jochen
2f55adc57c
mesh/merge-gate fail: builds betterbird, keycloak, searxng → ace; no bus step; 2 wait(s) for a person; 3 problem(s) the change brings; the first: a machine…
mesh/repo-check pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)
mesh/delivery rejected: the gate failed or could not run, or the repository's own check failed
Every setting reached every mergeable file: searxng's endpoints landed in its settings.yml, keycloak's issuer in its tools' config, betterbird's prefs would land in its accounts file. Each file now names the keys it reads, so the controller lays only those over it and calls the rest stray. Merge only after the controller that knows takes-settings (mesh-controller #272) has walked: an older one hands the field to the node-engine, which refuses it.
197 lines
4.8 KiB
JSON
197 lines
4.8 KiB
JSON
{
|
|
"module": "keycloak",
|
|
"version": "1",
|
|
"upgrade": {
|
|
"policy": "record",
|
|
"why": "every person's sign-in to every site goes through it, and its new version migrates its database on start: a person takes each build, after a backup (hq ADR 0236)"
|
|
},
|
|
"provides": [
|
|
{
|
|
"name": "oidc-client",
|
|
"scope": "mesh",
|
|
"identity": {
|
|
"max": 255,
|
|
"in": "a Keycloak client id"
|
|
}
|
|
}
|
|
],
|
|
"requires": [
|
|
"postgres-database",
|
|
"route"
|
|
],
|
|
"contributes": {
|
|
"postgres-database": {
|
|
"name": "keycloak"
|
|
},
|
|
"route": {
|
|
"label": "keycloak",
|
|
"endpoint": "web"
|
|
}
|
|
},
|
|
"binds": {
|
|
"postgres-database": "${dir:state}/database.json",
|
|
"route": "${dir:state}/route.json"
|
|
},
|
|
"secrets": {
|
|
"postgres-database": "${dir:state}/database.secret"
|
|
},
|
|
"capabilities": [
|
|
"container-runtime"
|
|
],
|
|
"emits": [
|
|
"user.created",
|
|
"user.deleted",
|
|
"password.reset",
|
|
"client.created",
|
|
"client.retired",
|
|
"group.created",
|
|
"role.created",
|
|
"admin.repaired",
|
|
"admin.unrepaired"
|
|
],
|
|
"listens": [
|
|
{
|
|
"name": "web",
|
|
"port": 8080,
|
|
"protocol": "tcp",
|
|
"from": "mesh",
|
|
"why": "anything the mesh runs that authenticates a person"
|
|
}
|
|
],
|
|
"serves": {
|
|
"oidc-client": {
|
|
"authorization-path": "/protocol/openid-connect/auth",
|
|
"token-path": "/protocol/openid-connect/token",
|
|
"userinfo-path": "/protocol/openid-connect/userinfo",
|
|
"issuer": "${setting:issuer}"
|
|
}
|
|
},
|
|
"receives": {
|
|
"oidc-client": "${dir:grants}/mesh.json"
|
|
},
|
|
"grants": {
|
|
"oidc-client": "${dir:grants}"
|
|
},
|
|
"own-secrets": {
|
|
"admin": "${dir:state}/admin.secret"
|
|
},
|
|
"data": {
|
|
"consumers": {
|
|
"oidc-client": {
|
|
"class": "rebuildable",
|
|
"in": "postgres-database",
|
|
"why": "a consumer's client is made again from its declaration, with a new secret"
|
|
}
|
|
}
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "mesh-state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"place": "mesh"
|
|
},
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"place": "."
|
|
},
|
|
{
|
|
"id": "grants",
|
|
"type": "directory",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "admin-env",
|
|
"type": "file",
|
|
"path": "${dir:state}/admin.env",
|
|
"mode": "0600",
|
|
"content": "KEYCLOAK_ADMIN=admin\nKEYCLOAK_ADMIN_PASSWORD=${secret:admin}\n"
|
|
},
|
|
{
|
|
"id": "database-env",
|
|
"type": "file",
|
|
"path": "${dir:state}/database.env",
|
|
"mode": "0600",
|
|
"content": "KC_DB_URL=jdbc:postgresql://${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nKC_DB_USERNAME=${bound:postgres-database:as}\nKC_DB_PASSWORD=${secret:postgres-database}\n"
|
|
},
|
|
{
|
|
"id": "net",
|
|
"type": "network",
|
|
"name": "keycloak"
|
|
},
|
|
{
|
|
"id": "hostname",
|
|
"type": "file",
|
|
"path": "${dir:state}/hostname.env",
|
|
"mode": "0644",
|
|
"content": "KC_HOSTNAME=https://${bound:route:name}\n"
|
|
},
|
|
{
|
|
"id": "server",
|
|
"type": "container",
|
|
"name": "keycloak",
|
|
"image": "quay.io/keycloak/keycloak@sha256:ecd43971114b0c764f8a3288dddab73f98cb473daccc4feaffe4dc14adeaf866",
|
|
"network": "keycloak",
|
|
"args": [
|
|
"start-dev"
|
|
],
|
|
"env": {
|
|
"KC_DB": "postgres",
|
|
"KC_HTTP_ENABLED": "true",
|
|
"KC_HEALTH_ENABLED": "true",
|
|
"KC_PROXY_HEADERS": "xforwarded"
|
|
},
|
|
"env-file": [
|
|
"${dir:state}/admin.env",
|
|
"${dir:state}/database.env",
|
|
"${dir:state}/hostname.env"
|
|
],
|
|
"ports": [
|
|
"8080"
|
|
],
|
|
"secrets-in-environment": "KC_DB_PASSWORD is convertible through a generated keycloak.conf (db-password=); KEYCLOAK_ADMIN_PASSWORD is env-only before Keycloak 26; not yet converted",
|
|
"restart-on": [
|
|
"hostname"
|
|
]
|
|
},
|
|
{
|
|
"id": "runtime-config",
|
|
"type": "file",
|
|
"path": "${dir:mesh-state}/config.json",
|
|
"mode": "0600",
|
|
"content": "{}\n",
|
|
"merge": "json",
|
|
"takes-settings": [
|
|
"url",
|
|
"user",
|
|
"realm",
|
|
"issuer"
|
|
]
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "code",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/keycloak-provider",
|
|
"binary": "keycloak-provider",
|
|
"loads": [
|
|
"keycloak-provider"
|
|
],
|
|
"env": {
|
|
"MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
|
|
"MESH_KEYCLOAK_CONFIG_FILE": "${dir:mesh-state}/config.json",
|
|
"MESH_KEYCLOAK_PASSWORD_FILE": "${dir:state}/admin.secret",
|
|
"MESH_RECEIVES": "${dir:grants}/mesh.json",
|
|
"MESH_KEYCLOAK_CONTAINER": "keycloak"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|