c4220f2c2d
Generalize the outpost token-pinning path beyond the LDAP outpost so any proxy outpost declaring a token authenticates against the authentik server with the vault token instead of the blueprint's auto-generated one. Drive both from a single rendered script over a target list. Also raise the server healthcheck start_period to 120s: cold first boot runs DB migrations plus app init (~90s observed), which tripped compose --wait as unhealthy at the old 30s. Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
26 lines
880 B
Django/Jinja
26 lines
880 B
Django/Jinja
from authentik.outposts.models import Outpost
|
|
from authentik.core.models import Token
|
|
|
|
# (outpost name, desired token key) for every outpost we pin a known
|
|
# token on: the LDAP outpost plus any proxy outpost that declares a
|
|
# `token` (co-located proxy outposts authenticate with it against the
|
|
# authentik server).
|
|
_targets = [
|
|
{% if authentik_ldap_outpost.name is defined %}
|
|
('{{ authentik_ldap_outpost.name }}', '{{ authentik_ldap_outpost.token }}'),
|
|
{% endif %}
|
|
{% for o in authentik_proxy_outposts | default([]) if o.token is defined %}
|
|
('{{ o.name }}', '{{ o.token }}'),
|
|
{% endfor %}
|
|
]
|
|
|
|
changed = False
|
|
for name, key in _targets:
|
|
o = Outpost.objects.get(name=name)
|
|
t = Token.objects.get(identifier=o.token_identifier)
|
|
if t.key != key:
|
|
t.key = key
|
|
t.save(update_fields=['key'])
|
|
changed = True
|
|
|
|
print('changed' if changed else 'ok')
|