Daniel Allaire
b60c5dc963
oauth2-proxy (v7.15.3) place Keycloak devant toute app sans OIDC natif (auth external, utilisateur via en-tête). Rôle paramétrable, réutilisable. Éprouvé devant icingaweb2 (backend=external, X-Forwarded-Preferred-Username). Prouvé : testmail → oauth2-proxy → Keycloak → icingaweb2 /dashboard, connecté. Ferme le gap LDAP-direct d'icingaweb2. Réglages appris : insecure_oidc_allow_unverified_email (IdP interne) ; reverse-proxy passe X-Forwarded-* pas X-Auth-Request-* ; handler nginx en restart (pas reload) — un changement d'adresse d'écoute n'est pas pris par un reload gracieux. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
70 lines
2.2 KiB
YAML
70 lines
2.2 KiB
YAML
---
|
|
- name: Exiger la configuration OIDC (client, secret, redirect, upstream, cookie)
|
|
ansible.builtin.assert:
|
|
that:
|
|
- serveur_oauth2_proxy_client_id | length > 0
|
|
- serveur_oauth2_proxy_client_secret | length > 0
|
|
- serveur_oauth2_proxy_redirect_url | length > 0
|
|
- serveur_oauth2_proxy_upstream | length > 0
|
|
- serveur_oauth2_proxy_cookie_secret | length > 0
|
|
fail_msg: "client_id, client_secret (voûte), redirect_url, upstream et cookie_secret (voûte) requis."
|
|
|
|
- name: Créer l'utilisateur système oauth2-proxy
|
|
ansible.builtin.user:
|
|
name: "{{ serveur_oauth2_proxy_utilisateur }}"
|
|
system: true
|
|
shell: /usr/sbin/nologin
|
|
create_home: false
|
|
|
|
- name: Télécharger oauth2-proxy
|
|
ansible.builtin.get_url:
|
|
url: "{{ serveur_oauth2_proxy_url }}"
|
|
dest: "/tmp/oauth2-proxy-{{ serveur_oauth2_proxy_version }}.tar.gz"
|
|
mode: "0644"
|
|
|
|
- name: Extraire le binaire oauth2-proxy
|
|
ansible.builtin.unarchive:
|
|
src: "/tmp/oauth2-proxy-{{ serveur_oauth2_proxy_version }}.tar.gz"
|
|
dest: /usr/local/bin
|
|
remote_src: true
|
|
extra_opts: ["--strip-components=1", "--wildcards", "*/oauth2-proxy"]
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
creates: "{{ serveur_oauth2_proxy_binaire }}"
|
|
notify: Redémarrer oauth2-proxy
|
|
|
|
- name: Créer le répertoire de configuration
|
|
ansible.builtin.file:
|
|
path: "{{ serveur_oauth2_proxy_config | dirname }}"
|
|
state: directory
|
|
owner: root
|
|
group: "{{ serveur_oauth2_proxy_utilisateur }}"
|
|
mode: "0750"
|
|
|
|
- name: Déployer la configuration oauth2-proxy
|
|
ansible.builtin.template:
|
|
src: oauth2-proxy.cfg.j2
|
|
dest: "{{ serveur_oauth2_proxy_config }}"
|
|
owner: root
|
|
group: "{{ serveur_oauth2_proxy_utilisateur }}"
|
|
mode: "0640"
|
|
no_log: true
|
|
notify: Redémarrer oauth2-proxy
|
|
|
|
- name: Déployer l'unité systemd oauth2-proxy
|
|
ansible.builtin.template:
|
|
src: oauth2-proxy.service.j2
|
|
dest: /etc/systemd/system/oauth2-proxy.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Redémarrer oauth2-proxy
|
|
|
|
- name: Activer et démarrer oauth2-proxy
|
|
when: not ansible_check_mode
|
|
ansible.builtin.systemd:
|
|
name: "{{ serveur_oauth2_proxy_service }}"
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|