e78000831e
Hearth is the infrastructure home for the letemcook ecosystem. Ported from coherence-mcp/infra: - Terraform modules (VPC, EKS, IAM, NLB, S3, storage) - Kubernetes manifests (Forgejo, ingress, cert-manager, karpenter) - Deployment scripts (phased rollout) Status: Not deployed. EKS cluster needs to be provisioned. Next steps: 1. Bootstrap terraform backend 2. Deploy phase 1 (foundation) 3. Deploy phase 2 (core services including Forgejo) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
77 lines
2.7 KiB
YAML
77 lines
2.7 KiB
YAML
# Forgejo OAuth2 Provider Configuration
|
|
# RFC 0040: Self-Hosted Core Services
|
|
#
|
|
# This ConfigMap contains the Keycloak OAuth2 provider configuration
|
|
# Applied via Forgejo's app.ini or admin UI
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: forgejo-oauth-provider
|
|
namespace: forgejo
|
|
labels:
|
|
app.kubernetes.io/name: forgejo
|
|
app.kubernetes.io/part-of: core-services
|
|
data:
|
|
# Instructions for configuring Keycloak SSO in Forgejo
|
|
# This can be done via:
|
|
# 1. Admin UI: Site Administration -> Authentication Sources -> Add New Source
|
|
# 2. API: POST /api/v1/admin/auths
|
|
# 3. Database seed script
|
|
oauth-provider.md: |
|
|
# Keycloak SSO Configuration for Forgejo
|
|
|
|
## Via Admin UI
|
|
|
|
1. Navigate to Site Administration -> Authentication Sources
|
|
2. Click "Add Authentication Source"
|
|
3. Select "OAuth2" as the type
|
|
4. Fill in the following:
|
|
- Authentication Name: keycloak
|
|
- OAuth2 Provider: OpenID Connect
|
|
- Client ID: forgejo
|
|
- Client Secret: (from Keycloak)
|
|
- OpenID Connect Auto Discovery URL: https://auth.beyondtheuniverse.superviber.com/realms/alignment/.well-known/openid-configuration
|
|
- Additional Scopes: groups
|
|
- Required Claim Name: (leave empty or set to "groups")
|
|
- Required Claim Value: (leave empty)
|
|
- Group Claim Name: groups
|
|
- Admin Group: /admins
|
|
- Restricted Group: (leave empty)
|
|
|
|
## Via API
|
|
|
|
```bash
|
|
curl -X POST "https://git.beyondtheuniverse.superviber.com/api/v1/admin/auths" \
|
|
-H "Authorization: token ${ADMIN_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{
|
|
"type": 6,
|
|
"name": "keycloak",
|
|
"is_active": true,
|
|
"is_sync_enabled": true,
|
|
"cfg": {
|
|
"Provider": "openidConnect",
|
|
"ClientID": "forgejo",
|
|
"ClientSecret": "${KEYCLOAK_CLIENT_SECRET}",
|
|
"OpenIDConnectAutoDiscoveryURL": "https://auth.beyondtheuniverse.superviber.com/realms/alignment/.well-known/openid-configuration",
|
|
"Scopes": "openid profile email groups",
|
|
"GroupClaimName": "groups",
|
|
"AdminGroup": "/admins"
|
|
}
|
|
}'
|
|
```
|
|
|
|
# OAuth2 provider configuration (for reference/automation)
|
|
oauth-config.json: |
|
|
{
|
|
"name": "keycloak",
|
|
"provider": "openidConnect",
|
|
"clientId": "forgejo",
|
|
"openIdConnectAutoDiscoveryUrl": "https://auth.beyondtheuniverse.superviber.com/realms/alignment/.well-known/openid-configuration",
|
|
"scopes": ["openid", "profile", "email", "groups"],
|
|
"groupClaimName": "groups",
|
|
"adminGroup": "/admins",
|
|
"restrictedGroup": "",
|
|
"skipLocalTwoFA": false,
|
|
"iconUrl": "https://auth.beyondtheuniverse.superviber.com/resources/logo.png"
|
|
}
|