ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/zitadel/forgejo.tf

@@ -0,0 +1,71 @@
+locals {
+  forgejo_oidc_redirect_uri = "${trim(var.forgejo_base_url, "/")}/user/oauth2/${var.forgejo_oauth_provider_name}/callback"
+  forgejo_roles_claim       = "groups"
+
+  forgejo_zitadel_roles = {
+    forgejo_user = {
+      display_name = "Forgejo user"
+      group        = "Forgejo"
+    }
+    forgejo_admin = {
+      display_name = "Forgejo administrator"
+      group        = "Forgejo"
+    }
+    forgejo_restricted = {
+      display_name = "Forgejo restricted user"
+      group        = "Forgejo"
+    }
+  }
+
+  forgejo_zitadel_role_keys = keys(local.forgejo_zitadel_roles)
+}
+
+resource "zitadel_project_role" "forgejo" {
+  for_each = local.forgejo_zitadel_roles
+
+  org_id       = zitadel_org.primary.id
+  project_id   = zitadel_project.services.id
+  role_key     = each.key
+  display_name = each.value.display_name
+  group        = each.value.group
+}
+
+resource "zitadel_application_oidc" "forgejo" {
+  org_id                       = zitadel_org.primary.id
+  project_id                   = zitadel_project.services.id
+  name                         = "Forgejo"
+  redirect_uris                = [local.forgejo_oidc_redirect_uri]
+  response_types               = ["OIDC_RESPONSE_TYPE_CODE"]
+  grant_types                  = ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"]
+  post_logout_redirect_uris    = [trim(var.forgejo_base_url, "/")]
+  app_type                     = "OIDC_APP_TYPE_WEB"
+  auth_method_type             = "OIDC_AUTH_METHOD_TYPE_BASIC"
+  version                      = "OIDC_VERSION_1_0"
+  clock_skew                   = "0s"
+  dev_mode                     = false
+  access_token_type            = "OIDC_TOKEN_TYPE_BEARER"
+  access_token_role_assertion  = false
+  id_token_role_assertion      = true
+  id_token_userinfo_assertion  = true
+  additional_origins           = []
+  skip_native_app_success_page = false
+}
+
+resource "vault_kv_secret_v2" "forgejo_oidc" {
+  mount = var.vault_kv_mount
+  name  = var.forgejo_oidc_vault_path
+
+  data_json = jsonencode({
+    auth_name     = var.forgejo_oauth_provider_name
+    key           = zitadel_application_oidc.forgejo.client_id
+    secret        = zitadel_application_oidc.forgejo.client_secret
+    client_id     = zitadel_application_oidc.forgejo.client_id
+    client_secret = zitadel_application_oidc.forgejo.client_secret
+    discovery_url = "https://${var.zitadel_domain}/.well-known/openid-configuration"
+    roles_claim   = local.forgejo_roles_claim
+    redirect_uri  = local.forgejo_oidc_redirect_uri
+  })
+
+  # Vault is source of truth after first write. OIDC credential rotation is explicit.
+  lifecycle { ignore_changes = [data_json] }
+}