Compare commits
5
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 pi
|
d4e9dbf350 | ||
|
pi
|
be44a576d4 | ||
|
pi
|
39081222a3 | ||
|
pi
|
7e5b793670 | ||
|
pi
|
354814a531 |
@@ -85,3 +85,7 @@ scripts/iam/*.py
|
||||
# Runtime credential export from the old Authentik provisioning run. Holds live
|
||||
# M2M tokens; never commit it.
|
||||
/authentik-m2m-tokens.env
|
||||
|
||||
# Never commit backup copies of plaintext tfvars (they carry cluster PKI)
|
||||
terraform/*.bak
|
||||
terraform/edge/.secrets/
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"nextId": 2,
|
||||
"loops": [
|
||||
{
|
||||
"id": "1",
|
||||
"prompt": "Check Longhorn and CNPG recovery progress in the homelab cluster and report terse. Run: kubectl -n longhorn-system get volumes.longhorn.io -o json (count by state/robustness), kubectl -n longhorn-system get replicas.longhorn.io -o json (count running/stopped/failed), kubectl get clusters.postgresql.cnpg.io -A (ready instances per cluster), kubectl -n cicd get pods,pvc | grep forgejo-db. Report: volumes healthy vs degraded, replicas running vs stopped, and each CNPG cluster ready count. If every volume is attached/healthy and every CNPG cluster shows 3/3 ready, say RECOVERED, list any leftover anomalies, and stop this loop with LoopDelete. Otherwise name what is still rebuilding and keep going.",
|
||||
"trigger": {
|
||||
"type": "cron",
|
||||
"schedule": "*/5 * * * *"
|
||||
},
|
||||
"status": "expired",
|
||||
"recurring": true,
|
||||
"createdAt": 1792898370946,
|
||||
"updatedAt": 1792901371403,
|
||||
"expiresAt": 1793503170946,
|
||||
"source": "tool",
|
||||
"readOnly": true,
|
||||
"maxFires": 6,
|
||||
"fireCount": 6
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -38,3 +38,8 @@ files:
|
||||
- pi-sandbox-secrets.enc.yaml
|
||||
- etcd-defrag-creds.enc.yaml
|
||||
- zitadel-masterkey.enc.yaml
|
||||
# Login UI RSA keypair, adopted from the chart-generated Secret so ArgoCD
|
||||
# owns it. Without this, the chart re-generates the keypair on every render,
|
||||
# which changes checksum/secret-login-service-key and leaves both Zitadel
|
||||
# Deployments permanently OutOfSync.
|
||||
- zitadel-login-service-key.enc.yaml
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: zitadel-login-service-key
|
||||
namespace: iam
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: ENC[AES256_GCM,data:Ad4omL7pD4QhixW6wSVsVor5FtHbWyOHeYbxOQsEBAaSuvb7JIkvnKqo+Xy6zKuMmRViUIbqhlLQDXCaseAVGgpu3PdtShwJ7LRXJmr0XtQV1M6YtRbRexN6UpFA3XdD+JfifMhtvd29rM3WzLPX69uk4k7voYN5m0pNXSN23jVeIeqm+xB1CpxDW/guZ2hA5+b5XBzVOkMsSOSdWFWH2lK7nInv6ZatCa0/fuIKmB5nZpSV9tHpCTiTnBuNc0rW1X4HOWa8zMiSbjQAqtDitm7lrVHJyImXwBjmuS0wM35VwrwxVUUEjS8kgqnyb02JvNRdNjuwOmIcyKjrdgO1B1ft0CrAbRNkk2dYR8Y7SNhR4F4tYYF5L2szQgj+5tcYrnRGEI2QkXbcmTa0Y9V99+D2bKjt5t59Pi/1r8/jt0CNy0GeeZDvsN5scy0/A4WqtJ2sZDyTnTPwtUpAAwVC2WSqsD11gkzhyRJAgmAmEgfPIL7kTZsZBoSQeuuCJ82Ghqx9kLTpui6kLULxxUpP9oefsKw9PjTwExRbNNcPV5p7PPi9dN00TNe9iYuFqoZFP/lp5SMjDqbsV4Ie1ffcfyZsIHMuOv5Ths7n8ExYdR0zIn+aQePXASt+dE6njhFiblxyBZsn0xON3EIUaE9e3WsdcQKjlPOaAW/DvU6PwBqCeaB2nYzM2NFk6W3lN8BahTE9k7xXrILHIrXuIXezotCK6jclb5yZmdm/fTCX1iejGVDktvvcmX6bbv3YXTRZmsviRhLFHA8oClU0alTsY5Q3nn2Xl0UfXU+rW+10AIpY5WFMzP6A8hXvHx0ISC1S4AIqjmlsDmq2yEZKpbiL+Bs52ymW7t2rQ+KGhWH/bcC3VrJwUWnVYP9b80xyHZdKqubwLc5UcDzCs/Lan23VpLxSJkqb8vZP7SHQ1nc+rlwrqFDkzQ+yMNLZmutqbaAmMyXbrR51Rz3VqofraPXjS+lmLAuEcuTEFbrImsct5Zb57MtKvhHi6CUWt/Vj/NOUJlwy09zPy4JAMMJ81ooyBj6CBHY2f1vfR/UUDN5VZdfg4dUWXS0CQdOb3hx19COr4lR4RcpA46qJEjum+4icm5ckziYT5Nm7NB+ydXJ+Eys2Ba0dGRM6CIeQVhghhCDOZ6uoQ2A6DNql6wjrfUml8UwuJNO0nXVqNS28pLwddsOjlbsysJAUEma6EHXb2Vjb90JZErVswGuhQ2+UdhtpuIkgBYX/MMCZV942C+K41A9478BaCiWuC9KbnAcx81ceR+T3syARctZvQaYaiH7WfF8qyo0VOGzZRYjFbqeyHefiOmPmWTS/XbIti3evyhmxHwjUcidK2njrPB0O/3w6R69UA1p7ph9EgFsj18gPYnJthikgX8vcfVaVnPIAwCqY5DJJmIFTNXVkNDBX+2orrW2qj6PEH+go+uc+aUmu646niqaMAcrUl7gGNGd2OWFHdIRKdtogOvoVpQMDB4eWHPRsL29EVt3rnknHfpq7cIjQXuk9XtlB8zjllYdrh50Q8ZNBOvzWgCiMvAyanfIA+kW9KHQlmb1qJGYp7it2Lrg1K7sDEekrlbuoNsf+2rl8YRQz8pVBuCSzG9DPp4+Rj+ddiqX/Rrs3ufWDKFV9zJoN1EpJ8+z6n8rsQJBe/lSFLW1mLVkaPSNNdIQfdJ6MbsHpMlqqFYP8dOKckxv82uOkHoCLHrgaXiiMd1dBsX1fBiv2NvzDiuLyN81d7R2wNAQbkG9b+/+C6wVr6kDg0n6seseoCyeSI++PJIkCrkTXzd7rLs8Of9CHZQEB15wjemlmYGlJnCiFWPFa6h0jJPatPrfTYv+GpqzWV8u1Uh3aNjd+g1wVQok/ojNOZJahUSI4B67HkJI+I7WOF9C+rRCwNutqshIxYzW7CpyVey5P6Kyv+/cucDEgb0ggH032MBtzTxazpJcE4Y6fTrOiXHp9j2KjzyUt2YeCCL8UMwbwJvW9p1I5gx3ArsOuyHm1kA==,iv:PLsjmrTwjM7IUS7ZBSyVvJfAJzCSUtU+UAvHbSwoaVk=,tag:pUQwbHoZgfHW4CpPKoULAw==,type:str]
|
||||
tls.key: ENC[AES256_GCM,data:rO1NVJZP9TP96C48it4+2lGyRutwqdlX6qiM9R/+0hgYc5ceeeopaCUG/i/LOgltxRQK8qkyed/W3zU2VI6alBpt75XkT3o9ZRy3uxe8mB3ixS7+xQnMc0ci8Mf2bCtGzqwUQj8XPRP4K7Mxw8r4XO5rQLnSmNme0+BxS+XiE6hqifS16UUKfLuFeUtTEoI850sg1GQt0uaHf9kOrpmvsbg3sflO2dQXk8uSFi3B1ghG5DdWImVoc4f5kFK86XG65WVVfYjLaUvm7ZBPT0mwvq3SgPdEXeWq1fp7tMQqCRKuluRZon1e+J5SlWOPUTxwyTq336oK2Nfk3HsiQ3uCG76oCmI5yTe2tCN1f2IXFXBvLNM9QTxc/KFhI4uI6bvHjimOSpXYuRdroH0hc4ohLP44WG0E8Nz7sAb3Ai3PbDTKnqYQemvGEUTdcdbWuMK5/JE4f1IE9DgOOO9RF+s7uXTdzZAmoMcRtVsckQJEJl7AKgqSn7BbK0cjRL/QXclNySQ/qcgSDFiV/pPbGC9JFweJon5F0Qn/AIAnGGzqmVbS6x45UAJieI5oI/30OxjzF+Dov6EGMoE0mys+6l4j8v1EFCtHhhopS7zM4jZRTnNzlZWPtEISU2kopLroGpKESE145VQnB7X66F40KXcOIiXmU1H7Yxw5rJ0SqLAFWQw7gyNdzbnbfCmGASByxnYYwZRy3QDZYrQlthLd5tlGe0cg7j02ZSHmmJNQOx5yOmSQI7z4njDvJlOPncC14T59yDZUIYYLTAYjL8nmCNk2yD55ImVGRIb/f0JGAc2vHMlDN6fkuiSLtbASz11PwWzdln9tS9BTpRx7sfv5+kMhFkzomufftAJbs5XdOxcvGRHkRkdyCn3t8jcRXaNDBpq3o8zWLNh+411I65DMDN1B0c4+7Uw4N17I+KfrVh5Fb8ix0LW9aEL/SUxeIqdEu0ZMTncxGS0QVzZmtJUTdWuT0JjtgfsD65jqpg9l8RdIKX4i0ox2+GeQuXKCQiCaXS47yDxUcICYZB7UDnfwBcXlnGWw1frvkBBqwvwUVa7G7Al1A1a35ob1qb9gpyJZGqmEyV4Qe3PmfUHkp+/bAWarLXnk8P4l2faFjCEnPDIejGMQgDdtkodq7lfqwtHwg02bXNl9X3FbXjyp51/IJshE9dhHLkniWyHwZvHZJ4jjqndf08682gxTnW0bscfv7d6lKznE7rgd/el5ygdlL0PSr0pbxJtcd7MYrACMfZZxRuY3PWZayr1n4iaqh161S8ldeEcLCiHFvDeGHslUK+Sl383AHhs46NHEVgMbhuKJ1thHckQSgpqm9vGE1gBIo0d7z40EulgD+KS4Qm/vdydCgqtzyNmFDg17L+SVCQiyckGxgl/j1YzQKz0o1EWXNssk121m7Nh/e/bYNN8kC6doJPBQBkdhU/+DVZa4+/je+qpqvqnjpheX42k49ubk638QhOkcMmx6ZNnEbL9Ra0mNJHZO27t6++LgN2XkPg6t8VO94yx1c/VFyoF9Qg21O1+BadK3RF9l9s1eUB7n93YwUDhxZpimr8j8oLCn+PvksKwzWEIiAFXUWvuROwh6yC31GghO6veGx7UqXGPM2O8+mkOxXZObbnYAAhteRhXO/k15HL3qf94pudZ6+tETmeej4FKdhZzF9iOsTu/69izQFhl57E+n5hDjRzeVANKQOdq2x7qDG7pGfpJzrDVR95Z1q7Y/d+7FJjBML+YvzGvbxZno+PbPmLGrgxSebAWgO73fUDkBHvosMDjeHjg0NKBXYfR3kImceo4iJwF0bOeFQA09j+6OKW1EId9r1EzYwPGR0DUDt+A9f4DkU/27dbKUmJovBPIAXtYHErwZ7EW0ITd8ebNXyOiArz8JJietDsR++lwetArzrDszsPsiumoSu1/FajtbBfUQqllxJBeoIqNEPHQED2ysSWzqTlHe8tfmY3Vp/PlZh8GbpA/EV5uikWzDSaZbADqXGny/xd+g+8mm4J3DxgPOEEgFqeg+q4C1U4yEy3gYkknT6AcIO8MGOa3daRowEv2zfhVlrNhv2ezLjzsPBQJSK/ph9KZbYiREZVCBQioJJlvfG/dkkycjkVqvTNtn3swhipxUqYc0vKmXFG+R9+fUOP5u9ctqmdIf7Jclew4OBO1ML+sH+l6NojgfX+T+OqQ8EyNMY2Aa7i24ppwS8ySDwyYEk9kjopVZ8L3MSw3CQnWBNMg734qUawCUoFMtGPZ0jC+o6DiV18xpkB1Ffrmjs+72AoKk6wR9zIYyVQG7wr7O4PLWeXEX2NgBDeKaWi0gHInVAb2puJKgGgaZbImuecSaKaqA0y1fXu3+4teozv9eLkBxhYUJRwIBQbA7E3lQ4ocziE3ZMxdAIGAOEJHgDs6UreB4ZMLgdKxqhYzR3GxrmZmspOw/TVBGGjClrefGZh0/gLkXSDZ0uugW1rNM3TkA9t2U0eBCNyRh+8sScUKzja4Ei2ukkfoCNEf0alJkG3udwBtjDBcTRhQJARFD+UWMut5Xqw/dAxs777/VmY00/wD9FaCq0aVc/CJI++oGYgunPDd7ACSTyuY0UST1AEBrCrFBB+T+eKrFcU/4gBXEGiAY4x8lrp7fNZ/nsGFvBvs5sxq9NvLFXGA8Tv3LHU8x8m8oGHVnT0AaFJIKM8vGf2bkdD89EmQkKG9pfnKPCTbyFszqOJlgORDLSn9bNvDYlVC3dS5HQbqdv1a1fn1WrLDEXTNuD1Nj6dJXUBLAZfqzRHaPRi04YNpw9MY+c6f3XmAvNmwrFgdnxHja47ObX4XGigltlCWUSImRboBinCeZ9k9GdQ82Pw36dO433Z3IjtjuFLTWFsUurpAvmgiemzJ3xnhra6pOEr2jy2dw6fUL4gMQtPpSwqB4Qd9TY6MOUpwBqK0MpuRMBisa3zOBphJyvnXOIG9RCYzivzOQM+PKzLmznjTyeql1Ipj/9LwEgQ==,iv:PbRgjgm5ERWlAkkWc7As8eIx8e0rjTUkQ7XlDBrEUlU=,tag:yh2/JuHu5I+dWlxVAmkkXA==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByOGNaakZoV3lhemhMSVVF
