From f0bae5e031a0a047c1fd1757491352ce647e3812 Mon Sep 17 00:00:00 2001 From: Tobias Manske Date: Thu, 14 Sep 2023 07:09:02 +0200 Subject: [PATCH] Add Terraform Stage 1 --- .drone.yml | 12 ++++ summon-wrapper | 3 + tf-stage-1/dns-tobiasmanske-de.tf | 44 +++++++++++++ tf-stage-1/dns-unruhig-eu.tf | 12 ++++ tf-stage-1/main.tf | 26 ++++++++ tf-stage-1/modules/dns/dns.tf | 14 +++++ tf-stage-1/modules/dns/main.tf | 9 +++ tf-stage-1/modules/dns/variables.tf | 10 +++ tf-stage-1/modules/kc-client/client.tf | 74 ++++++++++++++++++++++ tf-stage-1/modules/kc-client/main.tf | 8 +++ tf-stage-1/modules/kc-client/outputs.tf | 12 ++++ tf-stage-1/modules/kc-client/variables.tf | 75 +++++++++++++++++++++++ tf-stage-1/providers.tf | 10 +++ tf-stage-1/secrets.yml | 9 +++ tf-stage-1/service-gitea.tf | 37 +++++++++++ tf-stage-1/service_debug.tf | 8 +++ tf-stage-1/service_grafana.tf | 70 +++++++++++++++++++++ tf-stage-1/service_hedgedoc.tf | 51 +++++++++++++++ tf-stage-1/service_miniflux.tf | 51 +++++++++++++++ tf-stage-1/terraform.tfvars | 1 + tf-stage-1/user_ialistannen.tf | 13 ++++ tf-stage-1/user_rad4day.tf | 18 ++++++ tf-stage-1/variables.tf | 30 +++++++++ 23 files changed, 597 insertions(+) create mode 100755 summon-wrapper create mode 100644 tf-stage-1/dns-tobiasmanske-de.tf create mode 100644 tf-stage-1/dns-unruhig-eu.tf create mode 100644 tf-stage-1/main.tf create mode 100644 tf-stage-1/modules/dns/dns.tf create mode 100644 tf-stage-1/modules/dns/main.tf create mode 100644 tf-stage-1/modules/dns/variables.tf create mode 100644 tf-stage-1/modules/kc-client/client.tf create mode 100644 tf-stage-1/modules/kc-client/main.tf create mode 100644 tf-stage-1/modules/kc-client/outputs.tf create mode 100644 tf-stage-1/modules/kc-client/variables.tf create mode 100644 tf-stage-1/providers.tf create mode 100644 tf-stage-1/secrets.yml create mode 100644 tf-stage-1/service-gitea.tf create mode 100644 tf-stage-1/service_debug.tf create mode 100644 tf-stage-1/service_grafana.tf create mode 100644 tf-stage-1/service_hedgedoc.tf create mode 100644 tf-stage-1/service_miniflux.tf create mode 100644 tf-stage-1/terraform.tfvars create mode 100644 tf-stage-1/user_ialistannen.tf create mode 100644 tf-stage-1/user_rad4day.tf create mode 100644 tf-stage-1/variables.tf diff --git a/.drone.yml b/.drone.yml index 5520b23..5a7be91 100644 --- a/.drone.yml +++ b/.drone.yml @@ -15,6 +15,9 @@ environment: ANSIBLE_FORCE_COLOR: true ANSIBLE_HOME: /drone/src/.ansible ANSIBLE_VAULT_PASSWORD_FILE: "/drone/src/vault_pass" + SUMMON_PROVIDER: /drone/src/summon-wrapper + PASSAGE_DIR: /drone/src/.passage/store + PASSAGE_IDENTITIES_FILE: /drone/src/ssh_key node: ansible: "true" @@ -28,11 +31,13 @@ steps: from_secret: vault_pass SSH_KEY: from_secret: ssh_key + GIT_SSH_COMMAND: ssh -i /drone/src/ssh_key -o StrictHostKeyChecking=no commands: - echo $${VAULT_PASS} > /drone/src/vault_pass - echo $${SSH_KEY} | base64 -d > /drone/src/ssh_key - chmod 600 /drone/src/ssh_key - chmod 600 /drone/src/vault_pass + - git clone ssh://git@git.tobiasmanske.de:7779/tobias/infrastructure-vault.git $${PASSAGE_DIR} - name: Prepare Runner image: registry.tobiasmanske.de/ansible-runner:latest pull: always @@ -41,6 +46,13 @@ steps: - mkdir $ANSIBLE_HOME - ansible-galaxy install -r requirements.yaml - ansible-playbook --private-key ../ssh_key --inventory=inventory.yaml runner-pre.yaml + - name: Run Terraform + image: registry.tobiasmanske.de/terraform-runner:latest + pull: always + commands: + - cd tf-stage-1 + - summon terraform init + - summon terraform plan # do not run right now. this is still in debug :christ: - name: Run Ansible image: registry.tobiasmanske.de/ansible-runner:latest pull: always diff --git a/summon-wrapper b/summon-wrapper new file mode 100755 index 0000000..21404b4 --- /dev/null +++ b/summon-wrapper @@ -0,0 +1,3 @@ +#!