panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
45 lines
1.8 KiB
YAML
45 lines
1.8 KiB
YAML
---
|
|
# OIDC auth via Authelia — human login (bao login -method=oidc / UI).
|
|
# The Authelia 'openbao' client must already exist (authelia/values.yaml).
|
|
|
|
- name: Assert the OIDC client secret is provided
|
|
ansible.builtin.assert:
|
|
that:
|
|
- openbao_oidc_client_secret | length > 0
|
|
fail_msg: "Set vault_openbao_oidc_client_secret (plaintext of the Authelia openbao client)."
|
|
|
|
- name: Enable the OIDC auth method
|
|
ansible.builtin.command: "bao auth enable -path=oidc oidc"
|
|
environment: "{{ openbao_cli_env }}"
|
|
register: oidc_enable
|
|
changed_when: oidc_enable.rc == 0
|
|
failed_when:
|
|
- oidc_enable.rc != 0
|
|
- "'already in use' not in (oidc_enable.stderr | default('')) + (oidc_enable.stdout | default(''))"
|
|
no_log: "{{ openbao_no_log }}"
|
|
# Terraform owns this (../terraform). See openbao_config_managed_by_terraform.
|
|
when: not openbao_config_managed_by_terraform | bool
|
|
|
|
- name: Configure the OIDC provider (Authelia)
|
|
ansible.builtin.command: >-
|
|
bao write auth/oidc/config
|
|
oidc_discovery_url={{ openbao_oidc_discovery_url }}
|
|
oidc_client_id={{ openbao_oidc_client_id }}
|
|
oidc_client_secret={{ openbao_oidc_client_secret }}
|
|
default_role={{ openbao_oidc_default_role }}
|
|
environment: "{{ openbao_cli_env }}"
|
|
register: oidc_config
|
|
changed_when: oidc_config.rc == 0
|
|
no_log: true # carries the client secret — always hidden
|
|
|
|
- name: Create/update the admin OIDC role (restricted to the admin AD group)
|
|
ansible.builtin.command: "bao write auth/oidc/role/{{ openbao_oidc_default_role }} -"
|
|
args:
|
|
stdin: "{{ lookup('template', 'oidc-admin-role.json.j2') }}"
|
|
environment: "{{ openbao_cli_env }}"
|
|
register: oidc_role
|
|
changed_when: oidc_role.rc == 0
|
|
no_log: "{{ openbao_no_log }}"
|
|
# Terraform owns this (../terraform). See openbao_config_managed_by_terraform.
|
|
when: not openbao_config_managed_by_terraform | bool
|