71 lines
2.6 KiB
Terraform
71 lines
2.6 KiB
Terraform
|
locals {
|
||
|
|
forgejo_oidc_redirect_uri = "${trim(var.forgejo_base_url, "/")}/user/oauth2/${var.forgejo_oauth_provider_name}/callback"
|
||
|
|
forgejo_roles_claim = "groups"
|
||
|
|
|
||
|
|
forgejo_zitadel_roles = {
|
||
|
|
forgejo_user = {
|
||
|
|
display_name = "Forgejo user"
|
||
|
|
group = "Forgejo"
|
||
|
|
}
|
||
|
|
forgejo_admin = {
|
||
|
|
display_name = "Forgejo administrator"
|
||
|
|
group = "Forgejo"
|
||
|
|
}
|
||
|
|
forgejo_restricted = {
|
||
|
|
display_name = "Forgejo restricted user"
|
||
|
|
group = "Forgejo"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
forgejo_zitadel_role_keys = keys(local.forgejo_zitadel_roles)
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "zitadel_project_role" "forgejo" {
|
||
|
|
for_each = local.forgejo_zitadel_roles
|
||
|
|
|
||
|
|
org_id = zitadel_org.primary.id
|
||
|
|
project_id = zitadel_project.services.id
|
||
|
|
role_key = each.key
|
||
|
|
display_name = each.value.display_name
|
||
|
|
group = each.value.group
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "zitadel_application_oidc" "forgejo" {
|
||
|
|
org_id = zitadel_org.primary.id
|
||
|
|
project_id = zitadel_project.services.id
|
||
|
|
name = "Forgejo"
|
||
|
|
redirect_uris = [local.forgejo_oidc_redirect_uri]
|
||
|
|
response_types = ["OIDC_RESPONSE_TYPE_CODE"]
|
||
|
|
grant_types = ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"]
|
||
|
|
post_logout_redirect_uris = [trim(var.forgejo_base_url, "/")]
|
||
|
|
app_type = "OIDC_APP_TYPE_WEB"
|
||
|
|
auth_method_type = "OIDC_AUTH_METHOD_TYPE_BASIC"
|
||
|
|
version = "OIDC_VERSION_1_0"
|
||
|
|
clock_skew = "0s"
|
||
|
|
dev_mode = false
|
||
|
|
access_token_type = "OIDC_TOKEN_TYPE_BEARER"
|
||
|
|
access_token_role_assertion = false
|
||
|
|
id_token_role_assertion = true
|
||
|
|
id_token_userinfo_assertion = true
|
||
|
|
additional_origins = []
|
||
|
|
skip_native_app_success_page = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "forgejo_oidc" {
|
||
|
|
mount = var.vault_kv_mount
|
||
|
|
name = var.forgejo_oidc_vault_path
|
||
|
|
|
||
|
|
data_json = jsonencode({
|
||
|
|
auth_name = var.forgejo_oauth_provider_name
|
||
|
|
key = zitadel_application_oidc.forgejo.client_id
|
||
|
|
secret = zitadel_application_oidc.forgejo.client_secret
|
||
|
|
client_id = zitadel_application_oidc.forgejo.client_id
|
||
|
|
client_secret = zitadel_application_oidc.forgejo.client_secret
|
||
|
|
discovery_url = "https://${var.zitadel_domain}/.well-known/openid-configuration"
|
||
|
|
roles_claim = local.forgejo_roles_claim
|
||
|
|
redirect_uri = local.forgejo_oidc_redirect_uri
|
||
|
|
})
|
||
|
|
|
||
|
|
# Vault is source of truth after first write. OIDC credential rotation is explicit.
|
||
|
|
lifecycle { ignore_changes = [data_json] }
|
||
|
|
}
|