/bin/sh +passage show $(echo "${@}"|tr : \ ) + diff --git a/tf-stage-1/dns-tobiasmanske-de.tf b/tf-stage-1/dns-tobiasmanske-de.tf new file mode 100644 index 0000000..92f258b --- /dev/null +++ b/tf-stage-1/dns-tobiasmanske-de.tf @@ -0,0 +1,44 @@ +module "dns-tobiasmanske-de" { + source = "./modules/dns" + + account_id = var.cloudflare_account_id + zone = "tobiasmanske.de" + + records = [ + { type = "A", name = "web", value = "185.216.177.198" }, + { type = "AAAA", name = "web", value = "2a03:4000:4f:9f2::1" }, + { type = "CNAME", name = "@", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "s3", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "minio", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "doc", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "drone", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "git", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "meet", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "oauth", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "registry", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "registry-auth", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "traefik-fa", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "repo", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "rss", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "search", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "test", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "calendar", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "www", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "grafana", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "prometheus", value = "web.tobiasmanske.de" }, + { type = "CNAME", name = "status", value = "mon1.hel1.chaoswg.org" }, + { type = "CNAME", name = "auth", value = "infra.unruhig.eu" }, + { type = "TXT", name = "@", value = "google-site-verification=I7WrzPjqHIL6EATWd8UWfvx6ScDzqjA3DGZi-J-F1e0" }, + + # Mail settings + { type = "A", name = "mail", value = "202.61.232.207" }, + { type = "MX", name = "@", value = "mxe8cf.netcup.net", priority = 50 }, + { type = "MX", name = "@", value = "mail.tobiasmanske.de", priority = 10 }, + { type = "CNAME", name = "autoconfig", value = "autoconfig.netcup.net" }, + { type = "CNAME", name = "key1._domainkey", value = "key1._domainkey.webhosting.systems" }, + { type = "CNAME", name = "key2._domainkey", value = "key2._domainkey.webhosting.systems" }, + { type = "TXT", name = "@", value = "v=spf1 mx include:_spf.webhosting.systems -all" }, + { type = "TXT", name = "_dmarc", value = "v=DMARC1; p=quarantine;pct=100;rua=mailto:postmaster+dmarc@tobiasmanske.de;" }, + + ] +} diff --git a/tf-stage-1/dns-unruhig-eu.tf b/tf-stage-1/dns-unruhig-eu.tf new file mode 100644 index 0000000..4b0f805 --- /dev/null +++ b/tf-stage-1/dns-unruhig-eu.tf @@ -0,0 +1,12 @@ +module "dns-unruhig-eu" { + source = "./modules/dns" + + account_id = var.cloudflare_account_id + zone = "unruhig.eu" + + records = [ + { type = "A", name = "infra", value = "37.221.198.143" }, + { type = "AAAA", name = "infra", value = "2a03:4000:9:176::1" }, + ] + +} diff --git a/tf-stage-1/main.tf b/tf-stage-1/main.tf new file mode 100644 index 0000000..bd2f364 --- /dev/null +++ b/tf-stage-1/main.tf @@ -0,0 +1,26 @@ +terraform { + backend "s3" { + bucket = "infra" + key = "terraform/keycloak.tfstate" + endpoint = "https://s3.tobiasmanske.de" + force_path_style = true + region = "us-east-1" + skip_credentials_validation = true + skip_region_validation = true + skip_metadata_api_check = true + } + required_providers { + keycloak = { + source = "mrparkers/keycloak" + version = "~> 4.3.0" + } + cloudflare = { + source = "cloudflare/cloudflare" + version = "~> 4.0" + } + } +} + +data "keycloak_realm" "realm" { + realm = var.realm +} diff --git a/tf-stage-1/modules/dns/dns.tf b/tf-stage-1/modules/dns/dns.tf new file mode 100644 index 0000000..149d656 --- /dev/null +++ b/tf-stage-1/modules/dns/dns.tf @@ -0,0 +1,14 @@ +resource "cloudflare_zone" "zone" { + account_id = var.account_id + zone = var.zone +} + +resource "cloudflare_record" "records" { + zone_id = cloudflare_zone.zone.id + for_each = { for record in var.records : uuidv5("dns", "${record.type}/${record.name}/${record.value}") => record } # Hackery. + name = each.value.name + value = each.value.value + type = each.value.type + ttl = 1 + priority = each.value.type == "MX" ? each.value.priority : null +} diff --git a/tf-stage-1/modules/dns/main.tf b/tf-stage-1/modules/dns/main.tf new file mode 100644 index 0000000..b2ab089 --- /dev/null +++ b/tf-stage-1/modules/dns/main.tf @@ -0,0 +1,9 @@ +terraform { + required_providers { + cloudflare = { + source = "cloudflare/cloudflare" + version = "~> 4.0" + } + } +} + diff --git a/tf-stage-1/modules/dns/variables.tf b/tf-stage-1/modules/dns/variables.tf new file mode 100644 index 0000000..cf2f66f --- /dev/null +++ b/tf-stage-1/modules/dns/variables.tf @@ -0,0 +1,10 @@ +variable "account_id" { + type = string + sensitive = true +} +variable "zone" { + type = string +} +variable "records" { + type = set(object({ type = string, name = string, value = string, priority = optional(number) })) +} diff --git a/tf-stage-1/modules/kc-client/client.tf b/tf-stage-1/modules/kc-client/client.tf new file mode 100644 index 0000000..877f63e --- /dev/null +++ b/tf-stage-1/modules/kc-client/client.tf @@ -0,0 +1,74 @@ +data "keycloak_realm" "realm" { + realm = var.realm +} + +resource "keycloak_openid_client" "client" { + realm_id = data.keycloak_realm.realm.id + client_id = var.client_id + client_secret = var.client_secret + + name = var.client_name + description = var.description + + enabled = var.enabled + access_type = var.access_type + client_authenticator_type = var.client_authenticator_type + + root_url = var.root_url + base_url = var.base_url + admin_url = var.admin_url + backchannel_logout_url = var.backchannel_logout_url + + valid_redirect_uris = var.valid_redirect_uris + web_origins = var.web_origins + + login_theme = var.login_theme + + standard_flow_enabled = true + implicit_flow_enabled = false + direct_access_grants_enabled = true + service_accounts_enabled = false + frontchannel_logout_enabled = false + +} + +resource "keycloak_role" "restricted-access" { + realm_id = data.keycloak_realm.realm.id + client_id = keycloak_openid_client.client.id + name = "restricted-access" + description = "Restricts access to the client" +} + +resource "keycloak_role" "admin-role" { + realm_id = data.keycloak_realm.realm.id + client_id = keycloak_openid_client.client.id + name = "${var.admin_role_name != null ? "${var.admin_role_name}" : "${var.client_name}-admin"}" + description = "Client Admin permissions" +} + +resource "keycloak_group" "access_group" { + realm_id = data.keycloak_realm.realm.id + name = var.client_name +} + +resource "keycloak_group" "admin_group" { + realm_id = data.keycloak_realm.realm.id + parent_id = keycloak_group.access_group.id + name = "${var.client_name}-admin" +} + +resource "keycloak_group_roles" "access_group_roles" { + realm_id = data.keycloak_realm.realm.id + group_id = keycloak_group.access_group.id + role_ids = [ + keycloak_role.restricted-access.id + ] +} + +resource "keycloak_group_roles" "admin_group_roles" { + realm_id = data.keycloak_realm.realm.id + group_id = keycloak_group.admin_group.id + role_ids = [ + keycloak_role.admin-role.id + ] +} diff --git a/tf-stage-1/modules/kc-client/main.tf b/tf-stage-1/modules/kc-client/main.tf new file mode 100644 index 0000000..e2885aa --- /dev/null +++ b/tf-stage-1/modules/kc-client/main.tf @@ -0,0 +1,8 @@ +terraform { + required_providers { + keycloak = { + source = "mrparkers/keycloak" + version = "~> 4.3.0" + } + } +} diff --git a/tf-stage-1/modules/kc-client/outputs.tf b/tf-stage-1/modules/kc-client/outputs.tf new file mode 100644 index 0000000..cc52cde --- /dev/null +++ b/tf-stage-1/modules/kc-client/outputs.tf @@ -0,0 +1,12 @@ +output "client" { + value = keycloak_openid_client.client +} +output "admin_group" { + value = keycloak_group.admin_group +} +output "access_group" { + value = keycloak_group.access_group +} +output "realm" { + value = data.keycloak_realm.realm +} diff --git a/tf-stage-1/modules/kc-client/variables.tf b/tf-stage-1/modules/kc-client/variables.tf new file mode 100644 index 0000000..5a8fe81 --- /dev/null +++ b/tf-stage-1/modules/kc-client/variables.tf @@ -0,0 +1,75 @@ +variable "client_id" { + type = string +} +variable "client_name" { + type = string +} + +variable "admin_role_name" { + type = string + default = null +} + +variable "client_secret" { + type = string + default = null + sensitive = true +} + +variable "description" { + type = string +} +variable "access_type" { + type = string + default = "CONFIDENTIAL" +} + +variable "realm" { + type = string +} + +variable "client_authenticator_type" { + type = string + default = "client-secret" +} + +variable "root_url" { # requires web_origins, admin_url and valid_redirect_uris to be set... + type = string + default = null +} + +variable "admin_url" { + type = string + default = null +} + +variable "base_url" { + type = string + default = null +} + +variable "web_origins" { + type = list(string) + default = null +} + +variable "backchannel_logout_url" { + type = string + default = null + description = "The URL to which a backchannel logout request will be sent from the Keycloak server." +} +variable "valid_redirect_uris" { + type = list(string) +} +variable "enabled" { + type = bool + default = true +} + + +# Default settings for all clients: + +variable "login_theme" { + type = string + default = "keywind" +} diff --git a/tf-stage-1/providers.tf b/tf-stage-1/providers.tf new file mode 100644 index 0000000..17c3143 --- /dev/null +++ b/tf-stage-1/providers.tf @@ -0,0 +1,10 @@ +provider "keycloak" { + client_id = "terraform" + client_secret = var.keycloak_client_secret + url = "https://auth.tobiasmanske.de" + realm = "tobiasmanske.de" +} + +provider "cloudflare" { + api_token = var.cloudflare_api_token +} diff --git a/tf-stage-1/secrets.yml b/tf-stage-1/secrets.yml new file mode 100644 index 0000000..c2498af --- /dev/null +++ b/tf-stage-1/secrets.yml @@ -0,0 +1,9 @@ +--- +TF_VAR_grafana_secret: !var keycloak/grafana/secret +TF_VAR_hedgedoc_secret: !var keycloak/hedgedoc/secret +TF_VAR_miniflux_secret: !var keycloak/miniflux/secret +TF_VAR_keycloak_client_secret: !var keycloak/terraform/secret +TF_VAR_cloudflare_api_token: !var extern/cloudflare/api_token +TF_VAR_cloudflare_account_id: !var extern/cloudflare/account_id +AWS_ACCESS_KEY_ID: !var terraform/state/s3_access_key +AWS_SECRET_ACCESS_KEY: !var terraform/state/s3_secret_key diff --git a/tf-stage-1/service-gitea.tf b/tf-stage-1/service-gitea.tf new file mode 100644 index 0000000..ea69fa6 --- /dev/null +++ b/tf-stage-1/service-gitea.tf @@ -0,0 +1,37 @@ +module "giteaclient" { + source = "./modules/kc-client" + + realm = var.realm + client_id = "gitea" + client_name = "Gitea" + description = "git.tobiasmanske.de" + root_url = "https://git.tobiasmanske.de" + admin_url = "https://git.tobiasmanske.de" + base_url = "" + valid_redirect_uris = ["https://git.tobiasmanske.de/user/oauth2/Keycloak/callback"] + web_origins = ["https://git.tobiasmanske.de"] +} + +resource "keycloak_openid_user_property_protocol_mapper" "gitea-username-mapper" { + realm_id = module.giteaclient.realm.id + client_id = module.giteaclient.client.id + + name = "username" + user_property = "username" + claim_name = "preferred_username" + add_to_userinfo = true + add_to_access_token = true + add_to_id_token = false +} + +resource "keycloak_openid_user_client_role_protocol_mapper" "gitea-role-mapper" { + realm_id = module.giteaclient.realm.id + client_id = module.giteaclient.client.id + # client_id_for_role_mappings = module.giteaclient.client.id + multivalued = true + name = "user-client-role-mapper" + claim_name = "roles" + add_to_userinfo = true + add_to_access_token = true + add_to_id_token = false +} diff --git a/tf-stage-1/service_debug.tf