIENT_SECRET", "secret")],
"paperless": [("paperless-ai-secrets.enc.yaml", "paperless-ai-config",
"LLM_AUTH_CLIENT_SECRET", "secret")],
}
# Clients whose client_id lives in a plain (unencrypted) manifest. They need the
@@ -375,18 +379,14 @@ CLIENT_ID_MAP = {
"grafana": ("k8s/infra/logging/grafana-values.yaml",
r"(?m)^(\s*client_id:\s*)\S+\s*$", r"\g<1>{value}"),
"minio": ("k8s/infra/minio/minio-tenant.yaml",
r"(?m)^(\s*value:\s*)\"minio\"\s*$", r'\g<1>"{value}"'),
"paperless-ai-agent": ("k8s/apps/paperless/paperless-ai.yaml",
r"client_id=paperless-ai-agent", "client_id={value}"),
r'(?m)^(\s*value:\s*)"(?:minio|\d+)"\s*$', r'\g<1>"{value}"'),
"paperless": ("k8s/apps/paperless/paperless-ai.yaml",
r"client_id=(?:paperless-ai-agent|\d+)", "client_id={value}"),
}
# Secrets that a live workload mounts but no SOPS file in git defines. The phase
# cannot re-point them safely, so it names them.
MANUAL_ONLY = {
"homarr": "Secret homarr-oidc (keys client-id, client-secret) has no SOPS file in git — "
"adopt it first, then add it to SECRET_MAP. The repo also carries an orphan "
"homarr-auth-oidc.enc.yaml that nothing consumes.",
}
MANUAL_ONLY: dict[str, str] = {}
def state_outputs() -> dict: