Trez/rinoa-docker
4
0
Fork 0
Code Issues 1 Pull Requests 8 Actions Activity

Adding Jinja macro for Vault lookup.
Gitea Branch PR & Ansible Deployment / Check and Create PR (push) Successful in 6m4s
Details
Gitea Branch PR & Ansible Deployment / Ansible Lint (push) Failing after 15m39s
Details
Gitea Branch PR & Ansible Deployment / PR Merge (push) Successful in 7m16s
Details
Gitea Branch PR & Ansible Deployment / Ansible Config Deployment (push) Successful in 14m40s
Details

Browse Source
This commit is contained in:
Trez.One
2025-06-13 21:52:09 -04:00
parent 7cf7c4a2aa
commit add421bb81
73 changed files with 191 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/app-configs/authelia/configuration.yml.j2
+10 -9
View File
@@ -1,3 +1,4 @@
{% import '../macros/rinoa-macros.j2' as vault %}
{% set vault_addr = 'https://vault.trez.wtf' %}
{% set secrets_path = 'rinoa-docker/env' %}
@@ -64,11 +65,11 @@ authentication_backend:
mail: mail
display_name: displayName
user: uid=authelia,ou=people,dc=trez,dc=wtf
password: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_AUTH_BIND_LDAP_PASSWORD'] }}'
password: '{{ vault.vault_secret('env', 'AUTHELIA_AUTH_BIND_LDAP_PASSWORD') }}'
refresh_interval: 5m
identity_validation:
reset_password:
jwt_secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_JWT_SECRET'] }}'
jwt_secret: '{{ vault.vault_secret('env', 'AUTHELIA_JWT_SECRET') }}'
password_policy:
standard:
enabled: true
@@ -104,7 +105,7 @@ access_control:
- ['user:the.trezured.one']
session:
name: authelia_session
secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_SESSION_SECRET'] }}'
secret: '{{ vault.vault_secret('env', 'AUTHELIA_SESSION_SECRET') }}'
expiration: 1h
inactivity: 5m
remember_me: 1M
@@ -115,12 +116,12 @@ session:
host: redis
port: 6379
storage:
encryption_key: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_STORAGE_ENCRYPTION_KEY'] }}'
encryption_key: '{{ vault.vault_secret('env', 'AUTHELIA_STORAGE_ENCRYPTION_KEY') }}'
postgres:
address: 'tcp://authelia-pg:5432'
database: authelia
username: authelia
password: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_STORAGE_POSTGRES_PASSWORD'] }}'
password: '{{ vault.vault_secret('env', 'AUTHELIA_STORAGE_POSTGRES_PASSWORD') }}'
timeout: '5s'
regulation:
max_retries: 3
@@ -131,8 +132,8 @@ notifier:
smtp:
address: 'smtp://postal-smtp:25'
timeout: '5s'
username: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}'
password: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}'
username: '{{ vault.vault_secret('env', 'POSTAL_SMTP_AUTH_USER') }}'
password: '{{ vault.vault_secret('env', 'POSTAL_SMTP_AUTH_PASSWORD') }}'
sender: "Authelia <noreply@trez.wtf>"
identifier: 'localhost'
subject: "[Authelia] {title}"
@@ -142,7 +143,7 @@ notifier:
disable_html_emails: false
identity_providers:
oidc:
hmac_secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_OIDC_HMAC_SECRET'] }}'
hmac_secret: '{{ vault.vault_secret('env', 'AUTHELIA_OIDC_HMAC_SECRET') }}'
jwks:
- key: |
{{ lookup("community.hashi_vault.vault_kv2_get", "env", engine_mount_point="rinoa-docker", url=vault_addr, token=vault_token_cleaned)["secret"]["AUTHELIA_OIDC_JWKS_KEY"] | replace("\\n", "\n") | indent(10) }}
@@ -157,7 +158,7 @@ identity_providers:
clients:
- client_id: 'netbird'
client_name: 'NetBird'
client_secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_NETBIRD_CLIENT_SECRET'] }}'
client_secret: '{{ vault.vault_secret('env', 'AUTHELIA_NETBIRD_CLIENT_SECRET') }}'
public: false
authorization_policy: 'two_factor'
redirect_uris: