RnD/infra
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
33a794e35df8caa7aad6e3d7ed2c89c630fddc85
infra/cloud/.env.example
R de Ren 33a794e35d feat(sso): wire Keycloak SSO end-to-end across all apps 
New stack:
- stacks/oauth2-proxy/ — per-app sidecars (mlflow, portainer, rabbitmq)
  that gate vhosts via nginx auth_request against Keycloak's wbd realm.

Native OIDC wired into:
- grafana       (generic_oauth, role-attribute-path → Admin/Editor/Viewer)
- jupyterhub    (oauthenticator.GenericOAuthenticator)
- node-red      (passport-openidconnect; in-memory state store + users()
                 resolver because adminAuth doesn't expose req.session)
- jenkins       (oic-auth plugin via JCasC; matrix-auth for authz; setup
                 wizard suppressed; custom image with plugins.txt)

Infra fixes uncovered while bringing the above online:
- nginx-proxy: bump proxy_buffer_size to 16k so oauth2-proxy callbacks
  don't 502 on the JWT-bearing Set-Cookie header.
- nginx-proxy: add `resolver 127.0.0.11 valid=30s` so service names
  re-resolve after sidecar recreates (was cross-wiring oauth2-proxy
  upstreams after restart).
- jupyterhub: pass --allow-root to the singleuser spawner (hub runs as
  root inside its container; jupyter-server refused root without flag).
- jupyterhub Dockerfile: install jupyterlab + notebook so
  SimpleLocalProcessSpawner has something to launch.
- node-red Dockerfile: install passport-openidconnect into the image
  so settings.js can require() it.
- portainer: pre-seed local admin via --admin-password=<bcrypt-hash>
  so the 5-minute "no admin → lockout" timer can never trigger.
- deploy.sh: restore executable bit (was 644 in repo).

Admin/viewer policy:
- Created realm role `app-admin` in keycloak wbd realm.
- Grafana maps app-admin → Admin (default Viewer).
- Jenkins matrix-auth grants r.de.ren Overall/Administer, authenticated
  users get Overall/Read + Job/Read + View/Read.
- Node-RED: NODERED_ADMIN_USERS env list → permissions "*", others
  ["read"]. (TODO: switch to app-admin realm role.)
- JupyterHub: JUPYTERHUB_ADMIN_USERS env list. (Same TODO.)
- Gitea: r.de.ren pre-created as local admin; OIDC auto-links via email.

Docs:
- README, cloud/README, stacks/oauth2-proxy/README, and per-stack
  READMEs updated to reflect the new state and remove resolved TODOs.
- cloud/.env.example gains all the new OIDC client + cookie-secret keys.
- cloud/README documents the full kcadm realm bootstrap, including the
  hardcoded-audience mapper and post-logout redirect URIs that are
  non-obvious gotchas.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-21 18:34:37 +00:00