b/tf-stage-1/service_debug.tf new file mode 100644 index 0000000..206b7c9 --- /dev/null +++ b/tf-stage-1/service_debug.tf @@ -0,0 +1,8 @@ +module "kc-client" { + source = "./modules/kc-client" + client_id = "debug" + client_name = "Debug client" + description = "A client for debugging purposes" + realm = var.realm + valid_redirect_uris = ["http://localhost:8080/*"] +} diff --git a/tf-stage-1/service_grafana.tf b/tf-stage-1/service_grafana.tf new file mode 100644 index 0000000..b5da716 --- /dev/null +++ b/tf-stage-1/service_grafana.tf @@ -0,0 +1,70 @@ +module "grafanaclient" { + source = "./modules/kc-client" + + realm = var.realm + client_id = "grafana" + client_name = "Grafana" + client_secret = var.grafana_secret + description = "https://grafana.tobiasmanske.de" + admin_role_name = "serveradmin" + + root_url = "https://grafana.tobiasmanske.de" + admin_url = "https://grafana.tobiasmanske.de" + base_url = "https://grafana.tobiasmanske.de" + valid_redirect_uris = ["https://grafana.tobiasmanske.de/*"] + web_origins = ["https://grafana.tobiasmanske.de"] +} + +resource "keycloak_openid_group_membership_protocol_mapper" "grafana-membership-mapper" { + realm_id = module.grafanaclient.realm.id + client_id = module.grafanaclient.client.id + + name = "Group Mapper" + claim_name = "groups" + full_path = false + add_to_userinfo = true + add_to_access_token = false + add_to_id_token = true +} + +resource "keycloak_openid_user_property_protocol_mapper" "grafana-username-mapper" { + realm_id = module.grafanaclient.realm.id + client_id = module.grafanaclient.client.id + + name = "username" + user_property = "username" + claim_name = "preferred_username" + add_to_userinfo = true + add_to_access_token = true + add_to_id_token = false +} + +resource "keycloak_openid_user_client_role_protocol_mapper" "grafana-role-mapper" { + realm_id = module.grafanaclient.realm.id + client_id = module.grafanaclient.client.id + multivalued = true + name = "user-client-role-mapper" + claim_name = "resource_access.$${client_id}.roles" + add_to_userinfo = true + add_to_access_token = true + add_to_id_token = false +} + +resource "keycloak_role" "grafana-admin" { + realm_id = module.grafanaclient.realm.id + client_id = module.grafanaclient.client.id + name = "admin" + description = "Admin" +} +resource "keycloak_role" "grafana-editor" { + realm_id = module.grafanaclient.realm.id + client_id = module.grafanaclient.client.id + name = "editor" + description = "Editor" +} +resource "keycloak_role" "grafana-viewer" { + realm_id = module.grafanaclient.realm.id + client_id = module.grafanaclient.client.id + name = "viewer" + description = "Viewer" +} diff --git a/tf-stage-1/service_hedgedoc.tf b/tf-stage-1/service_hedgedoc.tf new file mode 100644 index 0000000..0c6061e --- /dev/null +++ b/tf-stage-1/service_hedgedoc.tf @@ -0,0 +1,51 @@ +module "hedgedocclient" { + source = "./modules/kc-client" + + realm = var.realm + client_id = "hedgedoc" + client_name = "hedgedoc" + client_secret = var.hedgedoc_secret + description = "doc.tobiasmanske.de" + root_url = "https://doc.tobiasmanske.de" + admin_url = "" + base_url = "" + valid_redirect_uris = ["https://doc.tobiasmanske.de/*"] + web_origins = ["https://doc.tobiasmanske.de"] +} + + +resource "keycloak_openid_user_session_note_protocol_mapper" "hedgedoc-id-mapper" { + realm_id = module.hedgedocclient.realm.id + client_id = module.hedgedocclient.client.id + name = "id" + + claim_name = "clientId" + claim_value_type = "String" + session_note = "clientId" + add_to_access_token = true + add_to_id_token = true +} + +resource "keycloak_openid_user_session_note_protocol_mapper" "hedgedoc-host-mapper" { + realm_id = module.hedgedocclient.realm.id + client_id = module.hedgedocclient.client.id + name = "host" + + claim_name = "clientHost" + claim_value_type = "String" + session_note = "clientHost" + add_to_access_token = true + add_to_id_token = true +} + +resource "keycloak_openid_user_session_note_protocol_mapper" "hedgedoc-ip-mapper" { + realm_id = module.hedgedocclient.realm.id + client_id = module.hedgedocclient.client.id + name = "ip" + + claim_name = "clientAddress" + claim_value_type = "String" + session_note = "clientAddress" + add_to_access_token = true + add_to_id_token = true +} diff --git a/tf-stage-1/service_miniflux.tf b/tf-stage-1/service_miniflux.tf new file mode 100644 index 0000000..61d6578 --- /dev/null +++ b/tf-stage-1/service_miniflux.tf @@ -0,0 +1,51 @@ +module "minifluxclient" { + source = "./modules/kc-client" + + realm = var.realm + client_id = "miniflux" + client_name = "Miniflux" + client_secret = var.miniflux_secret + description = "rss.tobiasmanske.de" + root_url = "https://rss.tobiasmanske.de" + admin_url = "" + base_url = "" + valid_redirect_uris = ["/oauth2/oidc/callback"] + web_origins = [] +} + + +resource "keycloak_openid_user_session_note_protocol_mapper" "miniflux-id-mapper" { + realm_id = module.minifluxclient.realm.id + client_id = module.minifluxclient.client.id + name = "id" + + claim_name = "clientId" + claim_value_type = "String" + session_note = "clientId" + add_to_access_token = true + add_to_id_token = true +} + +resource "keycloak_openid_user_session_note_protocol_mapper" "miniflux-host-mapper" { + realm_id = module.minifluxclient.realm.id + client_id = module.minifluxclient.client.id + name = "host" + + claim_name = "clientHost" + claim_value_type = "String" + session_note = "clientHost" + add_to_access_token = true + add_to_id_token = true +} + +resource "keycloak_openid_user_session_note_protocol_mapper" "miniflux-ip-mapper" { + realm_id = module.minifluxclient.realm.id + client_id = module.minifluxclient.client.id + name = "ip" + + claim_name = "clientAddress" + claim_value_type = "String" + session_note = "clientAddress" + add_to_access_token = true + add_to_id_token = true +} diff --git a/tf-stage-1/terraform.tfvars b/tf-stage-1/terraform.tfvars new file mode 100644 index 0000000..ef7e419 --- /dev/null +++ b/tf-stage-1/terraform.tfvars @@ -0,0 +1 @@ +realm = "tobiasmanske.de" diff --git a/tf-stage-1/user_ialistannen.tf b/tf-stage-1/user_ialistannen.tf new file mode 100644 index 0000000..c39a0ab --- /dev/null +++ b/tf-stage-1/user_ialistannen.tf @@ -0,0 +1,13 @@ +data "keycloak_user" "ialistannen" { + realm_id = data.keycloak_realm.realm.id + username = "ialistannen" +} + +resource "keycloak_user_groups" "ialistannen_groups" { + realm_id = data.keycloak_realm.realm.id + user_id = data.keycloak_user.ialistannen.id + exhaustive = false + group_ids = [ + module.hedgedocclient.access_group.id, + ] +} diff --git a/tf-stage-1/user_rad4day.tf b/tf-stage-1/user_rad4day.tf new file mode 100644 index 0000000..2269220 --- /dev/null +++ b/tf-stage-1/user_rad4day.tf @@ -0,0 +1,18 @@ +data "keycloak_user" "rad4day" { + realm_id = data.keycloak_realm.realm.id + username = "rad4day" +} + +resource "keycloak_user_groups" "rad4day_groups" { + realm_id = data.keycloak_realm.realm.id + user_id = data.keycloak_user.rad4day.id + exhaustive = false + group_ids = [ + module.giteaclient.access_group.id, + module.grafanaclient.access_group.id, + module.giteaclient.admin_group.id, + module.grafanaclient.admin_group.id, + module.hedgedocclient.access_group.id, + module.minifluxclient.access_group.id, + ] +} diff --git a/tf-stage-1/variables.tf b/tf-stage-1/variables.tf new file mode 100644 index 0000000..15bdb86 --- /dev/null +++ b/tf-stage-1/variables.tf @@ -0,0 +1,30 @@ +variable "realm" { + type = string +} + +variable "grafana_secret" { + type = string + sensitive = true +} + +variable "hedgedoc_secret" { + type = string + sensitive = true +} + +variable "miniflux_secret" { + type = string + sensitive = true +} +variable "cloudflare_api_token" { + type = string + sensitive = true +} +variable "cloudflare_account_id" { + type = string + sensitive = true +} +variable "keycloak_client_secret" { + type = string + sensitive = true +}