cluster

commit 5345ef620c00c031cec890956ae0678ce304bc83
parent ba206a0b7e7e28d0f532a64504a66e2e846b486e
Author: MTRNord <git@nordgedanken.dev>
Date:   Mon, 16 Sep 2024 13:27:31 +0000

Enable oidc on coder

Diffstat:
M
apps/2024_cluster/secrets/coder.yaml
 | 
50
+++++++++++++++++++++++++++++++++++++++++---------
M
apps/base/coder/release.yaml
 | 
22
++++++++++++++++++++++

2 files changed, 63 insertions(+), 9 deletions(-)
diff --git a/apps/2024_cluster/secrets/coder.yaml b/apps/2024_cluster/secrets/coder.yaml
@@ -5,7 +5,7 @@ metadata:
     namespace: coder
 type: Opaque
 stringData:
-    url: ENC[AES256_GCM,data:XLJ0mU1PLqDyuwQfXRTOk3u20Ykdc7Z4/Mb6NcJlyTIXvAM7pgrBzipvrekNyl9loTrWiNedD4eD4xraspylom77yTHtyErCBQlkaLbwHSVCdu1G74zyBplb/pRvo3M5bXyXFppCDlXQX/XyI7Pr9zfB12HKotsjXd/ReZsCWz+a1D0UY5Y9k0O8cUmj28rzbqw04QD9/09I1p+/iYS4Onx1,iv:Bxi7cOlCp9HxBEWHGtZ7BvQ87YSteMTULf9DIJAlAk0=,tag:YG0NAEtTHKEdJvReJntEcA==,type:str]
+    url: ENC[AES256_GCM,data:dvjAbdjhvDg5kQ+p1ZcaXu3u9cJ18xYABH2UeoAuzvYpQVoe7qh8Iy/E9YHJohCL8IBYGYp7rGWlP3l4PsuaHo5OGTYH/RcdbkIQC4IaxZZfmE+asCQp1+7LblEJdzdQMJqbtqGd2z9Czefm+J6JxKiOea5A4qSYdbbVubTJJgF7S8SPxdF0/Wbh+BPhNDZ5GOCS2Hb9Be+WxU4P9v+IksQE,iv:2jYDRSGqvOjDYsHQbhqBXOECsGsZqRpkhIwzDUg8FxQ=,tag:YVyicpdFZU2JgHL+Yzlm0w==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -15,14 +15,46 @@ sops:
         - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLYndSMTFpN011azMrUG1Z
-            b2Nvd1lGZGo0eDlMYW4rdFczMS9LSE4vSVM4CmRueXAvSlhncjZudWV4VlpJbFhY
-            UEs2QlVBSmdGbUk2clEyR25NdFZGbGsKLS0tIDlMeDdhL2NCa2pXYXoxSHhKQU9S
-            ZVR5TW9OUlRTa1hJelZ3RFFWSnZnVW8KYNv0HS+o9ghOWMYkyUSgWkRNvu8Uu6oj
-            MIM4bC86/qLSeLZvaKsgmtE1bC2VdGd1HBzIgo5AJLNkEnoc4zJejg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXZzhhMWRsbmZvQmM4N3d0
+            TWdSOGg4MzFtTGEyVFVKN1Q1b1NEVmdHbDNrCllYVmhZVGp4TUE1Z0hobGpLWUVD
+            OUJGcFRpSUFwYXUxSTduU2xEOFpSVUEKLS0tIFBNemw4NE50QVpuUHZCZnJUVGpl
+            dEVzK0NjcjlSNWR0MGcyQ3RweDA4RkkK4jnHGylOIYyiKdx+bCzhr+/WTGZalzKL
+            He+EFFNNF7szqnMrARa6cxHWXuysfuJ5L3vKotczwwUdE94K2Z+/SQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-09-16T09:13:17Z"
-    mac: ENC[AES256_GCM,data:qWrC2Ve89cE838+FrpmQGnFXeJAu+SFg1KxAaSpX60WOwEdu7HZG2JA5rkfmiPnUWbMNjInYuUR2maLm8vu5kWnLhqRxAHmf6EUf+mZKb8sD2hWWyxRGz1yuLWtv0daNzpQKwat3dgJ5KudRvAV9t3cuFuvLXzEL9bhCHSF8bRY=,iv:S23mtXz2zQ16dtisZVZBEtcCtKY77/5E6EZSdkC/rCw=,tag:jOcQjaLGEx8kj30nSM2efA==,type:str]
+    lastmodified: "2024-09-16T13:25:40Z"
+    mac: ENC[AES256_GCM,data:JyBN/N+dxZp1D4Y9X4SrVDks8tNCD7aWkVfLnNDRnJ7rvqX3dA99YO+N90wdcMPy3neQXLWi6q0JcBKp7bwhqrztzF51Ah5CEBmk14lYT+gP6ZJkj9PR3D+jQ1la67ovidLcL8wv7/5o64BMR0PzCqGz9ino9yLxU293e1+yY4w=,iv:GbrA1p7+LK9rredu5K9FWsp4Iym4hyQ7sSsmzADEBuE=,tag:FN00DG5QTAg2PwqWxFUJoQ==,type:str]
     pgp: []
     encrypted_regex: ^(admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
-    version: 3.8.1
+    mac_only_encrypted: true
+    version: 3.9.0
+---
+apiVersion: v1
+kind: Secret
+metadata:
+    name: coder-oauth
+    namespace: coder
+type: Opaque
+stringData:
+    client_id: ENC[AES256_GCM,data:AKnt2IHGsHqOqutiA9bzfWXerJJS3mUGyA0dgcp5NifAxPNA4SK05g==,iv:JwB1Z3ZxmLHDnzeXxWu8hgSGPFBgQU0vVSZ7wjXTe0w=,tag:NB67WUH4fdtUOmn5CFD6Fw==,type:str]
+    client_secret: ENC[AES256_GCM,data:ObfoCSRrIE099dejVrCBa3B6IVbuRo0nCLrWVRFqn0DG72Rb1q3fZ1c4bz4ERX6a068UciugujoQG6LMaIoUbijwMz3RvXd2KM+iP2mjMb0YtlO+rAjhDCXUrbr5gVITq7OnN4YQPOLdkSmVA+uHK5iRR4Hq6dDqxcL4Jmmb6uI=,iv:x/l0PWg1VeauqiwhAh1ByQB2cbJ5I/1knLwPZcwBnpM=,tag:J2TTU8DaxhA0q9rR0KRNOA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXZzhhMWRsbmZvQmM4N3d0
+            TWdSOGg4MzFtTGEyVFVKN1Q1b1NEVmdHbDNrCllYVmhZVGp4TUE1Z0hobGpLWUVD
+            OUJGcFRpSUFwYXUxSTduU2xEOFpSVUEKLS0tIFBNemw4NE50QVpuUHZCZnJUVGpl
+            dEVzK0NjcjlSNWR0MGcyQ3RweDA4RkkK4jnHGylOIYyiKdx+bCzhr+/WTGZalzKL
+            He+EFFNNF7szqnMrARa6cxHWXuysfuJ5L3vKotczwwUdE94K2Z+/SQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-16T13:25:40Z"
+    mac: ENC[AES256_GCM,data:JyBN/N+dxZp1D4Y9X4SrVDks8tNCD7aWkVfLnNDRnJ7rvqX3dA99YO+N90wdcMPy3neQXLWi6q0JcBKp7bwhqrztzF51Ah5CEBmk14lYT+gP6ZJkj9PR3D+jQ1la67ovidLcL8wv7/5o64BMR0PzCqGz9ino9yLxU293e1+yY4w=,iv:GbrA1p7+LK9rredu5K9FWsp4Iym4hyQ7sSsmzADEBuE=,tag:FN00DG5QTAg2PwqWxFUJoQ==,type:str]
+    pgp: []
+    encrypted_regex: ^(admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
+    mac_only_encrypted: true
+    version: 3.9.0
diff --git a/apps/base/coder/release.yaml b/apps/base/coder/release.yaml
@@ -29,6 +29,28 @@ spec:
                   value: "https://coder.midnightthoughts.space"
                 - name: CODER_WILDCARD_ACCESS_URL
                   value: "*.workspaces.coder.midnightthoughts.space"
+                - name: CODER_VERBOSE
+                  value: "true"
+                - name: CODER_OIDC_ISSUER_URL
+                  value: "https://auth.midnightthoughts.space/application/o/coder/"
+                - name: CODER_OIDC_EMAIL_FIELD
+                  value: "email"
+                - name: CODER_OIDC_USERNAME_FIELD
+                  value: "preferred_username"
+                - name: CODER_OIDC_SCOPES
+                  value: "openid,profile,email"
+                - name: CODER_OIDC_EMAIL_DOMAIN
+                  value: "nordgedanken.dev"
+                - name: CODER_OIDC_CLIENT_ID
+                  valueFrom:
+                    secretKeyRef:
+                        key: client_id
+                        name: coder-oauth
+                - name: CODER_OIDC_CLIENT_SECRET
+                  valueFrom:
+                    secretKeyRef:
+                        key: client_secret
+                        name: coder-oauth
             service:
                 type: ClusterIP
             ingress: