friessn
6c9cd67a08
Replaces the single shared HTTP Basic service-account credential (which caused a production outage from a username mismatch) with per-user login: Keycloak (already running on this VM for gcnm, now also fronted on auth.friessn.de with its own "homekeeper" realm) authenticates the user once via the landing page, FastAPI verifies the OIDC id_token and mints its own signed session JWT as a cookie, and both Shiny apps forward that per-session token as a Bearer credential instead of a static shared one. Authorization is a simple ALLOWED_USERS allowlist; the old auth.users table and bcrypt seeding are gone entirely. Also carries forward the in-progress rootless Podman/Quadlet migration (gitea, homekeeper, podman roles) and fixes a pre-existing bug where each role's handlers were malformed inside tasks/main.yml instead of their own handlers/main.yml, which broke ansible-playbook entirely. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FbiCdckkTX2HyAkyi1R39d
77 lines
2.3 KiB
YAML
77 lines
2.3 KiB
YAML
---
|
|
- name: Install nginx and certbot
|
|
apt:
|
|
name:
|
|
- nginx
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Remove default nginx site
|
|
file:
|
|
path: /etc/nginx/sites-enabled/default
|
|
state: absent
|
|
notify: Reload nginx
|
|
|
|
# git.friessn.de already has its own site file (deployed manually before this
|
|
# role existed, same one-file-per-domain convention as the other sites on this
|
|
# box) — this role only manages home.friessn.de.
|
|
- name: Deploy home.friessn.de nginx config
|
|
template:
|
|
src: home.friessn.de.conf.j2
|
|
dest: /etc/nginx/sites-available/home.friessn.de
|
|
mode: "0644"
|
|
notify: Reload nginx
|
|
|
|
- name: Enable home.friessn.de nginx site
|
|
file:
|
|
src: /etc/nginx/sites-available/home.friessn.de
|
|
dest: /etc/nginx/sites-enabled/home.friessn.de
|
|
state: link
|
|
notify: Reload nginx
|
|
|
|
- name: Obtain Let's Encrypt certificate for {{ domain }}
|
|
command: >
|
|
certbot --nginx -d {{ domain }}
|
|
--non-interactive --agree-tos -m {{ gitea_admin_email }}
|
|
--redirect
|
|
args:
|
|
creates: /etc/letsencrypt/live/{{ domain }}/fullchain.pem
|
|
notify: Reload nginx
|
|
|
|
# Keycloak itself runs as a plain Docker container for the unrelated gcnm
|
|
# app (not managed by this role) — it's already published on
|
|
# 127.0.0.1:8080, this just fronts it with TLS on its own subdomain so
|
|
# Homekeeper (and anything else on the box) can treat it as a normal OIDC
|
|
# provider. Requires a DNS record for {{ keycloak_domain }} pointing at this
|
|
# VM before the certbot step below can succeed.
|
|
- name: Deploy auth.friessn.de nginx config
|
|
template:
|
|
src: auth.friessn.de.conf.j2
|
|
dest: /etc/nginx/sites-available/{{ keycloak_domain }}
|
|
mode: "0644"
|
|
notify: Reload nginx
|
|
|
|
- name: Enable auth.friessn.de nginx site
|
|
file:
|
|
src: /etc/nginx/sites-available/{{ keycloak_domain }}
|
|
dest: /etc/nginx/sites-enabled/{{ keycloak_domain }}
|
|
state: link
|
|
notify: Reload nginx
|
|
|
|
- name: Obtain Let's Encrypt certificate for {{ keycloak_domain }}
|
|
command: >
|
|
certbot --nginx -d {{ keycloak_domain }}
|
|
--non-interactive --agree-tos -m {{ gitea_admin_email }}
|
|
--redirect
|
|
args:
|
|
creates: /etc/letsencrypt/live/{{ keycloak_domain }}/fullchain.pem
|
|
notify: Reload nginx
|
|
|
|
- name: Enable nginx
|
|
service:
|
|
name: nginx
|
|
enabled: true
|
|
state: started
|