rock
979a413a5b
ZITADEL_BOOTSTRAP_TOKEN and ZITADEL_URL now live in .env and .env.example, the same shape the Authentik variables use. The line is present and empty: the PAT does not exist until the chart's setup job creates the iam-admin machine user on the first sync, so a value cannot be minted ahead of time. The provisioning script loads .env itself instead of relying on the caller to source it, and resolves the token in a fixed order: ZITADEL_BOOTSTRAP_TOKEN, then the cached file under ~/.config/zitadel, then the cluster Secret. The .env value wins so a human can paste a rotated token without touching the cluster; the cluster Secret remains the only source that always reflects a rotation. .env stays git-ignored. It already holds the live Authentik secrets, and this change does not move them. Not exercised against a live instance: the kube-apiserver on talos-cp-1 is in CrashLoopBackOff, so kubectl only works against cp-2 or cp-3 right now.
93 lines
4.9 KiB
Bash
93 lines
4.9 KiB
Bash
# .env.example
|
|
# Copy to .env and fill in. The real .env is gitignored — never commit it.
|
|
# Leave any value empty and vsource will fetch it from Vault at cluster/<KEY>.
|
|
|
|
# ── Cluster Configuration ──────────────────────────────────────────────────────
|
|
# Base domain for external services (Authentik, MinIO, Forgejo, etc.)
|
|
# Example: riotpiao.com
|
|
CLUSTER_DOMAIN=riotpiao.com
|
|
|
|
# Internal Kubernetes DNS names (svc.cluster.local)
|
|
# Only change these if your cluster domain differs
|
|
POSTGRES_HOST=ddb-cluster-rw.ddb.svc.cluster.local
|
|
MINIO_ENDPOINT=minio.storage.svc.cluster.local:9000
|
|
KAFKA_BOOTSTRAP=kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092
|
|
REDIS_ADDR=kmsvc-redis-master.sqs.svc.cluster.local:6379
|
|
|
|
# ── Authentik ──────────────────────────────────────────────────────────────────
|
|
# Signing/encryption key. SET ONCE — rotating invalidates all sessions and tokens.
|
|
# openssl rand -base64 60 | tr -d '\n'
|
|
AUTHENTIK_SECRET_KEY=
|
|
|
|
# Initial password for the built-in admin 'akadmin'. Change after first login.
|
|
# openssl rand -base64 24
|
|
AUTHENTIK_BOOTSTRAP_PASSWORD=
|
|
|
|
# Initial API token for 'akadmin' (automation / blueprints).
|
|
# openssl rand -hex 32
|
|
AUTHENTIK_BOOTSTRAP_TOKEN=
|
|
|
|
# Password for the bundled PostgreSQL 'authentik' user.
|
|
# openssl rand -base64 24
|
|
AUTHENTIK_PG_PASSWORD=
|
|
|
|
# ── ZITADEL (Authentik replacement) ─────────────────────────────────────────────
|
|
# Instance URL, same hostname as the OIDC issuer.
|
|
ZITADEL_URL="https://zitadel.riotpiao.com"
|
|
|
|
# PAT of the 'iam-admin' machine user, created by the chart's setup job on the
|
|
# first sync. Leave empty until then. Read it with:
|
|
# kubectl -n iam get secret iam-admin-pat -o jsonpath='{.data.pat}' | base64 -d
|
|
# scripts/iam/zitadel-provision.py reads this variable first, then the cluster
|
|
# Secret. The masterkey and the client secrets never live in this file.
|
|
ZITADEL_BOOTSTRAP_TOKEN=
|
|
|
|
# ── MinIO ──────────────────────────────────────────────────────────────────────
|
|
MINIO_ROOT_USER=
|
|
MINIO_ROOT_PASSWORD=
|
|
|
|
# ── Grafana ────────────────────────────────────────────────────────────────────
|
|
GRAFANA_ADMIN_PASSWORD=
|
|
|
|
# ── Forgejo ────────────────────────────────────────────────────────────────────
|
|
FORGEJO_ADMIN_PASSWORD=
|
|
|
|
# ── OIDC client secrets (required) ────────────────────────────────────────────
|
|
# These must be pre-generated and stored in Vault before running setup_talos_iam.sh.
|
|
# talos put cluster/GRAFANA_OIDC_CLIENT_SECRET GRAFANA_OIDC_CLIENT_SECRET="$(openssl rand -hex 32)"
|
|
GRAFANA_OIDC_CLIENT_SECRET=
|
|
MINIO_OIDC_CLIENT_SECRET=
|
|
AUTHENTIK_FORGEJO_CLIENT_SECRET=
|
|
AUTHENTIK_ARGOCD_CLIENT_SECRET=
|
|
AUTHENTIK_OLLAMA_CLIENT_SECRET=
|
|
AUTHENTIK_TEMPORAL_CLIENT_SECRET=
|
|
AUTHENTIK_KMSVC_CLIENT_SECRET=
|
|
AUTHENTIK_LONGHORN_CLIENT_SECRET=
|
|
AUTHENTIK_PORTAINER_CLIENT_SECRET=
|
|
|
|
# ── OIDC client IDs (optional) ────────────────────────────────────────────────
|
|
# Leave empty to use the provider name as client_id (the safe default).
|
|
# Only set if you need a custom client_id (e.g. after rotating a compromised credential).
|
|
# talos put cluster/AUTHENTIK_ARGOCD_CLIENT_ID AUTHENTIK_ARGOCD_CLIENT_ID="my-custom-id"
|
|
GRAFANA_OIDC_CLIENT_ID=
|
|
MINIO_OIDC_CLIENT_ID=
|
|
AUTHENTIK_FORGEJO_CLIENT_ID=
|
|
AUTHENTIK_ARGOCD_CLIENT_ID=
|
|
AUTHENTIK_OLLAMA_CLIENT_ID=
|
|
AUTHENTIK_TEMPORAL_CLIENT_ID=
|
|
|
|
# ── CI/CD ──────────────────────────────────────────────────────────────────────
|
|
# Forgejo Personal Access Token (from rock user) for pushing images to registry
|
|
FORGEJO_RIOTPIAO_PAT=
|
|
|
|
# ── Cloudflare Tunnel (remote off-LAN access to kubectl/talosctl) ──────────────
|
|
# From Cloudflare Zero Trust dashboard → Networks → Tunnels
|
|
# CLOUDFLARE_CONNECTOR_TOKEN: full tunnel token (JWT-like base64 string)
|
|
# CLOUDFLARE_ACCOUNT_ID: your account ID (hex string)
|
|
# CLOUDFLARE_TUNNEL_ID: tunnel UUID
|
|
# CLOUDFLARE_API_TOKEN: API token for programmatic tunnel config (optional)
|
|
CLOUDFLARE_CONNECTOR_TOKEN=
|
|
CLOUDFLARE_ACCOUNT_ID=
|
|
CLOUDFLARE_TUNNEL_ID=
|
|
CLOUDFLARE_API_TOKEN=
|