|
||||
RklKbEsxeVFMWWdwQ3ZqR0lhRHlPM1dWT3h3Cnk2RnZUNnplVEwvNW9qMExsSUlt
|
||||
VVVXejMrcDRRTEdtT1krdThqWThLWWcKLS0tIEVZZEVBWFZyVi84S1puRHdtMWR1
|
||||
cDBHc1J5aHFpQkxSSEx2VDRjZ1RsdXcKG5MgnUBpFmlNGSkxBijXp7m492ujyqsC
|
||||
TbTfU8SWJwXhio7V+zDbXG+JW4R51wr9F9Sj47DCw7b64nbsD3N5TQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
lastmodified: "2026-10-26T02:15:51Z"
|
||||
mac: ENC[AES256_GCM,data:+2eGERwwzeK5JE9H6qhsu+tskR3Y9c7DecVGopfG8Ggq5SHQBfYyvz//IU+MGCOb6nIyP3JPf9+9IDS2DthVcw+RLtviQkN1TeWuUTDbxBxHdCoUv9zepwU7+d0qUMrdUK0N9QQSRZ4TpiwceViDeMuhPF/vTmADP9QWwid/qwk=,iv:nuJo37Dh8MAf+qI/Ty2jsW0IheNhgmZ4l0Va8pJG6+4=,tag:vCpifXvYF1/QU7XExc6raQ==,type:str]
|
||||
version: 3.13.2
|
||||
@@ -32,6 +32,15 @@ zitadel:
|
||||
TLS:
|
||||
Enabled: false
|
||||
|
||||
# First boot is COMPLETE (2026-10-26): the instance, the system org and the
|
||||
# `iam-admin` machine key all exist. Skip stops the setup hook from running
|
||||
# the first-instance step again. Without it, every sync re-runs the
|
||||
# machinekeyWriter, which silently rotates the iam-admin key Terraform
|
||||
# reads. ZITADEL objects are declared by scripts/iam/zitadel-provision.py.
|
||||
# Never set this back to false.
|
||||
FirstInstance:
|
||||
Skip: true
|
||||
|
||||
# Rendered into a Secret by the chart; read by pods and init jobs alike.
|
||||
masterkeySecretName: zitadel-masterkey
|
||||
|
||||
@@ -98,17 +107,38 @@ postgresql:
|
||||
# CNPG already created the database, the `app` user and its grants, so the init
|
||||
# job runs only the ZITADEL-internal step. Running the full default command
|
||||
# would try to create a database and a superuser it does not own.
|
||||
#
|
||||
# enabled: false after the first successful boot (2026-10-26). The schema is in
|
||||
# place; the init hook has nothing left to do and re-running it on every sync
|
||||
# only adds a PreSync failure surface. Re-enable it for a deliberate schema
|
||||
# upgrade, then set it back to false.
|
||||
initJob:
|
||||
enabled: false
|
||||
command: "zitadel"
|
||||
activeDeadlineSeconds: 600
|
||||
|
||||
# The setup job runs the full first-instance creation: schema migrations, the
|
||||
# system org, the iam-admin machine key, and 13 projection replays. The chart
|
||||
# default killed it at ~5.5 minutes on 2026-10-25 while it was still replaying
|
||||
# projections.projects4, which failed the whole sync. 20 minutes leaves room for
|
||||
# a cold database without masking a genuine hang.
|
||||
# system org, the iam-admin machine key, and 13 projection replays. 20 minutes
|
||||
# leaves room for a cold database without masking a genuine hang.
|
||||
#
|
||||
# DONE, 2026-10-26 — first boot completed. The annotations are moved from
|
||||
# pre-install/pre-upgrade to post-delete because a PreSync setup run is not
|
||||
# harmless after boot:
|
||||
# - it re-runs every repeatable migration on every sync;
|
||||
# - interrupting one (a sync aborted, or a human deleting the Job) leaves a
|
||||
# `system.migration.started` event with no matching `done`, and ZITADEL then
|
||||
# waits forever on `migration already started`. That is exactly how this
|
||||
# instance deadlocked on projections.projects4 and later on
|
||||
# repeatable_delete_stale_org_fields.
|
||||
# A post-delete hook is never executed by ArgoCD sync, so setup runs only on
|
||||
# first install. Re-enable it deliberately (and only with initJob too) for a
|
||||
# schema upgrade, then revert.
|
||||
setupJob:
|
||||
activeDeadlineSeconds: 1200
|
||||
annotations:
|
||||
helm.sh/hook: post-delete
|
||||
helm.sh/hook-delete-policy: hook-succeeded
|
||||
helm.sh/hook-weight: "2"
|
||||
|
||||
# Two API replicas: the read path survives one node drain, and both share the
|
||||
# same masterkey and database. The login UI stays at one replica — a session
|
||||
@@ -142,6 +172,12 @@ ingress:
|
||||
|
||||
login:
|
||||
enabled: true
|
||||
# ksops owns this Secret (k8s/argocd/secrets/zitadel-login-service-key.enc.yaml,
|
||||
# rendered by the sops-secrets Application). Pointing the chart at it stops the
|
||||
# chart from auto-generating an RSA keypair every render, which changed
|
||||
# checksum/secret-login-service-key and kept both Deployments permanently
|
||||
# OutOfSync. The keypair must stay RSA: the login container signs JWTs (RS256).
|
||||
loginServiceKeySecretName: zitadel-login-service-key
|
||||
replicaCount: 1
|
||||
revisionHistoryLimit: 3
|
||||
ingress:
|
||||
|
||||
@@ -6,7 +6,7 @@ One command replaces the manual sequence the Authentik script
|
||||
fixed order and every phase is safe to re-run:
|
||||
|
||||
keys extract the iam-admin machine key and PAT from namespace iam
|
||||
apply terraform apply terraform/zitadel (project, roles, apps, machines)
|
||||
apply create project, roles and OIDC apps through the ZITADEL API
|
||||
secrets write generated client ids/secrets back into the SOPS files
|
||||
users import one human user, converting the Django password hash
|
||||
verify check discovery, client count and the groups-claim gate
|
||||
@@ -43,13 +43,85 @@ from pathlib import Path
|
||||
import yaml
|
||||
|
||||
REPO = Path(__file__).resolve().parents[2]
|
||||
TF_DIR = REPO / "terraform" / "zitadel"
|
||||
SOPS_DIR = REPO / "k8s" / "argocd" / "secrets"
|
||||
SOPS_CONFIG = REPO / ".sops.yaml"
|
||||
CONF_DIR = Path(os.environ.get("ZITADEL_CONF_DIR", Path.home() / ".config" / "zitadel"))
|
||||
STATE_FILE = CONF_DIR / "state.json"
|
||||
NAMESPACE = os.environ.get("ZITADEL_NAMESPACE", "iam")
|
||||
BASE_URL = os.environ.get("ZITADEL_BASE_URL", "https://zitadel.riotpiao.com")
|
||||
|
||||
# ── desired ZITADEL state ──────────────────────────────────────────────────
|
||||
# Declared here, applied through the API by the `apply` phase. This replaces the
|
||||
# retired terraform/zitadel root module: same objects, no state file to drift and
|
||||
# no second writer.
|
||||
PROJECT_NAME = os.environ.get("ZITADEL_PROJECT_NAME", "homelab")
|
||||
PROJECT_GROUP = "homelab"
