vynil/domain
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix

Browse Source
This commit is contained in:
Sébastien Huss
2023-09-20 14:12:55 +02:00
parent 2b93be7324
commit 287b4b8caa
6 changed files with 453 additions and 423 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
apps/gitea/ldap.tf
View File

@@ -1,5 +1,7 @@
locals {
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
main-group = format("app-%s", local.app-name)
base-dn = format("dc=%s", join(",dc=", split(".", format("%s.%s", var.sub-domain, var.domain-name))))
base-group-dn = format("ou=groups,%s", local.base-dn)
base-user-dn = format("ou=users,%s", local.base-dn)
@@ -87,7 +89,8 @@ resource "authentik_application" "gitea_application" {
}
resource "authentik_group" "gitea_users" {
name = "gitea_users"
name = local.main-group
attributes = jsonencode({"${local.app-name}" = true})
}
data "authentik_group" "vynil-admin" {
@@ -96,13 +99,22 @@ data "authentik_group" "vynil-admin" {
}
resource "authentik_group" "gitea_admin" {
name = "gitea_admin"
name = format("admin-%s", local.app-name)
parent = authentik_group.gitea_users.id
attributes = jsonencode({"${local.app-name}" = true})
}
resource "authentik_policy_expression" "policy" {
name = local.main-group
expression = <<-EOF
attr = request.user.group_attributes()
return attr['${local.app-name}'] if '${local.app-name}' in attr else False
EOF
}
resource "authentik_policy_binding" "gitea_access_users" {
target = authentik_application.gitea_application.uuid
group = authentik_group.gitea_users.id
policy = authentik_policy_expression.policy.id
order = 0
}
resource "authentik_policy_binding" "gitea_access_vynil" {