home/kubernetes-deployments
2
0
Fork 0
Code Issues 3 Pull requests Projects Releases Packages Wiki Activity Actions

Use OIDC auth for freshrss

Browse source
This commit is contained in:
Pim Kunis 2025-02-08 13:02:59 +01:00
parent 05f020ecb3
commit 7f1505878b
4 changed files with 76 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

47
modules/authelia.nix
View file

@ -51,9 +51,52 @@
key = "smtpPassword";
path = "smtpPassword";
}
{
key = "oidc_hmac_secret";
path = "oidc_hmac_secret";
}
{
key = "oidc_jwk_rs256_private";
path = "oidc.jwk.RS256.pem";
}
{
key = "freshrss_client_secret";
path = "freshrss_client_secret";
}
];
configMap = {
identity_providers.oidc = {
enabled = true;
consent_mode = "implicit";
hmac_secret = {
secret_name = "authelia";
path = "oidc_hmac_secret";
};
jwks = [
{
algorithm = "RS256";
key.path = "/secrets/authelia/oidc.jwk.RS256.pem";
}
];
clients = [
{
client_id = "HDp48U5TaX-3gWKNEfHx5ea2C7gfaQm-OsSWREq4WTzln56IBGy.rT61lq9rF-LTZFlWOd44";
client_name = "FreshRSS";
client_secret.path = "/secrets/authelia/freshrss_client_secret";
public = false;
authorization_policy = "two_factor";
redirect_uris = ["https://rss.kun.is:443/i/oidc/"];
scopes = ["openid" "groups" "email" "profile"];
userinfo_signed_response_alg = "none";
token_endpoint_auth_method = "client_secret_basic";
}
];
};
access_control = {
default_policy = "one_factor";
@ -140,6 +183,10 @@
session = "ref+sops://secrets.yml#/authelia/encryption_keys/session";
smtpPassword = "ref+sops://secrets.yml#/authelia/smtpPassword";
users = "ref+sops://secrets.yml#/authelia/users";
oidc_hmac_secret = "ref+sops://secrets.yml#/authelia/oidc/hmac_secret";
oidc_jwk_rs256_private = "ref+sops://secrets.yml#/authelia/oidc/jwk_rs256/private";
oidc_jwk_rs256_public = "ref+sops://secrets.yml#/authelia/oidc/jwk_rs256/public";
freshrss_client_secret = "ref+sops://secrets.yml#/authelia/oidc/freshrss_client_secret";
};
};
};

19
modules/freshrss.nix
View file

@ -36,6 +36,14 @@
CRON_MIN.value = "2,32";
ADMIN_EMAIL.value = "pim@kunis.nl";
PUBLISHED_PORT.value = "443";
OIDC_ENABLED.value = "1";
OIDC_PROVIDER_METADATA_URL.value = "https://auth.kun.is/.well-known/openid-configuration";
OIDC_CLIENT_ID.value = "HDp48U5TaX-3gWKNEfHx5ea2C7gfaQm-OsSWREq4WTzln56IBGy.rT61lq9rF-LTZFlWOd44";
OIDC_CLIENT_SECRET.value = "ref+sops://secrets.yml#/authelia/oidc/freshrss_client_secret";
OIDC_CLIENT_CRYPTO_KEY.value = "ref+sops://secrets.yml#/freshrss/oidc_crypto_key";
OIDC_REMOTE_USER_CLAIM.value = "preferred_username";
OIDC_SCOPES.value = "openid groups email profile";
OIDC_X_FORWARDED_HEADERS.value = "X-Forwarded-Host X-Forwarded-Port X-Forwarded-Proto";
ADMIN_PASSWORD.valueFrom.secretKeyRef = {
name = "server";
@ -76,9 +84,20 @@
targetPort = "web";
};
};
ingresses.freshrss.metadata.annotations."traefik.ingress.kubernetes.io/router.middlewares" = "kube-system-forwardauth-authelia@kubernetescrd";
};
lab = {
ingresses.freshrss = {
host = "rss.kun.is";
service = {
name = "server";
portName = "web";
};
};
tailscaleIngresses.tailscale = {
host = "freshrss";
service.name = "server";

2
modules/tailscale-ingress.nix
View file

@ -42,7 +42,7 @@
pathType = "Prefix";
backend.service = {
name = service.name;
inherit (service) name;
port.name = service.portName;
};
}