c4220f2c2d
Generalize the outpost token-pinning path beyond the LDAP outpost so any proxy outpost declaring a token authenticates against the authentik server with the vault token instead of the blueprint's auto-generated one. Drive both from a single rendered script over a target list. Also raise the server healthcheck start_period to 120s: cold first boot runs DB migrations plus app init (~90s observed), which tripped compose --wait as unhealthy at the old 30s. Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
80 lines
No EOL
2.7 KiB
YAML
80 lines
No EOL
2.7 KiB
YAML
#SPDX-License-Identifier: MIT-0
|
|
---
|
|
# tasks file for authentik
|
|
|
|
- name: Create authentik directories
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: '0755'
|
|
loop:
|
|
- "{{ authentik_docker_compose_dir }}"
|
|
- "{{ authentik_docker_volume_dir }}/data"
|
|
- "{{ authentik_docker_volume_dir }}/certs"
|
|
- "{{ authentik_docker_volume_dir }}/templates"
|
|
- "{{ authentik_docker_volume_dir }}/postgresql"
|
|
- "{{ authentik_docker_volume_dir }}/blueprints"
|
|
|
|
- name: Create docker-compose file for authentik
|
|
template:
|
|
src: docker-compose.yml.j2
|
|
dest: "{{ authentik_docker_compose_dir }}/docker-compose.yml"
|
|
mode: '0644'
|
|
|
|
- name: Start authentik containers
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ authentik_docker_compose_dir }}"
|
|
state: present
|
|
wait: true
|
|
wait_timeout: 300
|
|
|
|
- name: Render blueprints
|
|
import_tasks: blueprints.yml
|
|
|
|
- name: Render blueprint wait script
|
|
template:
|
|
src: wait-for-blueprints.py.j2
|
|
dest: "{{ authentik_docker_volume_dir }}/data/wait-for-blueprints.py"
|
|
mode: '0644'
|
|
|
|
- name: Wait for custom blueprints to be applied
|
|
community.docker.docker_compose_v2_exec:
|
|
project_src: "{{ authentik_docker_compose_dir }}"
|
|
service: server
|
|
command: ak shell -c "exec(open('/data/wait-for-blueprints.py').read())"
|
|
register: blueprint_wait_result
|
|
changed_when: "'changed' in blueprint_wait_result.stdout"
|
|
retries: 30
|
|
delay: 10
|
|
until: blueprint_wait_result.rc == 0
|
|
when: blueprints_changed
|
|
|
|
# Pin known tokens on the LDAP outpost and on any proxy outpost that
|
|
# declares one, so co-located outposts (e.g. a proxy outpost on another
|
|
# host) can authenticate against the authentik server with the token from
|
|
# the vault instead of the auto-generated one the blueprint creates.
|
|
- name: Set fact whether any outpost needs a pinned token
|
|
ansible.builtin.set_fact:
|
|
_authentik_outpost_tokens: >-
|
|
{{ (authentik_ldap_outpost.name is defined)
|
|
or (authentik_proxy_outposts | default([]) | selectattr('token', 'defined') | list | length > 0) }}
|
|
|
|
- name: Render outpost token script
|
|
template:
|
|
src: set-outpost-token.py.j2
|
|
dest: "{{ authentik_docker_volume_dir }}/data/set-outpost-token.py"
|
|
mode: '0644'
|
|
when: _authentik_outpost_tokens | bool
|
|
register: outpost_token_script
|
|
|
|
- name: Set known tokens for outposts
|
|
community.docker.docker_compose_v2_exec:
|
|
project_src: "{{ authentik_docker_compose_dir }}"
|
|
service: server
|
|
command: ak shell -c "exec(open('/data/set-outpost-token.py').read())"
|
|
register: outpost_token_result
|
|
changed_when: "'changed' in outpost_token_result.stdout"
|
|
retries: 30
|
|
delay: 10
|
|
until: outpost_token_result.rc == 0
|
|
when: (_authentik_outpost_tokens | bool) and (blueprints_changed or outpost_token_script.changed) |