many things

2025-02-19 10:59:18 +00:00 · 2025-02-19 10:59:18 +00:00 · d908078ee6
commit d908078ee6
parent 846fca77c1
51 changed files with 4649 additions and 276 deletions
--- a/authentik/chat.tf
+++ b/authentik/chat.tf
@ -1,50 +1,56 @@
-#resource "random_id" "chat_client_id" {
-#  byte_length = 16
-#}
-#
-#resource "authentik_provider_oauth2" "chat" {
-#  name = "Chat"
-#  #  Required. You can use the output of:
-#  #     $ openssl rand -hex 16
-#  client_id = random_id.chat_client_id.id
-#
-#  # Optional: will be generated if not provided
-#  # client_secret = "my_client_secret"
-#
-#  authorization_flow = data.authentik_flow.default-provider-authorization-implicit-consent.id
-#
-#  redirect_uris = [
-#    "https://chat.lab.cowley.tech/oauth/oidc/callback"
-#  ]
-#  property_mappings = [
-#    data.authentik_scope_mapping.scope-openid.id,
-#    data.authentik_scope_mapping.scope-email.id,
-#    data.authentik_scope_mapping.scope-profile.id,
-#  ]
-#  lifecycle {
-#    ignore_changes = [
-#      signing_key,
-#      authentication_flow,
-#    ]
-#  }
-#}
-#
-#resource "authentik_application" "chat" {
-#  name              = "Chat"
-#  slug              = "chat"
-#  protocol_provider = authentik_provider_oauth2.chat.id
-#}
-#
-#resource "kubernetes_secret" "chat" {
-#  metadata {
-#    name      = "open-webui-authentik"
-#    namespace = "ollama"
-#  }
-#  data = {
-#    OAUTH_CLIENT_ID     = authentik_provider_oauth2.chat.client_id
-#    OAUTH_CLIENT_SECRET = authentik_provider_oauth2.chat.client_secret
-#    OPENID_PROVIDER_URL = "https://auth.lab.cowley.tech/application/o/chat/.well-known/openid-configuration"
-#    OAUTH_PROVIDER_NAME = "Authentik"
-#    OAUTH_SCOPES        = "openid email profile"
-#  }
-#}
+
+resource "random_id" "chat_client_id" {
+  byte_length = 16
+}
+resource "random_id" "chat_secret_key" {
+  byte_length = 16
+}
+resource "authentik_provider_oauth2" "chat" {
+  name = "Chat"
+
+  client_id           = random_id.chat_client_id.id
+  authentication_flow = data.authentik_flow.default-authentication-flow.id
+  authorization_flow  = data.authentik_flow.default-provider-authorization-implicit-consent.id
+  invalidation_flow   = data.authentik_flow.default-invalidation-flow.id
+
+  allowed_redirect_uris = [
+    {
+      "matching_mode" = "strict"
+      "url"           = "https://chat.lab.cowley.tech/oauth/oidc/callback"
+    }
+  ]
+
+  property_mappings = [
+
+    data.authentik_property_mapping_provider_scope.scope-openid.id,
+    data.authentik_property_mapping_provider_scope.scope-email.id,
+    data.authentik_property_mapping_provider_scope.scope-profile.id,
+  ]
+  lifecycle {
+    ignore_changes = [
+      signing_key,
+      authentication_flow,
+    ]
+  }
+
+}
+
+resource "authentik_application" "chat" {
+  name              = "Chat"
+  slug              = "chat"
+  protocol_provider = authentik_provider_oauth2.chat.id
+  meta_launch_url   = "https://chat.lab.cowley.tech"
+}
+
+resource "kubernetes_secret" "chat" {
+  metadata {
+    name      = "open-webui-authentik"
+    namespace = "ollama"
+  }
+  data = {
+    OAUTH_CLIENT_ID     = authentik_provider_oauth2.chat.client_id
+    OAUTH_CLIENT_SECRET = authentik_provider_oauth2.chat.client_secret
+    OPENID_PROVIDER_URL = "https://auth.lab.cowley.tech/application/o/chat/.well-known/openid-configuration"
+    WEBUI_SECRET_KEY    = random_id.chat_secret_key.hex
+  }
+}