|
||||
|
||||
# Role keys EQUAL the Authentik group names, so the `groups` claim keeps working
|
||||
# for every consumer that maps on it (kube-apiserver RBAC, MinIO policies,
|
||||
# Grafana roles).
|
||||
ROLES = {
|
||||
"homelab-admins": "Cluster administrators with full access",
|
||||
"minio-admins": "MinIO administrators",
|
||||
"minio-photos": "Photos bucket (Immich) access",
|
||||
"minio-documents": "Documents bucket (Paperless) access",
|
||||
"minio-backups": "Backups bucket read-only access",
|
||||
"poimen-admins": "Poimen memory administrators",
|
||||
"poimen-devs": "Dev and staging projects access",
|
||||
"poimen-prod-readonly": "Production projects read-only access",
|
||||
"paperless-admins": "Paperless administrators",
|
||||
"paperless-finance": "Finance documents",
|
||||
"paperless-legal": "Legal documents",
|
||||
"paperless-hr": "HR documents",
|
||||
"grafana-admins": "Grafana administrators",
|
||||
"grafana-editors": "Grafana dashboard editors",
|
||||
"grafana-viewers": "Grafana dashboard viewers",
|
||||
"sqs-users": "SQS/Temporal queue read access",
|
||||
"sqs-writers": "SQS/Temporal queue read/write access",
|
||||
"s3-users": "S3 read access",
|
||||
"s3-writers": "S3 read/write access",
|
||||
}
|
||||
|
||||
_WEB = {"app_type_id": "OIDC_APP_TYPE_WEB", "auth_method_id": "OIDC_AUTH_METHOD_TYPE_BASIC"}
|
||||
_NATIVE = {"app_type_id": "OIDC_APP_TYPE_NATIVE", "auth_method_id": "OIDC_AUTH_METHOD_TYPE_NONE"}
|
||||
_PKCE = {"app_type_id": "OIDC_APP_TYPE_USER_AGENT", "auth_method_id": "OIDC_AUTH_METHOD_TYPE_NONE"}
|
||||
|
||||
OIDC_APPS = {
|
||||
"api-gw": {**_WEB, "redirect_uris": [
|
||||
"http://localhost:3000/callback", "https://api.riotpiao.com/callback"]},
|
||||
"argocd": {**_WEB, "redirect_uris": [
|
||||
"http://localhost:8080/auth/callback",
|
||||
"https://argocd.riotpiao.com/auth/callback"]},
|
||||
"forgejo": {**_WEB, "redirect_uris": [
|
||||
"http://localhost:3000/user/oauth2/authentik/callback",
|
||||
"https://forgejo.riotpiao.com/user/oauth2/authentik/callback"]},
|
||||
"grafana": {**_WEB, "redirect_uris": [
|
||||
"http://localhost:3000/login/generic_oauth",
|
||||
"https://grafana.riotpiao.com/login/generic_oauth"]},
|
||||
"homarr": {**_WEB, "redirect_uris": [
|
||||
"http://localhost:7575/auth/callback",
|
||||
"https://homarr.riotpiao.com/auth/callback"]},
|
||||
"immich": {**_WEB, "app_type_id": "OIDC_APP_TYPE_NATIVE", "redirect_uris": [
|
||||
"app.immich:///oauth-callback", "https://img.riotpiao.com/auth/login",
|
||||
"https://img.riotpiao.com/user/oauth2/callback"]},
|
||||
"kubernetes": {**_PKCE, "dev_mode": True, "redirect_uris": [
|
||||
"http://localhost:8000", "http://localhost:18000"]},
|
||||
"minio": {**_WEB, "redirect_uris": [
|
||||
"http://localhost:9000/auth/sso/oauth2/code",
|
||||
"https://minio.riotpiao.com/auth/sso/oauth2/code"]},
|
||||
"paperless": {**_WEB, "redirect_uris": [
|
||||
"http://localhost:8000/accounts/oidc/authentik/login/callback/",
|
||||
"https://paperless.riotpiao.com/accounts/oidc/authentik/login/callback/"]},
|
||||
"poimen": {**_WEB, "redirect_uris": [
|
||||
"http://localhost:3000/callback", "https://poimen.riotpiao.com/callback"]},
|
||||
"queue-sqs": {**_WEB, "redirect_uris": [
|
||||
"http://localhost:8080/callback", "https://queue.riotpiao.com/callback"]},
|
||||
"vault": {**_WEB, "redirect_uris": [
|
||||
"http://localhost:8200/ui/vault/auth/oidc/oidc/callback",
|
||||
"https://vault.riotpiao.com/ui/vault/auth/oidc/oidc/callback"]},
|
||||
}
|
||||
|
||||
|
||||
_TEMP_FILES: set[str] = set()
|
||||
|
||||
|
||||
@@ -155,6 +227,13 @@ def curl_json(method: str, url: str, token: str | None = None, body: dict | None
|
||||
cfg = [f'url = "{esc(url)}"', f'request = "{method}"', "silent", "show-error",
|
||||
f"max-time = {timeout}", 'write-out = "\\n%{http_code}"',
|
||||
'header = "Content-Type: application/json"']
|
||||
# Reaching the instance by name needs either public DNS through the tunnel
|
||||
# or a pinned address. ZITADEL picks the instance from the Host header, so a
|
||||
# plain port-forward fails with "Instance not found". Set this to bypass DNS:
|
||||
# ZITADEL_CURL_RESOLVE=zitadel.riotpiao.com:443:192.168.1.160
|
||||
pinned = os.environ.get("ZITADEL_CURL_RESOLVE", "").strip()
|
||||
if pinned:
|
||||
cfg.append(f'resolve = "{esc(pinned)}"')
|
||||
if token:
|
||||
cfg.append(f'header = "Authorization: Bearer {esc(token)}"')
|
||||
if body is not None:
|
||||
@@ -179,27 +258,99 @@ def phase_keys(_args: argparse.Namespace) -> int:
|
||||
|
||||
# ── phase: apply ───────────────────────────────────────────────────────────
|
||||
|
||||
def phase_apply(args: argparse.Namespace) -> int:
|
||||
need("terraform")
|
||||
if not args.org_id:
|
||||
die("apply requires --org-id (ZITADEL console -> Organization settings -> Resource ID)")
|
||||
key = CONF_DIR / "iam-admin.json"
|
||||
if not key.exists():
|
||||
die(f"{key} missing — run the keys phase first")
|
||||
env = dict(os.environ, ZITADEL_JWT_PROFILE_FILE=str(key))
|
||||
def _api(method: str, path: str, token: str, body: dict | None = None,
|
||||
timeout: int = 30) -> tuple[int, dict]:
|
||||
code, payload = curl_json(method, f"{BASE_URL}{path}", token=token, body=body, timeout=timeout)
|
||||
try:
|
||||
return code, (json.loads(payload) if payload.strip() else {})
|
||||
except json.JSONDecodeError:
|
||||
return code, {"_raw": payload}
|
||||
|
||||
for cmd in (["init", "-input=false"], ["fmt", "-check", "-recursive"]):
|
||||
cp = run(["terraform", f"-chdir={TF_DIR}", *cmd], env=env)
|
||||
if cp.returncode != 0:
|
||||
die(f"terraform {' '.join(cmd)} failed: {cp.stderr.strip() or cp.stdout.strip()}")
|
||||
|
||||
cp = run(["terraform", f"-chdir={TF_DIR}", "apply", "-input=false", "-auto-approve",
|
||||
f"-var=org_id={args.org_id}"], env=env)
|
||||
sys.stdout.write(cp.stdout)
|
||||
sys.stderr.write(cp.stderr)
|
||||
if cp.returncode != 0:
|
||||
die("terraform apply failed — no SOPS value was written. Objects created before the "
|
||||
"failure stay in ZITADEL; re-run apply once the cause is fixed")
|
||||
def _ensure_project(token: str, name: str) -> str:
|
||||
code, d = _api("POST", "/management/v1/projects/_search", token, {})
|
||||
for row in d.get("result") or []:
|
||||
if row.get("name") == name:
|
||||
return row["id"]
|
||||
code, d = _api("POST", "/management/v1/projects", token, {"name": name})
|
||||
if code not in (200, 201) or not d.get("id"):
|
||||
die(f"create project {name} failed: {code} {d}")
|
||||
return d["id"]
|
||||
|
||||
|
||||
def _ensure_roles(token: str, project_id: str, roles: dict[str, str]) -> None:
|
||||
code, d = _api("POST", f"/management/v1/projects/{project_id}/roles/_search", token, {})
|
||||
have = {r.get("roleKey") for r in (d.get("result") or [])}
|
||||
for key, display in roles.items():
|
||||
if key in have:
|
||||
continue
|
||||
code, d = _api("POST", f"/management/v1/projects/{project_id}/roles", token,
|
||||
{"roleKey": key, "displayName": display, "group": PROJECT_GROUP})
|
||||
if code not in (200, 201):
|
||||
die(f"create role {key} failed: {code} {d}")
|
||||
|
||||
|
||||
def _ensure_oidc_apps(token: str, project_id: str, apps: dict[str, dict]) -> tuple[dict, dict]:
|
||||
code, d = _api("POST", f"/management/v1/projects/{project_id}/apps/_search", token, {})
|
||||
existing = {a.get("name"): a for a in (d.get("result") or [])}
|
||||
ids: dict[str, str] = {}
|
||||
secrets: dict[str, str] = {}
|
||||
for name, spec in apps.items():
|
||||
row = existing.get(name)
|
||||
if row:
|
||||
ids[name] = (row.get("oidcConfig") or {}).get("clientId", "")
|
||||
app_id = row.get("id")
|
||||
else:
|
||||
body = {
|
||||
"name": name,
|
||||
"redirectUris": spec["redirect_uris"],
|
||||
"responseTypes": ["OIDC_RESPONSE_TYPE_CODE"],
|
||||
"grantTypes": ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE",
|
||||
"OIDC_GRANT_TYPE_REFRESH_TOKEN"],
|
||||
"appType": spec.get("app_type_id", "OIDC_APP_TYPE_WEB"),
|
||||
"authMethodType": spec.get("auth_method_id", "OIDC_AUTH_METHOD_TYPE_BASIC"),
|
||||
"devMode": bool(spec.get("dev_mode")),
|
||||
"accessTokenType": "OIDC_TOKEN_TYPE_BEARER",
|
||||
"version": "OIDC_VERSION_1_0",
|
||||
"idTokenRoleAssertion": True,
|
||||
}
|
||||
code, d = _api("POST", f"/management/v1/projects/{project_id}/apps/oidc", token, body)
|
||||
if code not in (200, 201) or not d.get("appId"):
|
||||
die(f"create app {name} failed: {code} {d}")
|
||||
app_id = d["appId"]
|
||||
ids[name] = d.get("clientId", "")
|
||||
if spec.get("auth_method_id") == "OIDC_AUTH_METHOD_TYPE_NONE":
|
||||
continue
|
||||
code, d = _api("POST",
|
||||
f"/management/v1/projects/{project_id}/apps/{app_id}"
|
||||
"/oidc_config/_generate_client_secret", token, {})
|
||||
if code in (200, 201) and d.get("clientSecret"):
|
||||
secrets[name] = d["clientSecret"]
|
||||
return ids, secrets
|
||||
|
||||
|
||||
def phase_apply(_args: argparse.Namespace) -> int:
|
||||
"""Declare the ZITADEL objects through the API. No Terraform, no state drift."""
