141 lines
5.5 KiB
HCL
141 lines
5.5 KiB
HCL
# Scopes
|
|
data "authentik_property_mapping_provider_scope" "openid" {
|
|
scope_name = "openid"
|
|
}
|
|
|
|
data "authentik_property_mapping_provider_scope" "email" {
|
|
scope_name = "email"
|
|
}
|
|
|
|
data "authentik_property_mapping_provider_scope" "profile" {
|
|
scope_name = "profile"
|
|
}
|
|
|
|
# 1. Argo CD
|
|
resource "authentik_provider_oauth2" "argocd" {
|
|
name = "Argo CD"
|
|
client_id = "argocd-client-id"
|
|
client_secret = "SnarfNetArgoCDPermanentSecret2026"
|
|
authorization_flow = var.default_authorization_flow_uuid
|
|
invalidation_flow = var.default_invalidation_flow_uuid
|
|
signing_key = var.default_signing_key_uuid
|
|
redirect_uris = ["https://argo.snarfnet.net/auth/callback"]
|
|
property_mappings = [
|
|
data.authentik_property_mapping_provider_scope.openid.id,
|
|
data.authentik_property_mapping_provider_scope.email.id,
|
|
data.authentik_property_mapping_provider_scope.profile.id,
|
|
]
|
|
}
|
|
|
|
# 2. Gitea
|
|
resource "authentik_provider_oauth2" "gitea" {
|
|
name = "Gitea"
|
|
client_id = "gitea-client-id"
|
|
client_secret = "SnarfNetGiteaPermanentSecret2026"
|
|
authorization_flow = var.default_authorization_flow_uuid
|
|
invalidation_flow = var.default_invalidation_flow_uuid
|
|
signing_key = var.default_signing_key_uuid
|
|
redirect_uris = ["https://git.snarfnet.net/user/oauth2/authentik/callback"]
|
|
property_mappings = [
|
|
data.authentik_property_mapping_provider_scope.openid.id,
|
|
data.authentik_property_mapping_provider_scope.email.id,
|
|
data.authentik_property_mapping_provider_scope.profile.id,
|
|
]
|
|
}
|
|
|
|
# 3. AWX
|
|
resource "authentik_provider_oauth2" "awx" {
|
|
name = "AWX Automation"
|
|
client_id = "awx-client-id"
|
|
client_secret = "SnarfNetAWXPermanentSecret2026"
|
|
authorization_flow = var.default_authorization_flow_uuid
|
|
invalidation_flow = var.default_invalidation_flow_uuid
|
|
signing_key = var.default_signing_key_uuid
|
|
redirect_uris = ["https://awx.snarfnet.net/sso/complete/authentik/"]
|
|
property_mappings = [
|
|
data.authentik_property_mapping_provider_scope.openid.id,
|
|
data.authentik_property_mapping_provider_scope.email.id,
|
|
data.authentik_property_mapping_provider_scope.profile.id,
|
|
]
|
|
}
|
|
|
|
# 4. Grafana
|
|
resource "authentik_provider_oauth2" "grafana" {
|
|
name = "Grafana Monitoring"
|
|
client_id = "grafana-client-id"
|
|
client_secret = "SnarfNetGrafanaPermanentSecret2026"
|
|
authorization_flow = var.default_authorization_flow_uuid
|
|
invalidation_flow = var.default_invalidation_flow_uuid
|
|
signing_key = var.default_signing_key_uuid
|
|
redirect_uris = ["https://grafana.snarfnet.net/login/generic_oauth"]
|
|
property_mappings = [
|
|
data.authentik_provider_mapping_provider_scope.openid.id,
|
|
data.authentik_property_mapping_provider_scope.email.id,
|
|
data.authentik_property_mapping_provider_scope.profile.id,
|
|
]
|
|
}
|
|
|
|
# 5. Zabbix
|
|
resource "authentik_provider_oauth2" "zabbix" {
|
|
name = "Zabbix Monitoring"
|
|
client_id = "zabbix-client-id"
|
|
client_secret = "SnarfNetZabbixPermanentSecret2026"
|
|
authorization_flow = var.default_authorization_flow_uuid
|
|
invalidation_flow = var.default_invalidation_flow_uuid
|
|
signing_key = var.default_signing_key_uuid
|
|
redirect_uris = ["https://zabbix.snarfnet.net/index_sso.php"]
|
|
property_mappings = [
|
|
data.authentik_property_mapping_provider_scope.openid.id,
|
|
data.authentik_property_mapping_provider_scope.email.id,
|
|
data.authentik_property_mapping_provider_scope.profile.id,
|
|
]
|
|
}
|
|
|
|
# 6. Coder Workspaces
|
|
resource "authentik_provider_oauth2" "coder" {
|
|
name = "Coder Workspaces"
|
|
client_id = "coder-client-id"
|
|
client_secret = "SnarfNetCoderPermanentSecret2026"
|
|
authorization_flow = var.default_authorization_flow_uuid
|
|
invalidation_flow = var.default_invalidation_flow_uuid
|
|
signing_key = var.default_signing_key_uuid
|
|
redirect_uris = ["https://coder.snarfnet.net/api/v2/users/oidc/callback"]
|
|
property_mappings = [
|
|
data.authentik_property_mapping_provider_scope.openid.id,
|
|
data.authentik_property_mapping_provider_scope.email.id,
|
|
data.authentik_property_mapping_provider_scope.profile.id,
|
|
]
|
|
}
|
|
|
|
# 7. Semaphore UI
|
|
resource "authentik_provider_oauth2" "semaphore" {
|
|
name = "Semaphore UI"
|
|
client_id = "semaphore-client-id"
|
|
client_secret = "SnarfNetSemaphorePermanentSecret2026"
|
|
authorization_flow = var.default_authorization_flow_uuid
|
|
invalidation_flow = var.default_invalidation_flow_uuid
|
|
signing_key = var.default_signing_key_uuid
|
|
redirect_uris = ["https://semaphore.snarfnet.net/api/auth/oidc/authentik/redirect"]
|
|
property_mappings = [
|
|
data.authentik_property_mapping_provider_scope.openid.id,
|
|
data.authentik_property_mapping_provider_scope.email.id,
|
|
data.authentik_property_mapping_provider_scope.profile.id,
|
|
]
|
|
}
|
|
|
|
# 8. Synology DSM
|
|
resource "authentik_provider_oauth2" "synology" {
|
|
name = "Synology DSM"
|
|
client_id = "synology-client-id"
|
|
client_secret = "SnarfNetSynologyPermanentSecret2026"
|
|
authorization_flow = var.default_authorization_flow_uuid
|
|
invalidation_flow = var.default_invalidation_flow_uuid
|
|
signing_key = var.default_signing_key_uuid
|
|
redirect_uris = ["https://nas.snarfnet.net/entry.cgi", "https://snarfnas.snarfnet.net/entry.cgi"]
|
|
property_mappings = [
|
|
data.authentik_property_mapping_provider_scope.openid.id,
|
|
data.authentik_property_mapping_provider_scope.email.id,
|
|
data.authentik_property_mapping_provider_scope.profile.id,
|
|
]
|
|
}
|