Compare commits

..

8 Commits

8 changed files with 39 additions and 18 deletions

View File

@ -53,6 +53,11 @@ hydra_public_cors_allowed_origins: []
hydra_log_level: warn hydra_log_level: warn
hydra_log_leak_sensitive_values: no hydra_log_leak_sensitive_values: no
# Durée de vie des "refresh_token"
hydra_ttl_refresh_token: "24h"
hydra_bcrypt_cost: 8
# This value should not be changed after first deployment ! # This value should not be changed after first deployment !
hydra_secrets_seed: "{{ inventory_hostname }}" hydra_secrets_seed: "{{ inventory_hostname }}"
@ -166,9 +171,6 @@ hydra_saml_debug: no
# Niveau de verbosité du service shibboleth-sp # Niveau de verbosité du service shibboleth-sp
hydra_saml_sp_log_level: WARN hydra_saml_sp_log_level: WARN
# Durée de vie des "refresh_token"
hydra_ttl_refresh_token: "24h"
# Inclure les règles de cartographie des attributs SAML fournis par défaut par le projet hydra-shibboleth-sp-v3 # Inclure les règles de cartographie des attributs SAML fournis par défaut par le projet hydra-shibboleth-sp-v3
hydra_saml_include_sp_default_attributes_mapping: "yes" hydra_saml_include_sp_default_attributes_mapping: "yes"
@ -226,6 +228,7 @@ oidc_test_app_public_base_url: "{{ haproxy_public_base_url }}{{ haproxy_oidc_tes
enable_hydra_oidc: no enable_hydra_oidc: no
hydra_oidc_debug: no hydra_oidc_debug: no
hydra_oidc_internal_port: 8080
hydra_oidc_hydra_url_error: hydra_oidc_hydra_url_error:
hydra_oidc_base_url: hydra_oidc_base_url:
hydra_oidc_cookie_path: "{{ haproxy_hydra_oidc_base_path }}" hydra_oidc_cookie_path: "{{ haproxy_hydra_oidc_base_path }}"

View File

@ -46,6 +46,7 @@
name: cadoles-pod-hydra-oidc-v1 name: cadoles-pod-hydra-oidc-v1
state: restarted state: restarted
become: true become: true
when: not install_only
- name: Restart cadoles-pod-hydra-ldap-v1 - name: Restart cadoles-pod-hydra-ldap-v1
service: service:

View File

@ -89,6 +89,10 @@ properties:
hydra_ttl_refresh_token: hydra_ttl_refresh_token:
type: string type: string
hydra_brypt_cost:
type: number
description: Coût CPU pour calculer des hachages de secret (4-31)
# This value should not be changed after first deployment ! # This value should not be changed after first deployment !
hydra_secrets_seed: hydra_secrets_seed:
type: string type: string

View File

@ -0,0 +1,21 @@
---
# Simple task to update the config files of cadoles-pod-shibboleth-sp only.
- name: Configure cadoles-pod-shibboleth-sp-v3
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
mode: "{{ item.mode }}"
with_items:
- src: cadoles-pod-shibboleth-sp-v3.conf.j2
dest: /etc/cadoles-pod-shibboleth-sp-v3.conf
mode: u=rw,g=r
- src: shibboleth-attribute-map.inc.xml.j2
dest: /etc/shibboleth/attribute-map.inc.xml
mode: u=rw,g=r,o=r
- src: shibboleth-attribute-policy.inc.xml.j2
dest: /etc/shibboleth/attribute-policy.inc.xml
mode: u=rw,g=r,o=r
notify:
- Restart cadoles-pod-shibboleth-sp-v3
become: true

View File

@ -8,15 +8,5 @@
state: present state: present
become: true become: true
- name: Configure cadoles-pod-shibboleth-sp-v3 - name: Configure hydra SP
template: ansible.builtin.include_tasks: configure-hydra-sp.yml
src: "{{ item.src }}"
dest: "{{ item.dest }}"
mode: "{{ item.mode }}"
with_items:
- src: cadoles-pod-shibboleth-sp-v3.conf.j2
dest: /etc/cadoles-pod-shibboleth-sp-v3.conf
mode: u=rw,g=r
notify:
- Restart cadoles-pod-shibboleth-sp-v3
become: true

View File

@ -4,7 +4,7 @@ PODMAN_ARGS="\
--replace \ --replace \
--network=slirp4netns:allow_host_loopback=true \ --network=slirp4netns:allow_host_loopback=true \
--tz=local \ --tz=local \
-p 127.0.0.1:3000:80 \ -p 127.0.0.1:3000:8080 \
-e APP_ENV=prod \ -e APP_ENV=prod \
-e 'APP_DEBUG={{ hydra_dispatcher_debug }}' \ -e 'APP_DEBUG={{ hydra_dispatcher_debug }}' \
-e HYDRA_ADMIN_BASE_URL=http://10.0.2.2:4445 \ -e HYDRA_ADMIN_BASE_URL=http://10.0.2.2:4445 \
@ -21,7 +21,8 @@ PODMAN_ARGS="\
-e 'SENTRY_DSN={{ hydra_dispatcher_sentry_dsn }}' \ -e 'SENTRY_DSN={{ hydra_dispatcher_sentry_dsn }}' \
-e 'SENTRY_ENVIRONMENT={{ hydra_dispatcher_sentry_environment }}' \ -e 'SENTRY_ENVIRONMENT={{ hydra_dispatcher_sentry_environment }}' \
-e 'DISABLE_APP_AUTO_SELECT={{ hydra_dispatcher_disable_app_auto_select }}' \ -e 'DISABLE_APP_AUTO_SELECT={{ hydra_dispatcher_disable_app_auto_select }}' \
-v /etc/hydra-dispatcher/conf.d:/var/www/config/hydra \ -e 'PHP_FPM_MEMORY_LIMIT=128m' \
-v /etc/hydra-dispatcher/conf.d:/app/config/hydra \
{% for item in hydra_dispatcher_mounts %} {% for item in hydra_dispatcher_mounts %}
-v {{ item.host }}:{{ item.container }} \ -v {{ item.host }}:{{ item.container }} \
{% endfor %} {% endfor %}

View File

@ -4,7 +4,7 @@ PODMAN_ARGS="\
--replace \ --replace \
--network=slirp4netns:allow_host_loopback=true \ --network=slirp4netns:allow_host_loopback=true \
--tz=local \ --tz=local \
-p 127.0.0.1:3004:80 \ -p 127.0.0.1:3004:{{ hydra_oidc_internal_port | default(8080) }} \
-e APP_ENV=prod \ -e APP_ENV=prod \
-e 'APP_DEBUG={{ hydra_oidc_debug }}' \ -e 'APP_DEBUG={{ hydra_oidc_debug }}' \
-e 'HYDRA_ADMIN_BASE_URL=http://10.0.2.2:3000' \ -e 'HYDRA_ADMIN_BASE_URL=http://10.0.2.2:3000' \

View File

@ -25,5 +25,6 @@ PODMAN_ARGS="\
{% endif %} {% endif %}
-e 'HYDRA_SECRETS_SYSTEM={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \ -e 'HYDRA_SECRETS_SYSTEM={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
-e 'HYDRA_OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \ -e 'HYDRA_OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
-e 'HYDRA_BCRYPT_COST={{ hydra_bcrypt_cost }}' \
-v /etc/hydra/clients.d:/etc/hydra/clients.d \ -v /etc/hydra/clients.d:/etc/hydra/clients.d \
" "