|
||||
token = bootstrap_token()
|
||||
if not token:
|
||||
die("no iam-admin PAT — run the keys phase first")
|
||||
|
||||
project_id = _ensure_project(token, PROJECT_NAME)
|
||||
print(f"project : {PROJECT_NAME} ({project_id})")
|
||||
_ensure_roles(token, project_id, ROLES)
|
||||
print(f"roles : {len(ROLES)} ensured")
|
||||
ids, secrets = _ensure_oidc_apps(token, project_id, OIDC_APPS)
|
||||
print(f"oidc apps : {len(ids)} ensured, {len(secrets)} secrets issued")
|
||||
|
||||
state = {
|
||||
"project_id": {"value": project_id},
|
||||
"client_ids": {"value": ids},
|
||||
"client_secrets": {"value": secrets},
|
||||
"machine_keys": {"value": {}},
|
||||
"groups_claim_enabled": {"value": False},
|
||||
}
|
||||
write_private(STATE_FILE, json.dumps(state, indent=2, sort_keys=True).encode())
|
||||
print(f"state -> {STATE_FILE} (0600)")
|
||||
return 0
|
||||
|
||||
|
||||
@@ -238,16 +389,11 @@ MANUAL_ONLY = {
|
||||
}
|
||||
|
||||
|
||||
def terraform_outputs() -> dict:
|
||||
need("terraform")
|
||||
key = CONF_DIR / "iam-admin.json"
|
||||
if not key.exists():
|
||||
die(f"{key} missing — run the keys phase first")
|
||||
env = dict(os.environ, ZITADEL_JWT_PROFILE_FILE=str(key))
|
||||
cp = run(["terraform", f"-chdir={TF_DIR}", "output", "-json"], env=env)
|
||||
if cp.returncode != 0:
|
||||
die(f"terraform output failed: {cp.stderr.strip()}")
|
||||
return json.loads(cp.stdout or "{}")
|
||||
def state_outputs() -> dict:
|
||||
"""Read the object map written by the apply phase."""
|
||||
if not STATE_FILE.exists():
|
||||
die(f"{STATE_FILE} missing — run the apply phase first")
|
||||
return json.loads(STATE_FILE.read_text())
|
||||
|
||||
|
||||
def sops_env() -> dict:
|
||||
@@ -345,13 +491,13 @@ def update_client_id(client: str, value: str, dry_run: bool, apply_config: bool)
|
||||
|
||||
def phase_secrets(args: argparse.Namespace) -> int:
|
||||
need("sops")
|
||||
out = terraform_outputs()
|
||||
out = state_outputs()
|
||||
ids = out.get("client_ids", {}).get("value", {})
|
||||
secrets = out.get("client_secrets", {}).get("value", {})
|
||||
machine_keys = out.get("machine_keys", {}).get("value", {})
|
||||
|
||||
if not ids and not machine_keys:
|
||||
die("terraform has no ZITADEL outputs yet — run the apply phase first")
|
||||
die("no ZITADEL objects recorded yet — run the apply phase first")
|
||||
|
||||
print("[1/3] client secrets into SOPS")
|
||||
for client, entries in SECRET_MAP.items():
|
||||
@@ -438,7 +584,7 @@ def phase_verify(_args: argparse.Namespace) -> int:
|
||||
if code != 200:
|
||||
die("discovery endpoint is not 200 — the instance or the ingress is not ready")
|
||||
|
||||
out = terraform_outputs()
|
||||
out = state_outputs()
|
||||
ids = out.get("client_ids", {}).get("value", {})
|
||||
print(f"client apps : {len(ids)}")
|
||||
enabled = bool(out.get("groups_claim_enabled", {}).get("value"))
|
||||
|
||||
@@ -18,7 +18,7 @@
|
||||
# terraform -chdir=terraform/edge init
|
||||
# terraform -chdir=terraform/edge plan -var china_domain=example.cn ...
|
||||
#
|
||||
# State is local and git-ignored, same as terraform/zitadel. It carries no
|
||||
# State is local and git-ignored. It carries no
|
||||
# credential today, but it will once InstanceData or certificates are added, so
|
||||
# treat it as a secret and move it to MinIO before a second operator applies.
|
||||
terraform {
|
||||
|
||||
@@ -56,8 +56,12 @@ resource "tencentcloud_security_group_rule" "wireguard" {
|
||||
type = "ingress"
|
||||
ip_protocol = "udp"
|
||||
port_range = tostring(var.wireguard_port)
|
||||
cidr_ip = var.relay_admin_cidr
|
||||
policy = "accept"
|
||||
# The homelab dials outbound and has no static public address, so this is
|
||||
# 0.0.0.0/0 by default. WireGuard authenticates every packet by public key,
|
||||
# and an unauthenticated packet is dropped before it reaches the tunnel.
|
||||
# Narrow this to the homelab egress CIDR when that address is stable.
|
||||
cidr_ip = var.wireguard_allowed_cidr
|
||||
policy = "accept"
|
||||
}
|
||||
|
||||
# cloud-init: WireGuard listener, forwarding sysctls, and Caddy for TLS.
|
||||
|
||||
@@ -8,8 +8,15 @@ cloudflare_zone_id = "REPLACE_WITH_ZONE_ID"
|
||||
tunnel_id = "REPLACE_WITH_TUNNEL_UUID"
|
||||
|
||||
# Adopt existing records with `terraform import` before the first apply, or the
|
||||
# create call collides with the hand-made record of the same name.
|
||||
cloudflare_tunnel_hostnames = ["paperless", "img", "poimen"]
|
||||
# create call collides with the hand-made record of the same name:
|
||||
# terraform import 'cloudflare_dns_record.tunnel["zitadel"]' \
|
||||
# <zone_id>/<record_id>
|
||||
#
|
||||
# A tunnel CNAME is only half of the path. The tunnel's Public Hostname list
|
||||
# (Zero Trust -> Networks -> Tunnels -> Public Hostname) must also map the name
|
||||
# to https://<name>.riotpiao.com, or Cloudflare answers 404 from the tunnel even
|
||||
# though DNS resolves.
|
||||
cloudflare_tunnel_hostnames = ["paperless", "img", "poimen", "zitadel"]
|
||||
|
||||
# Leave false until the tunnel config import is understood. True makes
|
||||
# Terraform replace the entire ingress list with tunnel_ingress.
|
||||
|
||||
@@ -134,6 +134,12 @@ variable "wireguard_port" {
|
||||
default = 51820
|
||||
}
|
||||
|
||||
variable "wireguard_allowed_cidr" {
|
||||
description = "CIDR allowed to reach the WireGuard UDP port. The homelab dials outbound, so this is often 0.0.0.0/0; WireGuard authenticates by key. Restrict it to the homelab egress CIDR when that address is static."
|
||||
type = string
|
||||
default = "0.0.0.0/0"
|
||||
}
|
||||
|
||||
variable "wireguard_relay_private_key" {
|
||||
description = "WireGuard private key of the relay side. Generate with `wg genkey`; pass via TF_VAR_wireguard_relay_private_key."
|
||||
type = string
|
||||
|
||||
@@ -1,97 +0,0 @@
|
||||
# RECOVERED from live cluster state via talosctl get machineconfig.
|
||||
# Regenerated after the original tfvars.local was lost/corrupted.
|
||||
|
||||
cluster_id = "Rtc4g2av9EP0mOdxA4M0-QQitzHLWICz-rLBNfrOjgw="
|
||||
cluster_secret = "8E0CAeylAPKmmUEQmIGmHQAhQf+8c7NUf43CdrQZ+vg="
|
||||
bootstrap_token = "b2q7lh.9w7hwgrulrd65gr3"
|
||||
machine_token = "hq9wlf.96l9z46efd79jtr2"
|
||||
machine_ca_crt = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBMkUwRWZqbG41L1J3eTVjMVJmNkNSakFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qWXdOekE1TURVd056VTRXaGNOTXpZd056QTJNRFV3TnpVNFdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQUNwR3NQZkVHdEU4anVmNG9JTkNHNnlCQmN6aURFaEpLbDV3CnJib0hSR0tUbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkdmaExZUUdaOGYzd3lZZAo0SFI3KzlONnZKQXJNQVVHQXl0bGNBTkJBQ1ZQVlAwcGYxMkdUakYvSHJMZmcwZHBLemdBMlE1OGR5Y0paY0ZvClQvNDdPQk8ra29VZm11dXNjVVNNQnBXS0VuWHNYMFNocmNab3hQd1FHM3diblFFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
|
||||
machine_ca_key = "LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSlR4MXRqZEVOTTg1cGNRRFR0WWRtMFd0QXNBd0tzL1VESlZLN0ZqYU5uUgotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K"
|
||||
kubernetes_ca_crt = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpVENDQVRDZ0F3SUJBZ0lSQUtwT1ZaK29CRzljNHFycEpwaUc4TkV3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakEzTURrd05UQTNOVGhhRncwek5qQTNNRFl3TlRBMwpOVGhhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVQ1VjJvNkliMUpRZkcza3lCTTBCeTRkd2FLbnlGY2tVdjNVem9yOG1Ba3RaN2JrT2ZKZDlmL2VmcVkKYXBzUFpLV1RHQnYxM3JZbFdvOGtuU3ZnNm83Um8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGQ1dPZVJUVHdnN2tnNVNWMG9raFQwY0VDNGwzTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDSURURCtNYXUKb2JXdkp6UkNMVEdJaHJHc1daalFnalVmRWl2MnhCTXB6RnNVQWlCQzNNWkYwMjVqVHk4Uno2YjI5czVJQmpkNgpZQTVWd0kvNVFieXlwSGFXQlE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
|
||||
kubernetes_ca_key = "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUUrSEdPcUJJYXpJMzdqNmJJUlA1emVxeXEwZzhBU2xZeGplZUlJcEpIcXBvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK1ZkcU9pRzlTVUh4dDVNZ1ROQWN1SGNHaXA4aFhKRkw5MU02Sy9KZ0pMV2UyNURueVhmWAovM242bUdxYkQyU2xreGdiOWQ2MkpWcVBKSjByNE9xTzBRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo="
