mirror of
https://github.com/2martens/terraform.git
synced 2026-10-17 14:16:52 +02:00
319 lines
9.0 KiB
Terraform
319 lines
9.0 KiB
Terraform
data "keycloak_realm" "master" {
|
|
realm = "master"
|
|
}
|
|
|
|
data "keycloak_openid_client" "master_realm_client" {
|
|
realm_id = data.keycloak_realm.master.id
|
|
client_id = "master-realm"
|
|
}
|
|
|
|
resource "keycloak_realm" "twomartens_realm" {
|
|
realm = "twomartens"
|
|
enabled = true
|
|
|
|
display_name = "2martens Applications"
|
|
display_name_html = "<div class=\"kc-logo-text\"><span>2martens</span></div>"
|
|
|
|
login_theme = "keycloak.v2"
|
|
account_theme = "keycloak.v3"
|
|
admin_theme = "keycloak.v2"
|
|
email_theme = "keycloak"
|
|
|
|
# Security settings
|
|
password_policy = "upperCase(1) and length(12) and forceExpiredPasswordChange(365) and notUsername"
|
|
|
|
# Brute force protection
|
|
security_defenses {
|
|
brute_force_detection {
|
|
max_login_failures = 5
|
|
}
|
|
|
|
headers {
|
|
content_security_policy = "frame-src 'self'; frame-ancestors 'self' http://localhost:8100 http://localhost:4200 https://wahlrecht.2martens.de; object-src 'none';"
|
|
}
|
|
}
|
|
|
|
default_signature_algorithm = "ES256"
|
|
revoke_refresh_token = true
|
|
refresh_token_max_reuse = 0
|
|
|
|
web_authn_policy {
|
|
signature_algorithms = ["ES256"]
|
|
avoid_same_authenticator_register = true
|
|
}
|
|
|
|
web_authn_passwordless_policy {
|
|
signature_algorithms = ["ES256"]
|
|
avoid_same_authenticator_register = true
|
|
}
|
|
}
|
|
|
|
resource "keycloak_openid_client" "account" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
client_id = "account"
|
|
access_type = "PUBLIC"
|
|
name = "$${client_account}"
|
|
root_url = "$${authBaseUrl}"
|
|
base_url = "/realms/twomartens/account/"
|
|
valid_redirect_uris = [
|
|
"/realms/twomartens/account/*"
|
|
]
|
|
valid_post_logout_redirect_uris = [
|
|
"+"
|
|
]
|
|
standard_flow_enabled = true
|
|
backchannel_logout_session_required = true
|
|
full_scope_allowed = false
|
|
use_refresh_tokens = false
|
|
}
|
|
|
|
resource "keycloak_role" "account_view_profile" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
client_id = keycloak_openid_client.account.id
|
|
name = "view-profile"
|
|
}
|
|
|
|
resource "keycloak_oidc_identity_provider" "twomartens_github_identity_provider" {
|
|
realm = keycloak_realm.twomartens_realm.id
|
|
alias = "github"
|
|
display_name = "GitHub"
|
|
provider_id = "github"
|
|
|
|
# OAuth App Configuration
|
|
client_id = var.github_identity_provider_client_id
|
|
client_secret = var.github_identity_provider_client_secret
|
|
|
|
# OAuth Endpoints
|
|
authorization_url = "https://github.com/login/oauth/authorize"
|
|
token_url = "https://github.com/login/oauth/access_token"
|
|
|
|
# Detailed User Mapping
|
|
extra_config = {
|
|
"clientAuthMethod" = "client_secret_post"
|
|
}
|
|
|
|
# Scopes and Sync Settings
|
|
sync_mode = "IMPORT"
|
|
|
|
# Logout and UI Settings
|
|
ui_locales = true
|
|
}
|
|
|
|
resource "keycloak_openid_client_scope" "groups_scope" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
name = "groups"
|
|
}
|
|
|
|
resource "keycloak_openid_group_membership_protocol_mapper" "group_membership_mapper" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
client_scope_id = keycloak_openid_client_scope.groups_scope.id
|
|
name = "group-membership-mapper"
|
|
|
|
claim_name = "groups"
|
|
full_path = false
|
|
}
|
|
|
|
# from here clients
|
|
|
|
resource "keycloak_openid_client" "twomartens_gitea" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
name = "Gitea"
|
|
enabled = true
|
|
access_type = "CONFIDENTIAL"
|
|
client_id = "gitea"
|
|
client_secret = var.gitea_client_secret
|
|
standard_flow_enabled = true
|
|
use_refresh_tokens = false
|
|
full_scope_allowed = false
|
|
|
|
|
|
consent_required = true
|
|
base_url = "https://git.2martens.de"
|
|
valid_redirect_uris = [
|
|
"https://git.2martens.de/user/oauth2/keycloak/callback"
|
|
]
|
|
}
|
|
|
|
resource "keycloak_openid_client" "twomartens_nextcloud" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
name = "cloud.2martens.de"
|
|
enabled = true
|
|
access_type = "CONFIDENTIAL"
|
|
client_id = "nextcloud"
|
|
client_secret = var.nextcloud_client_secret
|
|
standard_flow_enabled = true
|
|
use_refresh_tokens = true
|
|
full_scope_allowed = false
|
|
|
|
|
|
consent_required = true
|
|
base_url = "https://cloud.2martens.de"
|
|
valid_redirect_uris = [
|
|
"https://cloud.2martens.de/index.php/apps/sociallogin/custom_oidc/keycloak"
|
|
]
|
|
valid_post_logout_redirect_uris = [
|
|
"https://cloud.2martens.de"
|
|
]
|
|
web_origins = [
|
|
"https://cloud.2martens.de/*"
|
|
]
|
|
}
|
|
|
|
resource "keycloak_openid_client" "twomartens_timetable_frontend" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
name = "Timetable Frontend"
|
|
enabled = true
|
|
access_type = "PUBLIC"
|
|
client_id = "tsw-timetable-frontend"
|
|
standard_flow_enabled = true
|
|
use_refresh_tokens = false
|
|
full_scope_allowed = false
|
|
pkce_code_challenge_method = "S256"
|
|
|
|
valid_redirect_uris = [
|
|
"http://localhost:8100/*",
|
|
"https://timetable.2martens.de/*"
|
|
]
|
|
web_origins = [
|
|
"+"
|
|
]
|
|
}
|
|
|
|
resource "keycloak_generic_role_mapper" "timetable_frontend_view_profile" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
client_id = keycloak_openid_client.twomartens_timetable_frontend.id
|
|
role_id = keycloak_role.account_view_profile.id
|
|
}
|
|
|
|
resource "keycloak_openid_client" "twomartens_wahlrecht_frontend" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
name = "Wahlrecht Frontend"
|
|
enabled = true
|
|
access_type = "PUBLIC"
|
|
client_id = "wahlrecht-frontend"
|
|
standard_flow_enabled = true
|
|
use_refresh_tokens = false
|
|
full_scope_allowed = false
|
|
|
|
valid_redirect_uris = [
|
|
"http://localhost:4200/*",
|
|
"https://wahlrecht.2martens.de/*"
|
|
]
|
|
web_origins = [
|
|
"+"
|
|
]
|
|
}
|
|
|
|
resource "keycloak_openid_client" "twomartens_wahlrecht_backend" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
name = "Wahlrecht Backend"
|
|
enabled = true
|
|
access_type = "CONFIDENTIAL"
|
|
client_id = "wahlrecht"
|
|
standard_flow_enabled = true
|
|
use_refresh_tokens = false
|
|
full_scope_allowed = false
|
|
|
|
valid_redirect_uris = [
|
|
"http://localhost:12000/*",
|
|
"https://api.2martens.de/wahlrecht/*"
|
|
]
|
|
web_origins = [
|
|
"+"
|
|
]
|
|
}
|
|
|
|
# from here ArgoCD
|
|
|
|
resource "keycloak_group" "argocd_admins" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
name = "ArgoCDAdmins"
|
|
}
|
|
|
|
resource "keycloak_openid_client" "twomartens_argocd_test" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
name = "ArgoCD Test Cluster"
|
|
enabled = true
|
|
access_type = "CONFIDENTIAL"
|
|
client_id = "argocd-test-oauth"
|
|
standard_flow_enabled = true
|
|
use_refresh_tokens = false
|
|
full_scope_allowed = false
|
|
|
|
valid_redirect_uris = [
|
|
"https://argocd.k8s.test.2martens.de/auth/callback"
|
|
]
|
|
web_origins = [
|
|
"+"
|
|
]
|
|
}
|
|
|
|
resource "keycloak_openid_client_optional_scopes" "argocd_test_optional_scopes" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
client_id = keycloak_openid_client.twomartens_argocd_test.id
|
|
|
|
optional_scopes = [
|
|
keycloak_openid_client_scope.groups_scope.name
|
|
]
|
|
}
|
|
|
|
resource "keycloak_openid_client" "twomartens_argocd_monitoring" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
name = "ArgoCD Monitoring Cluster"
|
|
enabled = true
|
|
access_type = "CONFIDENTIAL"
|
|
client_id = "argocd-monitoring-oauth"
|
|
standard_flow_enabled = true
|
|
use_refresh_tokens = false
|
|
full_scope_allowed = false
|
|
|
|
valid_redirect_uris = [
|
|
"https://argocd.k8s.monitoring.2martens.de/auth/callback"
|
|
]
|
|
web_origins = [
|
|
"+"
|
|
]
|
|
}
|
|
|
|
resource "keycloak_openid_client_optional_scopes" "argocd_monitoring_optional_scopes" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
client_id = keycloak_openid_client.twomartens_argocd_monitoring.id
|
|
|
|
optional_scopes = [
|
|
keycloak_openid_client_scope.groups_scope.name
|
|
]
|
|
}
|
|
|
|
# from here Grafana
|
|
|
|
resource "keycloak_openid_client" "twomartens_grafana_monitoring" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
name = "Grafana Monitoring Cluster"
|
|
enabled = true
|
|
access_type = "PUBLIC"
|
|
client_id = "grafana-oauth"
|
|
standard_flow_enabled = true
|
|
use_refresh_tokens = true
|
|
full_scope_allowed = false
|
|
pkce_code_challenge_method = "S256"
|
|
|
|
valid_redirect_uris = [
|
|
"https://grafana.k8s.monitoring.2martens.de/login/generic_oauth"
|
|
]
|
|
web_origins = [
|
|
"+"
|
|
]
|
|
}
|
|
|
|
resource "keycloak_role" "grafana_admin" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
client_id = keycloak_openid_client.twomartens_grafana_monitoring.id
|
|
name = "admin"
|
|
}
|
|
|
|
resource "keycloak_role" "grafana_editor" {
|
|
realm_id = keycloak_realm.twomartens_realm.id
|
|
client_id = keycloak_openid_client.twomartens_grafana_monitoring.id
|
|
name = "editor"
|
|
}
|