ginnoir
51acb44322
Deploy to valhalla / deploy (push) Has been cancelled
Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.
59 lines
2.2 KiB
Bash
59 lines
2.2 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# TB-006 batch 3: app-side auth so Authentik is not a second login screen.
|
|
# Run on valhalla after setup-batch1-oidc.py prints client_id/secret values.
|
|
#
|
|
# Requires OWNCLOUD_OIDC_* in owncloud stack.env and OAUTH_* in resume stack.env.
|
|
|
|
OWNCLOUD_ENV="${OWNCLOUD_ENV:-/tmp/owncloud-stack.env}"
|
|
RESUME_ENV="${RESUME_ENV:-/tmp/resume-stack.env}"
|
|
|
|
read_env() {
|
|
local file="$1" key="$2"
|
|
grep -E "^${key}=" "$file" | head -1 | cut -d= -f2-
|
|
}
|
|
|
|
echo "=== FreshRSS: switch to HTTP auth (Remote-User from Authentik via Caddy) ==="
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
docker cp "$SCRIPT_DIR/patch-freshrss-http-auth.php" freshrss:/tmp/patch-freshrss-http-auth.php
|
|
docker exec freshrss php /tmp/patch-freshrss-http-auth.php
|
|
docker exec freshrss grep -E "auth_type|http_auth_auto_register" /var/www/FreshRSS/data/config.php
|
|
|
|
echo "=== ownCloud: write oidc.config.php ==="
|
|
OC_ID="$(read_env "$OWNCLOUD_ENV" OWNCLOUD_OIDC_CLIENT_ID)"
|
|
OC_SECRET="$(read_env "$OWNCLOUD_ENV" OWNCLOUD_OIDC_CLIENT_SECRET)"
|
|
if [[ -z "$OC_ID" || -z "$OC_SECRET" ]]; then
|
|
echo "ERROR: set OWNCLOUD_OIDC_CLIENT_ID/SECRET in owncloud stack.env first" >&2
|
|
exit 1
|
|
fi
|
|
|
|
TMP_OC="$(mktemp)"
|
|
cat >"$TMP_OC" <<PHP
|
|
<?php
|
|
\$CONFIG = [
|
|
'http.cookie.samesite' => 'None',
|
|
'openid-connect' => [
|
|
'provider-url' => 'https://auth.ginnoir.com/application/o/owncloud/',
|
|
'client-id' => '${OC_ID}',
|
|
'client-secret' => '${OC_SECRET}',
|
|
'loginButtonName' => 'Log in with Authentik',
|
|
'mode' => 'userid',
|
|
'search-attribute' => 'preferred_username',
|
|
'autoRedirectOnLoginPage' => true,
|
|
],
|
|
];
|
|
PHP
|
|
docker cp "$TMP_OC" owncloud_server:/mnt/data/config/oidc.config.php
|
|
rm -f "$TMP_OC"
|
|
echo " wrote /mnt/data/config/oidc.config.php"
|
|
docker exec owncloud_server occ app:enable openidconnect >/dev/null 2>&1 || true
|
|
echo " owncloud openidconnect enabled"
|
|
|
|
echo "=== done — recreate resume container after stack.env OAuth vars are set ==="
|
|
if grep -q '^OAUTH_CLIENT_ID=' "$RESUME_ENV" 2>/dev/null; then
|
|
echo " resume stack.env has OAUTH_CLIENT_ID (Portainer redeploy or recreate app container)"
|
|
else
|
|
echo " WARN: add OAUTH_* vars to resume stack.env and redeploy the resume stack"
|
|
fi
|