rock
fbc1b6a33d
Forgejo keeps login sources in its database and exposes no REST endpoint for them, so neither GitOps nor `tea` (whose admin command only manages users) can set them. The in-pod CLI is the only supported writer. This script wraps `gitea admin auth update-oauth` so the rename from the Authentik-era label to `zitadel` is repeatable instead of a one-off command in a shell history. Note in the header: the source name is both the button label and the callback path, so ZITADEL must have both redirect URIs registered before a rename.
39 lines
1.3 KiB
Bash
Executable File
39 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# forgejo-oauth-source.sh — keep the Forgejo OAuth login source aligned with
|
|
# ZITADEL.
|
|
#
|
|
# Forgejo stores login sources in its database, not in GitOps, and its REST API
|
|
# does not expose them. `tea` has no auth-source command either (tea admin only
|
|
# manages users), so the supported writer is the in-pod CLI:
|
|
# gitea admin auth update-oauth
|
|
#
|
|
# The source name is the label on the "Sign in with ..." button AND the callback
|
|
# path (/user/oauth2/<name>/callback), so a rename changes the registered
|
|
# redirect URI. Register both spellings in ZITADEL (zitadel-provision.py does)
|
|
# before renaming.
|
|
#
|
|
# Usage:
|
|
# scripts/iam/forgejo-oauth-source.sh status
|
|
# scripts/iam/forgejo-oauth-source.sh rename zitadel
|
|
set -euo pipefail
|
|
|
|
NS="${FORGEJO_NAMESPACE:-cicd}"
|
|
SEL="${FORGEJO_SELECTOR:-app.kubernetes.io/name=forgejo}"
|
|
|
|
pod() {
|
|
kubectl -n "$NS" get pods -l "$SEL" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null \
|
|
|| kubectl -n "$NS" get pods -o name | grep -m1 forgejo-gitea | cut -d/ -f2
|
|
}
|
|
|
|
run() { kubectl -n "$NS" exec "$(pod)" -c gitea -- gitea admin auth "$@"; }
|
|
|
|
case "${1:-status}" in
|
|
status) run list ;;
|
|
rename)
|
|
name="${2:?usage: $0 rename <name>}"
|
|
run update-oauth --id 1 --name "$name"
|
|
run list
|
|
;;
|
|
*) echo "usage: $0 [status|rename <name>]" >&2; exit 2 ;;
|
|
esac
|