126 lines
4.6 KiB
Plaintext
Raw Blame History

# Aggregated env for the cloud composition.
# Copy to .env and fill in real values. Never commit .env.
TZ=Europe/Amsterdam
# Domain / TLS
PRIMARY_DOMAIN=wbd-rd.nl
LETSENCRYPT_EMAIL=r.de.ren@brabantsedelta.nl
# Production CA: https://acme-v02.api.letsencrypt.org/directory
# Staging CA (testing): https://acme-staging-v02.api.letsencrypt.org/directory
ACME_CA_URI=https://acme-v02.api.letsencrypt.org/directory
# WireGuard server
WG_SERVER_PORT=51820
WG_SERVER_PUBLIC_HOST=
# Keycloak (admin bootstrap + DB). KEYCLOAK_ADMIN/_PASSWORD are the master-realm
# emergency admin — only used the first time the container starts. The wbd
# realm + per-app OIDC clients are bootstrapped via kcadm in stacks/keycloak/README.md.
KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=
KEYCLOAK_HOSTNAME=auth.wbd-rd.nl
KEYCLOAK_DB_PASSWORD=
# InfluxDB
INFLUX_ADMIN_USER=admin
INFLUX_ADMIN_PASSWORD=
INFLUX_ADMIN_TOKEN=
INFLUX_ORG=wbd
INFLUX_BUCKET=telemetry
# Grafana
GRAFANA_ADMIN_USER=admin
GRAFANA_ADMIN_PASSWORD=
GRAFANA_ROOT_URL=https://dash.wbd-rd.nl
# SQL (postgres — single point of config)
SQL_DB=config
SQL_USER=config
SQL_PASSWORD=
# RabbitMQ
RABBITMQ_USER=admin
RABBITMQ_PASSWORD=
RABBITMQ_VHOST=/
# Postfix
POSTFIX_RELAYHOST=
POSTFIX_FROM_DOMAIN=wbd-rd.nl
# Gitea (HTTPS-only; uses sql backend; OIDC via Keycloak)
GITEA_ROOT_URL=https://git.wbd-rd.nl
GITEA_DOMAIN=git.wbd-rd.nl
GITEA_DB_HOST=sql:5432
GITEA_DB_NAME=gitea
GITEA_DB_USER=gitea
GITEA_DB_PASSWORD=
GITEA_OAUTH_CLIENT_ID=gitea
GITEA_OAUTH_CLIENT_SECRET=
GITEA_OAUTH_DISCOVERY_URL=https://auth.wbd-rd.nl/realms/wbd/.well-known/openid-configuration
GITEA_MAIL_FROM=gitea@wbd-rd.nl
# Jenkins (authn via Keycloak OIDC + JCasC matrix-auth; see stacks/jenkins/config/jenkins.yaml)
JENKINS_ADMIN_USER=admin
JENKINS_ADMIN_PASSWORD=
JENKINS_OAUTH_CLIENT_ID=jenkins
JENKINS_OAUTH_CLIENT_SECRET=
JENKINS_OAUTH_DISCOVERY_URL=https://auth.wbd-rd.nl/realms/wbd/.well-known/openid-configuration
# MLflow (uses sql backend; gated by oauth2-proxy at the nginx layer)
MLFLOW_DB_NAME=mlflow
MLFLOW_DB_USER=mlflow
MLFLOW_DB_PASSWORD=
MLFLOW_OAUTH_CLIENT_ID=mlflow
MLFLOW_OAUTH_CLIENT_SECRET=
MLFLOW_OAUTH_DISCOVERY_URL=https://auth.wbd-rd.nl/realms/wbd/.well-known/openid-configuration
# JupyterHub (Keycloak OIDC via oauthenticator.GenericOAuthenticator)
# JUPYTERHUB_ADMIN_USERS: comma-separated emails of users who get the Hub admin UI.
JUPYTER_NOTEBOOK_IMAGE=jupyter/datascience-notebook:latest
JUPYTERHUB_ADMIN_USERS=
JUPYTERHUB_OAUTH_CLIENT_ID=jupyterhub
JUPYTERHUB_OAUTH_CLIENT_SECRET=
JUPYTERHUB_OAUTH_DISCOVERY_URL=https://auth.wbd-rd.nl/realms/wbd/.well-known/openid-configuration
# Node-RED (passport-openidconnect; only the editor is gated)
# NODERED_ADMIN_USERS: comma-separated usernames/emails — get permissions "*".
# Everyone else in the realm gets ["read"] (can view flows, can't deploy).
NODERED_OAUTH_CLIENT_ID=node-red
NODERED_OAUTH_CLIENT_SECRET=
NODERED_OAUTH_DISCOVERY_URL=https://auth.wbd-rd.nl/realms/wbd/.well-known/openid-configuration
NODERED_ADMIN_USERS=
# Grafana OIDC (generic_oauth → Keycloak wbd realm)
GRAFANA_OAUTH_CLIENT_ID=grafana
GRAFANA_OAUTH_CLIENT_SECRET=
GRAFANA_OAUTH_DISCOVERY_URL=https://auth.wbd-rd.nl/realms/wbd/.well-known/openid-configuration
# Portainer-CE — gated by oauth2-proxy at nginx; local admin pre-seeded via bcrypt hash.
# Generate hash with: docker run --rm python:3.13-alpine sh -c "pip install -q bcrypt;
# python -c \"import bcrypt; print(bcrypt.hashpw(b'<password>', bcrypt.gensalt()).decode())\""
# Then double every $ in the hash before pasting (compose interpolates single $).
PORTAINER_ADMIN_PASSWORD=
PORTAINER_ADMIN_PASSWORD_HASH=
PORTAINER_OAUTH_CLIENT_ID=portainer-ce
PORTAINER_OAUTH_CLIENT_SECRET=
PORTAINER_OAUTH_DISCOVERY_URL=https://auth.wbd-rd.nl/realms/wbd/.well-known/openid-configuration
# RabbitMQ management UI — gated by oauth2-proxy at nginx. Users still log into
# the RabbitMQ UI with the local broker credentials above; SSO only gates access
# to the page itself.
RABBITMQ_OAUTH_CLIENT_ID=rabbitmq
RABBITMQ_OAUTH_CLIENT_SECRET=
RABBITMQ_OAUTH_DISCOVERY_URL=https://auth.wbd-rd.nl/realms/wbd/.well-known/openid-configuration
# oauth2-proxy cookie secrets (per-app). 16, 24, or 32 raw bytes — easiest is
# 32 hex chars (i.e. `openssl rand -hex 16`). Different per app to keep cookies
# scoped and to limit blast radius if one ever leaks.
OAUTH2_PROXY_COOKIE_SECRET_MLFLOW=
OAUTH2_PROXY_COOKIE_SECRET_PORTAINER=
OAUTH2_PROXY_COOKIE_SECRET_RABBITMQ=
# FROST (SensorThings — dedicated postgis + internal mosquitto bus, ingressed at sta.wbd-rd.nl)
FROST_DB_PASSWORD=
FROST_SERVICE_ROOT_URL=https://sta.wbd-rd.nl/FROST-Server
Reference in New Issue View Git Blame Copy Permalink