From fab5ad2f9c061748de0cd2e8b1835f4d445bf24b Mon Sep 17 00:00:00 2001
From: Mark <mark@openappstack.net>
Date: Mon, 16 Dec 2019 15:43:30 +0100
Subject: [PATCH] Add single-sign-on to oas

---
 ansible/group_vars/all/oas.yml                |  8 +++
 ansible/roles/apps/tasks/main.yml             |  3 +
 ansible/roles/apps/tasks/single-sign-on.yml   | 11 ++++
 .../templates/single-sign-on-settings.yaml    | 62 +++++++++++++++++++
 flux/single-sign-on.yaml                      | 19 ++++++
 5 files changed, 103 insertions(+)
 create mode 100644 ansible/roles/apps/tasks/single-sign-on.yml
 create mode 100644 ansible/roles/apps/templates/single-sign-on-settings.yaml
 create mode 100644 flux/single-sign-on.yaml

diff --git a/ansible/group_vars/all/oas.yml b/ansible/group_vars/all/oas.yml
index 77ee8c694..6f4284c44 100644
--- a/ansible/group_vars/all/oas.yml
+++ b/ansible/group_vars/all/oas.yml
@@ -21,6 +21,14 @@ onlyoffice_postgresql_password: "{{ lookup('password', '{{ cluster_dir }}/secret
 onlyoffice_rabbitmq_password: "{{ lookup('password', '{{ cluster_dir }}/secrets/onlyoffice_rabbitmq_password chars=ascii_letters') }}"
 grafana_admin_password: "{{ lookup('password', '{{ cluster_dir }}/secrets/grafana_admin_password chars=ascii_letters') }}"
 
+# Single sign-on passwords
+userpanel_oauth_client_secret: "{{ lookup('password', '{{ cluster_dir }}/secrets/userpanel_oauth_client_secret chars=ascii_letters') }}"
+userbackend_postgres_password: "{{ lookup('password', '{{ cluster_dir }}/secrets/userbackend_postgres_password chars=ascii_letters') }}"
+userbackend_admin_username: "admin"
+userbackend_admin_password: "{{ lookup('password', '{{ cluster_dir }}/secrets/userbackend_admin_username chars=ascii_letters') }}"
+userbackend_admin_email: "email@example.net"
+hydra_system_secret: "{{ lookup('password', '{{ cluster_dir }}/secrets/hydra_system_secret chars=ascii_letters') }}"
+
 # Application versions
 helm:
   # helm snap 2.15 broke for us
diff --git a/ansible/roles/apps/tasks/main.yml b/ansible/roles/apps/tasks/main.yml
index 47f0e897f..b345c1895 100644
--- a/ansible/roles/apps/tasks/main.yml
+++ b/ansible/roles/apps/tasks/main.yml
@@ -28,3 +28,6 @@
 
 - name: Tasks pertaining to NextCloud
   import_tasks: nextcloud.yml
+
+- name: Tasks pertaining to Single sign-on
+  import_tasks: single-sign-on.yml
diff --git a/ansible/roles/apps/tasks/single-sign-on.yml b/ansible/roles/apps/tasks/single-sign-on.yml
new file mode 100644
index 000000000..92a54d65e
--- /dev/null
+++ b/ansible/roles/apps/tasks/single-sign-on.yml
@@ -0,0 +1,11 @@
+---
+
+- name: Create Kubernetes secret with single-sign-on settings
+  tags:
+    - config
+    - flux
+    - single-sign-on
+  vars:
+    flux:
+      name: "single-sign-on-settings"
+  include_tasks: flux_secret.yml
diff --git a/ansible/roles/apps/templates/single-sign-on-settings.yaml b/ansible/roles/apps/templates/single-sign-on-settings.yaml
new file mode 100644
index 000000000..44d66090a
--- /dev/null
+++ b/ansible/roles/apps/templates/single-sign-on-settings.yaml
@@ -0,0 +1,62 @@
+replicaCount: 1
+
+consentProviderImage:
+  << : &IMAGE_DEFAULTS_SSO { tag: "master", pullPolicy: "Always" }
+  repository: "open.greenhost.net:4567/openappstack/single-sign-on/consent_provider"
+loginProviderImage:
+  << : *IMAGE_DEFAULTS_SSO
+  repository: "open.greenhost.net:4567/openappstack/single-sign-on/login_provider"
+
+singleSignOnHost: &SSO_HOST "sso.{{ domain }}"
+
+userpanel:
+  image:
+    << : &IMAGE_DEFAULTS_USER_PANEL { tag: "master", pullPolicy: "Always" }
+    repository: "open.greenhost.net:4567/openappstack/user-panel/frontend"
+  ingress:
+    host: "admin.{{ domain }}"
+  oAuthClientSecret: "{{ userpanel_oauth_client_secret }}"
+
+userbackend:
+  image:
+    << : *IMAGE_DEFAULTS_USER_PANEL
+    repository: "open.greenhost.net:4567/openappstack/user-panel/backend"
+  username: "{{ userbackend_admin_username }}"
+  password: "{{ userbackend_admin_password }}"
+  email: "{{ userbackend_admin_email }}"
+  postgresImage: postgres
+  postgresTag: 11
+  postgresPullPolicy: Always
+  postgresPassword: "{{ userbackend_postgres_password }}"
+  persistence:
+    enabled: false
+    annotations:
+      size: 1Gi
+      storageClass: "-"
+
+hydra:
+  hydra:
+    dangerousForceHttp: true
+    config:
+      dsn: memory
+      urls:
+        self:
+          issuer: "https://sso.{{ domain }}"
+        login: "https://sso.{{ domain }}/login"
+        consent: "https://sso.{{ domain }}/consent"
+      secrets:
+        system: "{{ hydra_system_secret }}"
+  ingress:
+    public:
+      enabled: true
+      annotations:
+        kubernetes.io/tls-acme: "true"
+      hosts:
+        - host: *SSO_HOST
+          paths: ["/"]
+      tls:
+        - hosts:
+          - *SSO_HOST
+          secretName: hydra-public.tls
+    admin:
+      enabled: false
diff --git a/flux/single-sign-on.yaml b/flux/single-sign-on.yaml
new file mode 100644
index 000000000..dffe3821e
--- /dev/null
+++ b/flux/single-sign-on.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: helm.fluxcd.io/v1
+kind: HelmRelease
+metadata:
+  name: single-sign-on
+  namespace: oas
+  annotations:
+    flux.weave.works/automated: "false"
+spec:
+  releaseName: single-sign-on
+  chart:
+    git: https://open.greenhost.net/openappstack/single-sign-on
+    ref: 0d57810b0380baecda2d7f784898203a258bc366
+    path: ./helmchart/single-sign-on/
+  valuesFrom:
+    - secretKeyRef:
+        name: single-sign-on-settings
+        key: values.yaml
+  timeout: 1800
-- 
GitLab