|
||||
etcd_ca_crt = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNTZ0F3SUJBZ0lSQVAyaHkwdUhvTm5vSzQyZE9LTk1nU2t3Q2dZSUtvWkl6ajBFQXdJd0R6RU4KTUFzR0ExVUVDaE1FWlhSalpEQWVGdzB5TmpBM01Ea3dOVEEzTlRoYUZ3MHpOakEzTURZd05UQTNOVGhhTUE4eApEVEFMQmdOVkJBb1RCR1YwWTJRd1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFRVGlKYUJpSEJPCmJha3JuL0dVdkUxVFd5czRVUkVzVGtVNEM4OG1EdWZYQURjV0NnN2RTRzc0QjkzOGFwSWgybGc4UDhKRDFFRUoKN0RkU1lQVG5zYWh1bzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSApBd0VHQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkliYTBLaEhmM3hhClBQNk1hb3dESUNWVXBLdDVNQW9HQ0NxR1NNNDlCQU1DQTBjQU1FUUNJRzZMYUJGeGgvcys2WXpGdVlwaUxUWlYKS2prOGh5UVNvMmVTZTJTUy81MG5BaUI0a0RNWnR4b1UzTitHc3BEOHVEbXFrNlhxbzZoeE0vbG0yU21OMzlPNAovdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
|
||||
etcd_ca_key = "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUUwZ3JiMk0yblA4c1hxWjVhd3NzNThwbUdvb1FlSWg3a3RoWVlxNzhZZThvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFRTRpV2dZaHdUbTJwSzUveGxMeE5VMXNyT0ZFUkxFNUZPQXZQSmc3bjF3QTNGZ29PM1VodQorQWZkL0dxU0lkcFlQRC9DUTlSQkNldzNVbUQwNTdHb2JnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo="
|
||||
aggregator_ca_crt = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZVENDQVFhZ0F3SUJBZ0lSQUpxeFI3alBzcmhzRUp2cmtEWndYR3N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5qQTNNRGt3TlRBM05UaGFGdzB6TmpBM01EWXdOVEEzTlRoYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVFBWWlieHY1ZDVFRGdTbWhlRHlhYjJLZGh4ZFZnZ3lQc2pNcjBET0JMVmxtQmpMcXFqClpNSkk2d1ZmV2hkUjBRVGxVdEFLZDJvREJZLy9TeDBzQi9qY28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGSTkrWm1EYVBybDhrTnhXUUxOT3ErTmVzeEh0TUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCklRRC9DRUZ2SUVHMW9qcmRZRVUzUldmTklLV1FwVXlZQWJ1ZGE0T0ZWQS9yOUFJaEFPS1VOZFF6bUk2WVZOdzgKeklDejlLblRxazQrT3dvV3RjNVl5SmlKR29zUgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
|
||||
aggregator_ca_key = "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUFoOEwycXFLbUxoYkpmczJ2M3ZRWXBFZHF6Ri9hTGZhSmoraEZRazdPY2NvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFQUdJbThiK1hlUkE0RXBvWGc4bW05aW5ZY1hWWUlNajdJeks5QXpnUzFaWmdZeTZxbzJUQwpTT3NGWDFvWFVkRUU1VkxRQ25kcUF3V1AvMHNkTEFmNDNBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo="
|
||||
service_account_key = "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKSndJQkFBS0NBZ0VBd3NNZU40eE1YQkZ0VVE2dVZ2NEZFU1dNT2ZLc1RKdmxHa0ptVG1URjJIazg1SlJvCkhuQU1nMEkvMEJiMGFUQTJ3MjlkSEUrdUN6dFd5eVVqTzV5eWdJSDQ0Q2RtVnNHVzVua1Z0TmFGNzNpcFllbjYKaG11bmRoWDY1VndqOHpVUmFYZUxtUEc0Y2d4dk5SOXdGYUZXS0ZZdzQzdGtlWjg5S0F5QTNibjFXN3JHTloyOQovcXRYWEcrQnFSSlVuUzhXQmt4dkErUktyRE1OVHF4bjVGOEl1VkpTWkw5bDVEd3lSUnNqMjVMZVdRZUFYenl6CllWcmFKZmVubSt6L3hLZjhLdHFZMSs5U1pwbkZsS2N6TGlWVzg4WkJ5TnR0KytYZjB4N3FSL2lQOHhRQXV0ckIKV1pTbytoa01FRjV5YU0wQWdxcG5mbDBsUmhsM0I0UUx3NHkyTUpoTEpyQ1ltQjl1QllLWU5oRE5NOXk0Z1lrZgpacmdEdm9NdGpsSUJUUHRyVjMyemxYN05Od3d5UjdXOXp5ZlBSVjEvbjhpMk9KR0szeittdGNCR2Y0TS8veDFsClJRNEhzWWhDUVJRaE8vQWp2U2QvQlhFRnB3dEhsb1VYRU5nQ2lPSW00MnFrZTNWb3lLbjJ2Q3g2QlhodlJVZDAKUHgvK0JpM0d4RmRoa2Uxa0doelJLQTdySGhEMVBkVGsyM04wUXV3WHNNVDZRWXVrRDdPZG5KdFZtZVN4TkxqcwptdVpybmpwRzZsaHRDSmdvMGdVeXBYQ2RlWGVnZ0dIc0JCMks4NjIrdThVa0dwMk9IQUhGeldsdDF5L2VXTW9PCmhneWx1SEVLcjkzUU5uNDZsTGtZTDViWjlVTUZ0NXBMRFVrSFQxNkV5dTh0V21ET2ZoQ3Z3M1lmRWY4Q0F3RUEKQVFLQ0FnQUdSbUlSV1JoV3VRc0VHd3g3NmdoQXdxeHZhNFdvbkRjMzd0Njc5Tnc0K3NMKy9GY1ViL2kvTytHeApjeVBoeGJkbCtZOE82L1JJRVZ2ZEJLL0xhbU9INTJnYzFMZ2o0RzNidEJnQ2NRejBwN2NSWEFnQno3TWdCMXBECmpJSHVBbzR5anpMMHRRa0R4Nm5IbE9FNEdUQWM4WlgycGxHWTU0d0JYOUhCRXc0NEs5N1orR0NZTlc0Rm9PUVYKRGUyaStOTGxWZzRYbW9IYlpYT3V6cmcwTCttb2l1SHp0QVQwNHdtZGwxL0M0Y3IvSkZJNi8wb3FQMUthK1kweApaV1BpTXFWWnZoeEJqTWpqWEYzMHlhUkkvdFA3MjYzZjZrM3pXVGNxWnFzV3NZZjF4WFcyajNpK1NaOWVHM043CmpZZHpIL085d2Y2K29BS2s3UW9jT0dGbXBnQnlwdm9JbytlSFdjZlpZNFNXNloyeTRacUl0M2xTSWFHMEtmQjEKUnVrSVBtMlYzNDNlc3Azdy9TV2liRVU2elhvd01sWjlZc0dPalY1MTZDQmJZK0lQcmY2RXY0UFhDWjlnUERxcgpnUFFIZ0lFS294aUdYK2dENG9pYWdUMWVVSk1iYWZkaEkzSHJMWk9YbUpBZU40RHpOZXR1SGRsTk13YnpZZHN5CnpyMllSMkhqNTZydk9hcWZZUFJKV1NmS3ozRlhQdDNDMHJRVmNRekVqV1ZZbm9MZG9yR3FkaU1uMyt1NzF2RW4KSnluZksvN3VRSDY5VTU3NGNKK3FjOFNtNTlPeHBnN1RoODljMUZTeSszTk03bTE2czlJcjQvcG94Q2pWaHNWeQpKRmN2cHE4UTMwek9CQk0waUxyblNKcVRXaXJDRU8xNHlRY0VLbFBVd2VGUWdJK05pUUtDQVFFQTMwMWNrTnZuCmpaRHduRXFQaWp4SlBDSUNEeHcxYWtnVTZUNUpMVkt5SUFnK3BYNHlPZDZtendvV2hpWE5oVUQ5eWxPL21lTEsKSDRPUXVzeWdJUDdkOVNKZi9ZVTV5a1RZaVZLMUdzM1loZXovRmhRQXdBQUg4UmdBdW8rZU9UTUcyT0IxM2loLworQlFYL1lrOG9VR1M0YlpsZWNGWG5pSTZ5S0g1MUJUQ3g0ZTZZcStvdGMrMFc2RzBRVHVBT3JWcjdXWklGY1htClVDdElReXRJN2s2UVd6SXU0K3dnVnU3OUdrUEJTMHNBaXhzU0ppYXRTNzk1TjlhYjYwRzNDeVFWZDZWajJaVmEKWGpCR1oyQXREalpEWS9MMDlZQTlRVUxDbWVqT2hYVFlGNkJuNnRkYmVjeVlZTHdNS2MzWEhqNEt2U2ZaQ01HTwpvUXROdnFoUFFlSWpxUUtDQVFFQTMwZnFCSThDK2QwdXJlM1JhNFFRdUlzUC9xVTMyejIzMUdzbTZOOXlQd0hUClM4ZzlrS0ZDYzhMVGlmWFdnajhIRWxTVjVLSXJseERwZEVWQ1pEM05qdy9GVDdHcHV5SVplN1E3VlhiNld3MnYKY1I0M1FkdUQvOEc4ZkdlZGkrZ1BnKzlzeURCQXFIVzFGSHl1RmVaWGNsVTF1cndOV3V3TlFKUnZHczFoK1NuQQpXVmJxd1ZUL01GMmYxTjlBaFN0alhkM0Nscm1rb0o4ek05YW0zVWg5VUprQ2xSZi9mZVRONXZndE1odS9NNGtGCmVQYUlBMTVqT3h1cEFMN3ptVVVxZ0h1NE9yMm5mYTVNNHMzWTR6TVRYYm9VZGNVT09oRTRzU0J2bGlaak5KL3QKV2pSTmJmUWhxbWRBTTNZZjFGUC8vRW9CYTBPejBxMHNXci92cEhDUlp3S0NBUUFxMlkySnZxa1FZVi9LbmdRdApZcVFyQmR1ZlNxcDFXcCtvb21zb1oxWUhENDMxOCtGdmVXcEpFSWFCOTM4WXN3QUFjMUd4RmZQeldDdk5yTGFOCm5scTVUMzljQnRTd0c4WHhsQTFzdDFOMVg2VVRkNE10Vk5ReFQ0blVRdnI1dnZEeGJTRXhJRlJ1Sm16MEdnR28KY0F6ZmcwQzF2SVF6dEIzVG9rRnVrUTFQZkp3bms4MnNGYzltUmdGeEF4bjRLaGdyMWhTL0dOcTVSNVQyVHJnUQpBc053dkpDQzdDeklnZFBQMW5DaElpTllqamxOV042b1NuWFlZVFpLVHJIeFVWdE5PaytPMFRvbUdOMXB1T3JzCmJ6MC9VTC93M0VyazJ3cTh2Zy9qVENpclgveVE5QUo1dk9rQXB4VXVjSEYzUERDVFc3SXFHL3Bpck9pZVRXM28KRnAwQkFvSUJBRjBxa3JsSU8wT3JTUmtHRE1aQ0d3QUY5cXlZb0EvNVZzVnAySmgrOUJyYVZpSmU4V0Z5Q0ZwcApSdjlmOXh2dDFMT1BXK1JFenMrQUhRbUpCTVR6RE56UEJkUFZIQytiY09xdkw3cmZwR050K0hESTNPRzhDUDRsCkJ0TWFJU0VKdWIraG5kQ0NZZGhwRlIveFRtcVE3SmdtZWY3ckROK05jNUlvM1p0ZmE2d2VBY2JGZjdzZ0RrTk8KTGEwVFlzYXViZzN5eElsRCtTK1VmamI1TUROUlZnalZiOEJxZlE4NDg3bVdnTFZSNHB4TVpsNHM4R0FIZUh4bgpkRU45YWdQZ1duVzJLZzlJcDZUSG9BbGJQMDYrTnl4NndxTEprTUFtQTNQVlJ2cHVGaU1WUUdMTlJDbkhIbTBPCkhEbmM1amNndmNXMTA1WEFjRDVPU0IydHpQN2VnYTBDZ2dFQUZhTHJxMDJ6M2tXaW1iVzdoNi9Pby9YRHdjZ2YKSmdXMDYyYWdWUlpEMjM3Mm4valZSL25kMnFybmwxTFdWaXpzWW91b3hvY2N6NUwvQ2h3MktCOC9Rc1Zxai9KOApOUWh1ZDJ2ZUxjQlUvVzNseVhENnJpajJZMythNzRvM1A4b1psOGdDQmJEck1jajNsMHRZMXRWbm9nOWo0eHQ3Ckp3UXA3djNXb3ArSFVuRWVjbGpscTdlN1VuTGNwZlRDOE5PUmdxbjBGSUtCbXdFNlpJQnQxUzB6NmxSKytJdVMKQk1oTTZTSkZmeUFOVVdjTCt2cHJoRzBjWUZmcUYzajlPZ1dXRnBGTHFWQmdSTlZBVDRoM0U1Ymh4L0lsMTVHMAo2USs2aWlkRElqMEhNNFAzcjhja2lRUlVPdFI1R2NVS1RYZGh1TjkwMjZGRTdEckRvSURVZ0F5dGVnPT0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K"
|
||||
secretbox_encryption_secret = "RLkR4RmeaLmH/abyK3eYf6q22umJ/byLhheVCnh/yrA="
|
||||
|
||||
controlplane_configs = {
|
||||
"talos-cp-1" = {
|
||||
hostname = "talos-cp-1"
|
||||
lan_ip = "192.168.1.166"
|
||||
public_ip = "https://k8s-api.riotpiao.com"
|
||||
lan_subnet = "192.168.1.0/24"
|
||||
lan_gateway = "192.168.1.254"
|
||||
install_disk = "/dev/nvme0n1"
|
||||
longhorn_disks = []
|
||||
zone = "az-a"
|
||||
allow_scheduling = true
|
||||
cloudflare_talos_sans = []
|
||||
cloudflare_apiserver_sans = []
|
||||
},
|
||||
"talos-cp-2" = {
|
||||
hostname = "talos-cp-2"
|
||||
lan_ip = "192.168.1.214"
|
||||
public_ip = "https://k8s-api.riotpiao.com"
|
||||
lan_subnet = "192.168.1.0/24"
|
||||
lan_gateway = "192.168.1.254"
|
||||
install_disk = "/dev/disk/by-id/wwn-0x644a842029bd3f002720989b07d7143d"
|
||||
longhorn_disks = [
|
||||
{ device = "/dev/disk/by-id/wwn-0x644a842029bd3f0031b60f4375d97062", mountpoint = "/var/lib/longhorn-disk1" },
|
||||
{ device = "/dev/disk/by-id/wwn-0x644a842029bd3f0031b5ffeb8bb8b47f", mountpoint = "/var/lib/longhorn-disk2" },
|
||||
{ device = "/dev/disk/by-id/wwn-0x644a842029bd3f0031b6000c8dabb266", mountpoint = "/var/lib/longhorn-disk3" },
|
||||
# /var/lib/longhorn-disk4 (wwn-0x6b083fe0c5782700321370dc23fd765b) was
|
||||
# retired 2026-10-12: the 2TB PERC virtual disk failed with continuous
|
||||
# SCSI I/O errors, hung its XFS filesystem, and wedged Longhorn replica
|
||||
# rebuilds on talos-cp-2 with unkillable D-state processes. Do not
|
||||
# re-add it.
|
||||
]
|
||||
zone = "az-b"
|
||||
allow_scheduling = true
|
||||
cloudflare_talos_sans = []
|
||||
cloudflare_apiserver_sans = []
|
||||
},
|
||||
"talos-cp-3" = {
|
||||
hostname = "talos-cp-3"
|
||||
lan_ip = "192.168.1.162"
|
||||
public_ip = "https://k8s-api.riotpiao.com"
|
||||
lan_subnet = "192.168.1.0/24"
|
||||
lan_gateway = "192.168.1.254"
|
||||
install_disk = "/dev/nvme0n1"
|
||||
longhorn_disks = [
|
||||
{ device = "/dev/disk/by-id/usb-Seagate_One_Touch_w_PW_00000000NABV3H34-0:0", mountpoint = "/var/lib/longhorn-paperless-media" },
|
||||
]
|
||||
zone = "az-c"
|
||||
allow_scheduling = true
|
||||
cloudflare_talos_sans = []
|
||||
cloudflare_apiserver_sans = []
|
||||
},
|
||||
}
|
||||
|
||||
worker_configs = {
|
||||
"worker-1" = {
|
||||
hostname = "worker-1"
|
||||
lan_ip = "192.168.1.223"
|
||||
lan_subnet = "192.168.1.0/24"
|
||||
lan_gateway = "192.168.1.254"
|
||||
install_disk = "/dev/nvme0n1"
|
||||
network_interface = "enp28s0f0np0"
|
||||
zone = "az-a"
|
||||
gpu_count = 4
|
||||
node_labels = {}
|
||||
node_taints = []
|
||||
factory_image = "factory.talos.dev/metal-installer/0a2153a6dc099a371bf2f63d6c3c22d275c876bf6302dd154c5813072924cb3f:v1.13.3"
|
||||
swap_size = "64GiB"
|
||||
ephemeral_max_size = "700GiB"
|
||||
extra_disks = []
|
||||
}
|
||||
}
|
||||
|
||||
cluster_config = {
|
||||
controlplane_ip = "192.168.1.166"
|
||||
pod_subnets = ["10.244.0.0/16"]
|
||||
service_subnets = ["10.96.0.0/12"]
|
||||
dns_servers = ["8.8.8.8", "1.1.1.1"]
|
||||
dns_domain = "cluster.local"
|
||||
}
|
||||
@@ -1,58 +0,0 @@
|
||||
# The groups claim — the single load-bearing decision of the migration.
|
||||
#
|
||||
# ZITADEL does not issue a `groups` claim. Authentik did, and these consumers
|
||||
# read it: kube-apiserver RBAC (`--oidc-groups-claim=groups` plus 11 RoleBindings
|
||||
# on oidc:<group>), MinIO (`MINIO_IDENTITY_OPENID_CLAIM_NAME=groups`), Grafana
|
||||
# role mapping, and every service that filters on a group name.
|
||||
#
|
||||
# Plan §1.3 Option A keeps those consumers unchanged by synthesizing the claim.
|
||||
# Option B refactors all of them. This module takes responsibility only for the
|
||||
# ZITADEL side of Option A: the action resource and its trigger.
|
||||
#
|
||||
# The script body is NOT shipped by default. The go/no-go gate (§1.3, §1.5 task
|
||||
# 1.3) is: prove on the live instance that the action runtime can read project
|
||||
# roles plus user metadata and write both `groups` and the per-agent claims,
|
||||
# for a human token AND a machine-user token. Until that proof exists, enabling
|
||||
# this resource would move every consumer onto an unverified claim source:
|
||||
#
|
||||
# terraform apply -var enable_groups_claim_action=true \
|
||||
# -var groups_claim_script=./groups-claim.js
|
||||
#
|
||||
# After it applies, verify with a real token exchange before moving a consumer:
|
||||
#
|
||||
# curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
|
||||
# -d grant_type=refresh_token -d refresh_token=<t> \
|
||||
# -d client_id=kubernetes | jq -R 'split(".")[1] | @base64d | fromjson'
|
||||
#
|
||||
# The decoded access token must contain `"groups":["homelab-admins", ...]`.
|
||||
|
||||
resource "zitadel_action" "groups_claim" {
|
||||
count = var.enable_groups_claim_action ? 1 : 0
|
||||
|
||||
org_id = data.zitadel_org.default.id
|
||||
name = "homelab-groups-claim"
|
||||
script = file(var.groups_claim_script)
|
||||
timeout = "5s"
|
||||
allowed_to_fail = false
|
||||
}
|
||||
|
||||
# Both triggers are needed. The access-token trigger fills the JWT that
|
||||
# Kubernetes and MinIO read. The userinfo trigger fills the response that
|
||||
# Grafana, paperless and Forgejo read.
|
||||
resource "zitadel_trigger_actions" "groups_claim_access_token" {
|
||||
count = var.enable_groups_claim_action ? 1 : 0
|
||||
|
||||
org_id = data.zitadel_org.default.id
|
||||
flow_type = "FLOW_TYPE_CUSTOMISE_TOKEN"
|
||||
trigger_type = "TRIGGER_TYPE_PRE_ACCESS_TOKEN_CREATION"
|
||||
action_ids = [zitadel_action.groups_claim[0].id]
|
||||
}
|
||||
|
||||
resource "zitadel_trigger_actions" "groups_claim_userinfo" {
|
||||
count = var.enable_groups_claim_action ? 1 : 0
|
||||
|
||||
org_id = data.zitadel_org.default.id
|
||||
flow_type = "FLOW_TYPE_CUSTOMISE_TOKEN"
|
||||
trigger_type = "TRIGGER_TYPE_PRE_USERINFO_CREATION"
|
||||
action_ids = [zitadel_action.groups_claim[0].id]
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
# API applications — the machine-token surface.
|
||||
#
|
||||
# ZITADEL keeps two different objects apart: an OIDC application is for a
|
||||
# browser flow, and an API application is what a client_credentials / JWT-profile
|
||||
# caller presents. Authentik modelled both with one provider, so the plan §1.1
|
||||
# row 1 ("OIDC app + machine user") needs one of each here.
|
||||
#
|
||||
# The gateway signs its token request with the machine key from machines.tf, so
|
||||
# the auth method is PRIVATE_KEY_JWT. No secret is stored for it.
|
||||
|
||||
resource "zitadel_application_api" "machine" {
|
||||
for_each = { for name, spec in local.machine_users : name => spec if contains(keys(var.api_app_consumers), name) }
|
||||
|
||||
org_id = data.zitadel_org.default.id
|
||||
project_id = zitadel_project_v2.homelab.id
|
||||
name = "${each.key}-machine"
|
||||
auth_method_type = "API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT"
|
||||
}
|
||||
@@ -1,136 +0,0 @@
|
||||
# OIDC applications — one per consumer that logs a browser in.
|
||||
#
|
||||
# Client IDs: the plan §3.2 wants every client_id byte-identical after the move,
|
||||
# so that a consumer change is only the issuer URL plus the secret.
|
||||
#
|
||||
# THAT GOAL IS NOT ACHIEVABLE HERE, verified twice on 2026-10-24:
|
||||
# - ZITADEL v4.19.2 CreateOIDCApplicationRequest has no client_id field, and
|
||||
# CreateOIDCApplicationResponse documents the value as "generated"
|
||||
# (proto/zitadel/app/v2beta/app_service.proto:540-650).
|
||||
# - zitadel provider 3.8.7 exposes no settable application id: `id` on
|
||||
# `zitadel_application_v2` is not a valid argument (terraform validate
|
||||
# rejects it), and `client_id` on `zitadel_application_oidc` is computed.
|
||||
# Consequence: every consumer takes a NEW client_id as well as a new secret.
|
||||
# Budget the extra config change per consumer — this is not the one-line
|
||||
# re-point the plan assumed.
|
||||
#
|
||||
# The only way to keep the old value is to create each app through the v2 REST
|
||||
# API with an explicit body id, then import it:
|
||||
# POST /v2/projects/<project_id>/apps
|
||||
# {"id":"<old-client-id>","name":"<old-client-id>","oidcRequest":{...}}
|
||||
# Not implemented here: it would put app creation outside Terraform state.
|
||||
#
|
||||
# Secrets are generated by ZITADEL, never written here. `terraform output -json
|
||||
# client_ids` and `client_secrets` feed the SOPS re-point (§3.2, §6.9). Do not
|
||||
# commit the tfstate: it carries those values.
|
||||
|
||||
locals {
|
||||
oidc_clients = {
|
||||
# Gateway. Browser sessions for the console, plus a machine path
|
||||
# (machines.tf) for callers that need client_credentials.
|
||||
"api-gw" = {
|
||||
redirect_uris = ["http://localhost:3000/callback", "https://api.riotpiao.com/callback"]
|
||||
app_type = "WEB"
|
||||
auth_method = "BASIC"
|
||||
dev_mode = false
|
||||
}
|
||||
"argocd" = {
|
||||
redirect_uris = ["http://localhost:8080/auth/callback", "https://argocd.riotpiao.com/auth/callback"]
|
||||
app_type = "WEB"
|
||||
auth_method = "BASIC"
|
||||
dev_mode = false
|
||||
}
|
||||
"forgejo" = {
|
||||
redirect_uris = ["http://localhost:3000/user/oauth2/authentik/callback", "https://forgejo.riotpiao.com/user/oauth2/authentik/callback"]
|
||||
app_type = "WEB"
|
||||
auth_method = "BASIC"
|
||||
dev_mode = false
|
||||
}
|
||||
"grafana" = {
|
||||
redirect_uris = ["http://localhost:3000/login/generic_oauth", "https://grafana.riotpiao.com/login/generic_oauth"]
|
||||
app_type = "WEB"
|
||||
auth_method = "BASIC"
|
||||
dev_mode = false
|
||||
}
|
||||
"homarr" = {
|
||||
redirect_uris = ["http://localhost:7575/auth/callback", "https://homarr.riotpiao.com/auth/callback"]
|
||||
app_type = "WEB"
|
||||
auth_method = "BASIC"
|
||||
dev_mode = false
|
||||
}
|
||||
"immich" = {
|
||||
redirect_uris = ["app.immich:///oauth-callback", "https://img.riotpiao.com/auth/login", "https://img.riotpiao.com/user/oauth2/callback"]
|
||||
app_type = "NATIVE"
|
||||
auth_method = "BASIC"
|
||||
dev_mode = false
|
||||
}
|
||||
"kubernetes" = {
|
||||
redirect_uris = ["http://localhost:8000", "http://localhost:18000"]
|
||||
app_type = "WEB"
|
||||
auth_method = "NONE"
|
||||
dev_mode = true
|
||||
}
|
||||
"minio" = {
|
||||
redirect_uris = ["http://localhost:9000/auth/sso/oauth2/code", "https://minio.riotpiao.com/auth/sso/oauth2/code"]
|
||||
app_type = "WEB"
|
||||
auth_method = "BASIC"
|
||||
dev_mode = false
|
||||
}
|
||||
"paperless" = {
|
||||
redirect_uris = ["http://localhost:8000/accounts/oidc/authentik/login/callback/", "https://paperless.riotpiao.com/accounts/oidc/authentik/login/callback/"]
|
||||
app_type = "WEB"
|
||||
auth_method = "BASIC"
|
||||
dev_mode = false
|
||||
}
|
||||
"poimen" = {
|
||||
redirect_uris = ["http://localhost:3000/callback", "https://poimen.riotpiao.com/callback"]
|
||||
app_type = "WEB"
|
||||
auth_method = "BASIC"
|
||||
dev_mode = false
|
||||
}
|
||||
"queue-sqs" = {
|
||||
redirect_uris = ["http://localhost:8080/callback", "https://queue.riotpiao.com/callback"]
|
||||
app_type = "WEB"
|
||||
auth_method = "BASIC"
|
||||
dev_mode = false
|
||||
}
|
||||
"vault" = {
|
||||
redirect_uris = ["http://localhost:8200/ui/vault/auth/oidc/oidc/callback", "https://vault.riotpiao.com/ui/vault/auth/oidc/oidc/callback"]
|
||||
app_type = "WEB"
|
||||
auth_method = "BASIC"
|
||||
dev_mode = false
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "zitadel_application_v2" "oidc" {
|
||||
for_each = local.oidc_clients
|
||||
|
||||
org_id = data.zitadel_org.default.id
|
||||
project_id = zitadel_project_v2.homelab.id
|
||||
name = each.key
|
||||
|
||||
oidc {
|
||||
redirect_uris = each.value.redirect_uris
|
||||
response_types = ["OIDC_RESPONSE_TYPE_CODE"]
|
||||
grant_types = [
|
||||
"OIDC_GRANT_TYPE_AUTHORIZATION_CODE",
|
||||
"OIDC_GRANT_TYPE_REFRESH_TOKEN",
|
||||
]
|
||||
app_type = "OIDC_APP_TYPE_${each.value.app_type}"
|
||||
auth_method_type = "OIDC_AUTH_METHOD_TYPE_${each.value.auth_method}"
|
||||
version = "OIDC_VERSION_1_0"
|
||||
|
||||
# JWT access tokens: Kubernetes RBAC, MinIO policy mapping and the Go
|
||||
# gateway all read claims, and an opaque bearer token carries none.
|
||||
access_token_type = "OIDC_TOKEN_TYPE_JWT"
|
||||
|
||||
# Assert roles without the client having to request the scope. Every
|
||||
# consumer here maps roles or groups to local permissions.
|
||||
access_token_role_assertion = true
|
||||
id_token_role_assertion = true
|
||||
id_token_userinfo_assertion = true
|
||||
|
||||
dev_mode = each.value.dev_mode
|
||||
}
|
||||
}
|
||||
@@ -1,139 +0,0 @@
|
||||
# Machine users and their project grants (plan §1.4, §5.3).
|
||||
#
|
||||
# Authentik gave each agent an app password or a client_credentials grant built
|
||||
# on a user password. ZITADEL has no user password on a machine user: it issues
|
||||
# a JWT profile key (`KEY_TYPE_JSON`) that the SDK signs its token request with.
|
||||
# That removes the password path entirely, which is the point — see §5.3.
|
||||
#
|
||||
# Per-agent claim values are copied from `SERVICE_ACCOUNTS` in
|
||||
# scripts/iam/provision-rbac.py. They live in user metadata as JSON strings,
|
||||
# because the groups-claim action (actions.tf) is the only thing that turns them
|
||||
# into token claims. Without that action a consumer sees roles but not
|
||||
# `minio_buckets`, `authorized_models`, `sqs_queues`, `memory_projects`,
|
||||
# `memory_visibility` or `paperless_doctypes`.
|
||||
#
|
||||
# Keys are generated per machine user and land in `terraform output -json
|
||||
# machine_keys` (sensitive). Feed each one to the owning workload as a mounted
|
||||
# file, never as an environment variable dumps-able through `ps`.
|
||||
|
||||
locals {
|
||||
machine_users = {
|
||||
"memory-agent" = {
|
||||
description = "Memory service agent"
|
||||
project_roles = ["poimen-admins"]
|
||||
authenticated_by = "poimen memory (Rust)"
|
||||
metadata = {
|
||||
roles = jsonencode(["llm:inference", "memory:read", "memory:write", "notification:write", "sessions:read", "sessions:write"])
|
||||
memory_projects = jsonencode(["*"])
|
||||
memory_visibility = "private"
|
||||
authorized_models = jsonencode(["reasoning", "ornith:35b", "qwen2.5:3b"])
|
||||
}
|
||||
}
|
||||
"paperless-ai-agent" = {
|
||||
description = "Paperless AI plugin (auto-tagging, entity extraction)"
|
||||
project_roles = ["poimen-devs"]
|
||||
authenticated_by = "paperless-ai"
|
||||
metadata = {
|
||||
roles = jsonencode(["llm:inference", "memory:write", "paperless:admin", "notification:write"])
|
||||
minio_buckets = jsonencode(["paperless"])
|
||||
paperless_doctypes = jsonencode(["*"])
|
||||
memory_projects = jsonencode(["*"])
|
||||
authorized_models = jsonencode(["reasoning", "qwen2.5:3b"])
|
||||
}
|
||||
}
|
||||
"portfolio-agent" = {
|
||||
description = "Portfolio service agent"
|
||||
project_roles = ["poimen-prod-readonly"]
|
||||
authenticated_by = "portfolio service"
|
||||
metadata = {
|
||||
roles = jsonencode(["llm:inference", "memory:read"])
|
||||
memory_projects = jsonencode(["homelab", "portfolio"])
|
||||
memory_visibility = "public"
|
||||
authorized_models = jsonencode(["ornith:35b"])
|
||||
minio_buckets = jsonencode(["backups"])
|
||||
}
|
||||
}
|
||||
"temporal-worker-agent" = {
|
||||
description = "Temporal workflow worker"
|
||||
project_roles = ["poimen-admins"]
|
||||
authenticated_by = "Temporal worker"
|
||||
metadata = {
|
||||
roles = jsonencode(["llm:inference", "workflow:execute", "memory:read", "memory:write", "queue:send", "notification:write"])
|
||||
memory_projects = jsonencode(["*"])
|
||||
sqs_queues = jsonencode(["*"])
|
||||
authorized_models = jsonencode(["reasoning", "ornith:35b", "qwen2.5:3b"])
|
||||
}
|
||||
}
|
||||
# The gateway is the one consumer that used client_credentials on a machine
|
||||
# token, so it needs both the OIDC app (clients.tf) and a machine user
|
||||
# (here) plus its API application (api_apps.tf). Its capability check reads
|
||||
# the `roles` claim, which arrives as metadata.
|
||||
"api-gw" = {
|
||||
description = "Go LLM gateway machine identity"
|
||||
project_roles = []
|
||||
authenticated_by = "api-gw"
|
||||
metadata = {
|
||||
roles = jsonencode(["llm:inference"])
|
||||
}
|
||||
}
|
||||
# pi-worker has no anchor in git (plan §1.1: "not in git") and no group in
|
||||
# the Authentik provisioning script. It gets a machine user and no project
|
||||
# role until the owner names the consumer configuration that holds its old
|
||||
# credentials. Creating a role grant blind would widen access, not preserve it.
|
||||
"pi-worker" = {
|
||||
description = "pi sandbox worker (no git anchor for its consumer config)"
|
||||
project_roles = []
|
||||
authenticated_by = "pi sandbox worker"
|
||||
metadata = {
|
||||
roles = jsonencode([])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
machine_metadata = merge([
|
||||
for user, spec in local.machine_users : {
|
||||
for key, value in spec.metadata : "${user}/${key}" => {
|
||||
user = user
|
||||
key = key
|
||||
value = value
|
||||
}
|
||||
}
|
||||
]...)
|
||||
}
|
||||
|
||||
resource "zitadel_machine_user" "agent" {
|
||||
for_each = local.machine_users
|
||||
|
||||
org_id = data.zitadel_org.default.id
|
||||
user_name = each.key
|
||||
name = each.key
|
||||
description = "${each.value.description} — consumer: ${each.value.authenticated_by}"
|
||||
with_secret = false
|
||||
}
|
||||
|
||||
resource "zitadel_machine_key" "agent" {
|
||||
for_each = local.machine_users
|
||||
|
||||
org_id = data.zitadel_org.default.id
|
||||
user_id = zitadel_machine_user.agent[each.key].id
|
||||
key_type = "KEY_TYPE_JSON"
|
||||
expiration_date = var.machine_key_expiry
|
||||
}
|
||||
|
||||
resource "zitadel_project_member" "agent" {
|
||||
for_each = { for user, spec in local.machine_users : user => spec if length(spec.project_roles) > 0 }
|
||||
|
||||
org_id = data.zitadel_org.default.id
|
||||
project_id = zitadel_project_v2.homelab.id
|
||||
user_id = zitadel_machine_user.agent[each.key].id
|
||||
roles = each.value.project_roles
|
||||
}
|
||||
|
||||
resource "zitadel_user_metadata" "agent_claim" {
|
||||
for_each = local.machine_metadata
|
||||
|
||||
org_id = data.zitadel_org.default.id
|
||||
user_id = zitadel_machine_user.agent[each.value.user].id
|
||||
key = each.value.key
|
||||
value = each.value.value
|
||||
}
|
||||
@@ -1,46 +0,0 @@
|
||||
# Outputs feed two things: the SOPS re-point of consumer secrets (§3.2, §6.9)
|
||||
# and the machine-key handoff to each agent workload (§5.3). Every value that can
|
||||
# authenticate a client is marked sensitive, so `terraform output` prints a
|
||||
# placeholder until you ask for it explicitly.
|
||||
|
||||
output "org_id" {
|
||||
description = "Organization that owns the project, roles and applications."
|
||||
value = data.zitadel_org.default.id
|
||||
}
|
||||
|
||||
output "project_id" {
|
||||
description = "Project ID, which ZITADEL puts in the access-token `aud` claim."
|
||||
value = zitadel_project_v2.homelab.id
|
||||
}
|
||||
|
||||
output "client_ids" {
|
||||
description = "client_id per consumer. Compare against the Authentik values: any difference means the consumer config must change too."
|
||||
value = { for name, app in zitadel_application_v2.oidc : name => app.oidc[0].client_id }
|
||||
}
|
||||
|
||||
output "client_secrets" {
|
||||
description = "Generated client secret per consumer. Write these into the existing SOPS files; never into git."
|
||||
value = { for name, app in zitadel_application_v2.oidc : name => app.oidc[0].client_secret }
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
output "api_app_client_ids" {
|
||||
description = "client_id of each API application (machine-token surface)."
|
||||
value = { for name, app in zitadel_application_api.machine : name => app.client_id }
|
||||
}
|
||||
|
||||
output "machine_user_ids" {
|
||||
description = "ZITADEL user ID per machine user."
|
||||
value = { for name, user in zitadel_machine_user.agent : name => user.id }
|
||||
}
|
||||
|
||||
output "machine_keys" {
|
||||
description = "JWT profile key JSON per machine user. Mount as a file; do not pass through the environment."
|
||||
value = { for name, key in zitadel_machine_key.agent : name => key.key_details }
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
output "groups_claim_enabled" {
|
||||
description = "Whether the groups-claim action and its triggers exist. False means Option A is not yet in place and no consumer may move."
|
||||
value = var.enable_groups_claim_action
|
||||
}
|
||||
@@ -1,62 +0,0 @@
|
||||
# Project, roles and default-org lookup.
|
||||
#
|
||||
# ZITADEL has no group object. The plan §1.3 maps every Authentik group to a
|
||||
# project role, and the groups-claim action (actions.tf) reconstructs the
|
||||
# `groups` claim from those role keys. Role keys therefore EQUAL the existing
|
||||
# Authentik group names, including the hyphens, so that the resulting claim is
|
||||
# byte-identical and no consumer or RBAC file changes. The v4.19.2 API allows
|
||||
# role keys of 1-200 characters with no character-set restriction (proto
|
||||
# zitadel/project/v2/project_service.proto, AddProjectRole.role_key).
|
||||
|
||||
data "zitadel_org" "default" {
|
||||
id = var.org_id
|
||||
}
|
||||
|
||||
locals {
|
||||
# Single source: the 19 groups of scripts/iam/provision-rbac.py GROUPS.
|
||||
# Descriptions are carried over so the console reads the same as before.
|
||||
roles = {
|
||||
"homelab-admins" = "Cluster administrators with full access"
|
||||
"minio-admins" = "MinIO administrators"
|
||||
"minio-photos" = "Photos bucket (Immich) access"
|
||||
"minio-documents" = "Documents bucket (Paperless) access"
|
||||
"minio-backups" = "Backups bucket read-only access"
|
||||
"poimen-admins" = "Poimen memory administrators"
|
||||
"poimen-devs" = "Dev and staging projects access"
|
||||
"poimen-prod-readonly" = "Production projects read-only access"
|
||||
"paperless-admins" = "Paperless administrators"
|
||||
"paperless-finance" = "Finance documents"
|
||||
"paperless-legal" = "Legal documents"
|
||||
"paperless-hr" = "HR documents"
|
||||
"grafana-admins" = "Grafana administrators"
|
||||
"grafana-editors" = "Grafana dashboard editors"
|
||||
"grafana-viewers" = "Grafana dashboard viewers"
|
||||
"sqs-users" = "SQS/Temporal queue read access"
|
||||
"sqs-writers" = "SQS/Temporal queue read/write access"
|
||||
"s3-users" = "S3 read access"
|
||||
"s3-writers" = "S3 read/write access"
|
||||
}
|
||||
}
|
||||
|
||||
resource "zitadel_project_v2" "homelab" {
|
||||
org_id = data.zitadel_org.default.id
|
||||
name = var.project_name
|
||||
project_id = var.project_id
|
||||
project_role_check = false
|
||||
|
||||
# Roles must reach the tokens. Every consumer authorizes on them:
|
||||
# kube-apiserver RBAC reads `groups`, MinIO reads bucket policies, Grafana
|
||||
# reads grafana_org_role. Role assertion on the ID token is what most OIDC
|
||||
# clients inspect.
|
||||
project_role_assertion = true
|
||||
}
|
||||
|
||||
resource "zitadel_project_role" "groups" {
|
||||
for_each = local.roles
|
||||
|
||||
org_id = data.zitadel_org.default.id
|
||||
project_id = zitadel_project_v2.homelab.id
|
||||
role_key = each.key
|
||||
display_name = each.key
|
||||
group = "homelab"
|
||||
}
|
||||
@@ -1,53 +0,0 @@
|
||||
# terraform/zitadel — identity configuration for the ZITADEL instance
|
||||
#
|
||||
# Scope: this root module declares the objects INSIDE ZITADEL (org, project,
|
||||
# roles, OIDC applications, machine users, grants). It does NOT deploy ZITADEL
|
||||
# itself — that is ArgoCD's job (`k8s/argocd/apps/30-security.yaml`, values in
|
||||
# `k8s/infra/iam/zitadel-values.yaml`).
|
||||
#
|
||||
# Migration plan: ~/workplace/homelab-doc/ZITADEL_MIGRATION.html (outside git).
|
||||
# This file implements §1.3 (roles), §1.4 (machine users), §2.4 (grants) and
|
||||
# §6.2 (Terraform provider route). The claim-injection action of §1.3 lives in
|
||||
# `actions.tf` and stays disabled until the live go/no-go gate proves it.
|
||||
#
|
||||
# Authentication to ZITADEL uses the `iam-admin` machine key that the chart's
|
||||
# setup job writes to the `iam-admin` Secret in namespace iam:
|
||||
#
|
||||
# kubectl -n iam get secret iam-admin -o jsonpath='{.data.iam-admin\.json}' \
|
||||
# | base64 -d > ~/.config/zitadel/iam-admin.json
|
||||
# chmod 600 ~/.config/zitadel/iam-admin.json
|
||||
#
|
||||
# export ZITADEL_JWT_PROFILE_FILE=$HOME/.config/zitadel/iam-admin.json
|
||||
# terraform -chdir=terraform/zitadel init
|
||||
# terraform -chdir=terraform/zitadel plan
|
||||
#
|
||||
# State is LOCAL and git-ignored (`terraform/*.tfstate` in .gitignore). That is
|
||||
# a deliberate first step, not the final answer: §8 risk 8 of the plan names
|
||||
# state drift as a blast-radius item. Move the state to MinIO before a second
|
||||
# operator ever runs `apply`. No secret is written to state except the generated
|
||||
# client secrets and machine keys, which are marked sensitive — they still land
|
||||
# in the state file, so treat that file as a secret.
|
||||
terraform {
|
||||
required_version = ">= 1.6.0"
|
||||
|
||||
required_providers {
|
||||
zitadel = {
|
||||
source = "zitadel/zitadel"
|
||||
version = "3.8.7"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "zitadel" {
|
||||
domain = var.zitadel_domain
|
||||
port = var.zitadel_port
|
||||
|
||||
# JWT profile of the iam-admin machine user. Preferred over a PAT: it is
|
||||
# short-lived per call and never sits in the environment as a bearer token.
|
||||
# Set the path through ZITADEL_JWT_PROFILE_FILE.
|
||||
jwt_profile_file = var.jwt_profile_file
|
||||
|
||||
# The instance serves plain HTTP behind ingress-nginx, which terminates TLS.
|
||||
# Turn this on only if the provider must call the pod directly.
|
||||
insecure = var.zitadel_insecure
|
||||
}
|
||||
@@ -1,103 +0,0 @@
|
||||
variable "zitadel_domain" {
|
||||
description = "External domain of the ZITADEL instance, without scheme."
|
||||
type = string
|
||||
default = "zitadel.riotpiao.com"
|
||||
}
|
||||
|
||||
variable "zitadel_port" {
|
||||
description = "Port for the ZITADEL API. 443 behind ingress, 8080 for a direct pod port-forward."
|
||||
type = string
|
||||
default = "443"
|
||||
}
|
||||
|
||||
variable "zitadel_insecure" {
|
||||
description = "Call the API over plain HTTP (set true only when port-forwarding the pod)."
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "jwt_profile_file" {
|
||||
description = "Path to the iam-admin machine key JSON extracted from the iam-admin Secret."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "org_id" {
|
||||
description = <<-EOT
|
||||
ID of the ZITADEL organization that holds the project. Read it from the
|
||||
console: https://zitadel.riotpiao.com -> Organization settings -> Resource
|
||||
ID. The chart's setup job creates the default org; this module never creates
|
||||
one, because creating a second org would split the role and grant space.
|
||||
EOT
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "project_id" {
|
||||
description = <<-EOT
|
||||
Stable project ID. ZITADEL puts the project ID in the access token `aud`
|
||||
claim, so pinning it keeps audience checks readable across a rebuild.
|
||||
Every consumer that validates `aud` against a client ID must be re-pointed
|
||||
to this value — see the plan §5.2.
|
||||
EOT
|
||||
type = string
|
||||
default = "homelab"
|
||||
}
|
||||
|
||||
variable "project_name" {
|
||||
description = "Display name of the project that carries every role and application."
|
||||
type = string
|
||||
default = "homelab"
|
||||
}
|
||||
|
||||
variable "machine_key_expiry" {
|
||||
description = "Expiry of every machine key, RFC3339. Matches the chart's default iam-admin key window; rotate by changing this value and re-applying."
|
||||
type = string
|
||||
default = "2029-01-01T00:00:00Z"
|
||||
}
|
||||
|
||||
variable "api_app_consumers" {
|
||||
description = <<-EOT
|
||||
Machine users that also need an API application (the client_credentials
|
||||
replacement). Only the gateway does: every other agent signs a JWT with its
|
||||
machine key and does not need a client_credentials grant.
|
||||
EOT
|
||||
type = map(string)
|
||||
default = { api-gw = "Go LLM gateway" }
|
||||
}
|
||||
|
||||
variable "enable_groups_claim_action" {
|
||||
description = <<-EOT
|
||||
Create the Actions v1 script and its trigger that synthesizes the `groups`
|
||||
claim. Keep this false until the live go/no-go gate passes: the claim is
|
||||
load-bearing for kube-apiserver RBAC, MinIO policies, Grafana role mapping
|
||||
and every service that reads `groups`. Turning it on with an unverified
|
||||
script can break every consumer at once.
|
||||
EOT
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "groups_claim_script" {
|
||||
description = <<-EOT
|
||||
Path to the JavaScript body for the groups-claim action, read only when
|
||||
enable_groups_claim_action is true. The body is deliberately not shipped
|
||||
blind: the ZITADEL v1 Actions runtime API must be confirmed against the live
|
||||
instance before a script is committed, because a wrong call silently emits
|
||||
no claim instead of failing loudly.
|
||||
EOT
|
||||
type = string
|
||||
default = null
|
||||
|
||||
validation {
|
||||
# try() is required: HCL does not short-circuit `||`, so fileexists(null)
|
||||
# would fail the whole plan even with the action disabled.
|
||||
condition = try(fileexists(var.groups_claim_script), true)
|
||||
error_message = "groups_claim_script must name an existing file when it is set."
|
||||
}
|
||||
|
||||
# Enabling the action without a script would reach file(null) inside actions.tf.
|
||||
validation {
|
||||
condition = !var.enable_groups_claim_action || var.groups_claim_script != null
|
||||
error_message = "enable_groups_claim_action requires groups_claim_script."
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user