SmokyZoneandClaude Sonnet 5
2ee46ceb4a
- Deployment/Service for the app, StatefulSet/Service for Postgres 17 - Secrets (DB password, session secret, Google client, allowed e-mails) via ExternalSecret from OpenBao - Ingress with a Let's Encrypt certificate, NetworkPolicy for Postgres - Nightly pg_dump CronJob - Optional OpenBao OIDC provider setup script Co-Authored-By: Claude Sonnet 5 <[email protected]>
59 lines
2.9 KiB
Bash
Executable File
59 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Configure OpenBao as an OpenID Connect provider for the expense tracker and store the
|
|
# resulting client credentials + CA certificate in the KV secret the chart reads.
|
|
#
|
|
# export BAO_ADDR=https://192.168.2.218:30200 BAO_SKIP_VERIFY=true BAO_TOKEN=<admin token>
|
|
# scripts/openbao-oidc.sh
|
|
#
|
|
# Prerequisites: `bao` and `kubectl` on PATH; the KV secret secret/expense-tracker/app
|
|
# already exists (see README step 1). Afterwards enable it: `auth.openbao.enabled: true`.
|
|
#
|
|
# NOTE: written against the OpenBao OIDC provider API docs; not run against a live server
|
|
# from the machine that authored it - check the output of each step.
|
|
set -euo pipefail
|
|
|
|
NAME="${NAME:-expense-tracker}"
|
|
# scheme://host:port that both browser and pod can reach; the effective issuer becomes
|
|
# <ISSUER_ADDR>/v1/identity/oidc/provider/<NAME> and must equal auth.openbao.issuer in values.yaml
|
|
ISSUER_ADDR="${ISSUER_ADDR:-https://192.168.2.218:30200}"
|
|
REDIRECT_URI="${REDIRECT_URI:-https://budget.smokyzone.de:30444/auth/callback/openbao}"
|
|
KV_MOUNT="${KV_MOUNT:-secret}"
|
|
KV_PATH="${KV_PATH:-expense-tracker/app}"
|
|
|
|
echo "1/5 signing key"
|
|
bao write "identity/oidc/key/$NAME" allowed_client_ids="*" algorithm=RS256 rotation_period=24h verification_ttl=24h
|
|
|
|
echo "2/5 scope 'email' (claim comes from the entity's metadata)"
|
|
bao write identity/oidc/scope/email template='{"email": {{identity.entity.metadata.email}}}'
|
|
|
|
echo "3/5 client"
|
|
bao write "identity/oidc/client/$NAME" redirect_uris="$REDIRECT_URI" assignments="allow_all" \
|
|
key="$NAME" id_token_ttl=30m access_token_ttl=1h
|
|
CLIENT_ID="$(bao read -field=client_id "identity/oidc/client/$NAME")"
|
|
CLIENT_SECRET="$(bao read -field=client_secret "identity/oidc/client/$NAME")"
|
|
|
|
echo "4/5 provider"
|
|
bao write "identity/oidc/provider/$NAME" issuer="$ISSUER_ADDR" allowed_client_ids="$CLIENT_ID" scopes_supported="email"
|
|
|
|
echo "5/5 store credentials + CA in $KV_MOUNT/$KV_PATH"
|
|
CA_FILE="$(mktemp)"; trap 'rm -f "$CA_FILE"' EXIT
|
|
kubectl -n openbao get secret openbao-tls -o jsonpath='{.data.ca\.crt}' | base64 -d > "$CA_FILE"
|
|
[ -s "$CA_FILE" ] || { echo "could not read the CA from secret openbao/openbao-tls" >&2; exit 1; }
|
|
bao kv patch -mount="$KV_MOUNT" "$KV_PATH" \
|
|
openbao_client_id="$CLIENT_ID" openbao_client_secret="$CLIENT_SECRET" openbao_ca_cert=@"$CA_FILE"
|
|
|
|
echo
|
|
echo "Issuer: $ISSUER_ADDR/v1/identity/oidc/provider/$NAME"
|
|
curl -sk "$ISSUER_ADDR/v1/identity/oidc/provider/$NAME/.well-known/openid-configuration" | head -c 300 || true
|
|
echo
|
|
cat <<MSG
|
|
|
|
Remaining manual steps
|
|
* The person signing in needs an OpenBao *entity* whose metadata carries their email, e.g.
|
|
bao write identity/entity name=<name> metadata=email=<address>
|
|
bao write identity/entity-alias name=<login> canonical_id=<entity id> mount_accessor=<auth mount accessor>
|
|
(or add metadata to the existing entity of the userpass/OIDC user you log in with).
|
|
* Set auth.openbao.enabled=true in values.yaml, commit and push.
|
|
* The address must also be listed in allowed_emails.
|
|
MSG
|