From 3f1df6e67c97929b321939d2da213ee7ace557a4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Huss?= Date: Wed, 20 Sep 2023 13:47:31 +0200 Subject: [PATCH] fix --- apps/code-server/forward.tf | 13 ++++++++-- apps/code-server/index.yaml | 49 ++++++++++++++++++++----------------- apps/traefik-ui/forward.tf | 13 ++++++++-- apps/traefik-ui/index.yaml | 22 ++++++++--------- 4 files changed, 59 insertions(+), 38 deletions(-) diff --git a/apps/code-server/forward.tf b/apps/code-server/forward.tf index 258c57b..7c5fe97 100644 --- a/apps/code-server/forward.tf +++ b/apps/code-server/forward.tf @@ -8,7 +8,7 @@ locals { forward-outpost-pk = jsondecode(data.http.get_forward_outpost.response_body).results[0].pk app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance) app-icon = "_static/src/browser/media/favicon-dark-support.svg" - main-group = format("%s-users", local.app-name) + main-group = format("app-%s", local.app-name) sub-groups = [] external-url = format("https://%s", local.dns-names[0]) access-token-validity = "hours=10" // ;minutes=10 @@ -68,6 +68,7 @@ resource "authentik_application" "prj_application" { resource "authentik_group" "prj_users" { name = local.main-group + attributes = jsonencode({local.app-name = true}) } resource "authentik_group" "subgroup" { @@ -76,6 +77,14 @@ resource "authentik_group" "subgroup" { parent = authentik_group.prj_users.id } +resource "authentik_policy_expression" "policy" { + name = local.main-group + expression = <<-EOF + attr = request.user.group_attributes() + return attr['${local.app-name}'] if '${local.app-name}' in attr else False + EOF +} + data "authentik_group" "vynil-admin" { depends_on = [authentik_group.prj_users] # fake dependency so it is not evaluated at plan stage name = "vynil-forward-admins" @@ -83,7 +92,7 @@ data "authentik_group" "vynil-admin" { resource "authentik_policy_binding" "prj_access_users" { target = authentik_application.prj_application.uuid - group = authentik_group.prj_users.id + policy = authentik_policy_expression.policy.id order = 0 } resource "authentik_policy_binding" "prj_access_vynil" { diff --git a/apps/code-server/index.yaml b/apps/code-server/index.yaml index af6110e..4e666a7 100644 --- a/apps/code-server/index.yaml +++ b/apps/code-server/index.yaml @@ -6,21 +6,11 @@ metadata: name: code-server description: null options: - ingress-class: - default: traefik + no-editor: + default: false examples: - - traefik - type: string - domain-name: - default: your_company.com - examples: - - your_company.com - type: string - timezone: - default: Europe/Paris - examples: - - Europe/Paris - type: string + - false + type: boolean storage: default: accessMode: ReadWriteOnce @@ -45,9 +35,19 @@ options: default: Filesystem enum: - Filesystem - - block + - Block type: string type: object + timezone: + default: Europe/Paris + examples: + - Europe/Paris + type: string + ingress-class: + default: traefik + examples: + - traefik + type: string domain: default: your-company examples: @@ -107,25 +107,28 @@ options: type: number type: object type: object - no-editor: - default: false + domain-name: + default: your_company.com examples: - - false - type: boolean - issuer: - default: letsencrypt-prod - examples: - - letsencrypt-prod + - your_company.com type: string sub-domain: default: code examples: - code type: string + issuer: + default: letsencrypt-prod + examples: + - letsencrypt-prod + type: string dependencies: - dist: null category: share component: authentik-forward +- dist: null + category: core + component: secret-generator providers: kubernetes: true authentik: true diff --git a/apps/traefik-ui/forward.tf b/apps/traefik-ui/forward.tf index 9a6f876..7298881 100644 --- a/apps/traefik-ui/forward.tf +++ b/apps/traefik-ui/forward.tf @@ -8,7 +8,7 @@ locals { forward-outpost-pk = jsondecode(data.http.get_forward_outpost.response_body).results[0].pk app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance) app-icon = "dashboard/statics/icons/favicon-96x96.png" - main-group = format("%s-users", local.app-name) + main-group = format("app-%s", local.app-name) sub-groups = [] access-token-validity = "minutes=10" rules-icons = [ for v in local.dns-names : { @@ -67,6 +67,7 @@ resource "authentik_application" "prj_application" { resource "authentik_group" "prj_users" { name = local.main-group + attributes = jsonencode({local.app-name = true}) } resource "authentik_group" "subgroup" { @@ -75,6 +76,14 @@ resource "authentik_group" "subgroup" { parent = authentik_group.prj_users.id } +resource "authentik_policy_expression" "policy" { + name = local.main-group + expression = <<-EOF + attr = request.user.group_attributes() + return attr['${local.app-name}'] if '${local.app-name}' in attr else False + EOF +} + data "authentik_group" "vynil-admin" { depends_on = [authentik_group.prj_users] # fake dependency so it is not evaluated at plan stage name = "vynil-forward-admins" @@ -82,7 +91,7 @@ data "authentik_group" "vynil-admin" { resource "authentik_policy_binding" "prj_access_users" { target = authentik_application.prj_application.uuid - group = authentik_group.prj_users.id + policy = authentik_policy_expression.policy.id order = 0 } resource "authentik_policy_binding" "prj_access_vynil" { diff --git a/apps/traefik-ui/index.yaml b/apps/traefik-ui/index.yaml index 2e14d50..e0909a8 100644 --- a/apps/traefik-ui/index.yaml +++ b/apps/traefik-ui/index.yaml @@ -6,31 +6,31 @@ metadata: name: traefik-ui description: Access to the Traefik UI options: - ingress-class: - default: traefik + issuer: + default: letsencrypt-prod examples: - - traefik - type: string - sub-domain: - default: traefik - examples: - - traefik + - letsencrypt-prod type: string domain-name: default: your_company.com examples: - your_company.com type: string - issuer: - default: letsencrypt-prod + ingress-class: + default: traefik examples: - - letsencrypt-prod + - traefik type: string domain: default: your-company examples: - your-company type: string + sub-domain: + default: traefik + examples: + - traefik + type: string dependencies: - dist: null category: share