Cadoles
/
ansible-role-sso
10
0
Fork 0
Code Issues 1 Pull Requests 1 Projects Releases Wiki Activity

feat(hydra): add variable HYDRA_BCRYPT_COST

This commit is contained in:
Laurent Gourvenec 2023-11-13 11:12:03 +01:00
parent daa8612bae
commit 9fb1118961
3 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
defaults/main.yml
View File

@ -56,6 +56,8 @@ hydra_log_leak_sensitive_values: no
# Durée de vie des "refresh_token" # Durée de vie des "refresh_token"
hydra_ttl_refresh_token: "24h" hydra_ttl_refresh_token: "24h"
hydra_bcrypt_cost: 8
# This value should not be changed after first deployment ! # This value should not be changed after first deployment !
hydra_secrets_seed: "{{ inventory_hostname }}" hydra_secrets_seed: "{{ inventory_hostname }}"

4
sso.schema.yml
View File

@ -89,6 +89,10 @@ properties:
hydra_ttl_refresh_token: hydra_ttl_refresh_token:
type: string type: string
hydra_brypt_cost:
type: number
description: Coût CPU pour calculer des hachages de secret (4-31)
# This value should not be changed after first deployment ! # This value should not be changed after first deployment !
hydra_secrets_seed: hydra_secrets_seed:
type: string type: string

1
templates/cadoles-pod-hydra-v1.conf.j2
View File

@ -25,5 +25,6 @@ PODMAN_ARGS="\
{% endif %} {% endif %}
-e 'HYDRA_SECRETS_SYSTEM={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \ -e 'HYDRA_SECRETS_SYSTEM={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
-e 'HYDRA_OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \ -e 'HYDRA_OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
-e 'HYDRA_BCRYPT_COST={{ hydra_bcrypt_cost }}' \
-v /etc/hydra/clients.d:/etc/hydra/clients.d \ -v /etc/hydra/clients.d:/etc/hydra/clients.d \
" "