diff --git a/manuscript/CHANGELOG.md b/manuscript/CHANGELOG.md index 9405c12..c625ca3 100644 --- a/manuscript/CHANGELOG.md +++ b/manuscript/CHANGELOG.md @@ -2,25 +2,25 @@ ## Subscribe to updates -* Email : Sign up [here](http://eepurl.com/dfx95n) (double-opt-in) to receive email updates on new and improve recipes! + +

Notify me 🔔

Be the first to know when recipes are added / improved!

We won't send you spam. Unsubscribe at any time. No monkey-business.

Powered By ConvertKit
+ +Also available via: + * Mastodon: https://mastodon.social/@geekcookbook_changes * RSS: https://mastodon.social/@geekcookbook_changes.rss * The #changelog channel in our [Discord server](http://chat.funkypenguin.co.nz) -## Recent additions to work-in-progress - -* Kubernetes recipes for UniFi controller, Miniflux, Kanboard and PrivateBin coming in March! (_19 Mar 2019_) - ## Recently added recipes + * Overhauled [Ceph (Shared Storage)](https://geek-cookbook.funkypenguin.co.nz/ha-docker-swarm/shared-storage-ceph/) recipe for Ceph Octopus (v15) (_25 May 2020_) * Added recipe for making your own [DIY Kubernetes Cluster](/kubernetes/diycluster/) (_14 December 2019_) * Added recipe for [authenticating Traefik Forward Auth against KeyCloak](/ha-docker-swarm/traefik-forward-auth/keycloak/) (_16 May 2019_) * Added [Bitwarden](/recipes/bitwarden/), an **awesome** open-source password manager, with great mobile sync support (_14 May 2019_) -* Added [Traefik Forward Auth](/ha-docker-swarm/traefik-forward-auth/), replacing function of multiple [oauth_proxies](/reference/oauth_proxy/) with a single, 7MB Go application, which can authenticate against Google, [KeyCloak](/recipes/keycloak/), and other OIDC providers (_10 May 2019_) ## Recent improvements +* Updated [Traefik Forward Auth](/ha-docker-swarm/traefik-forward-auth/) for latest @thomseddon image (_11 Jun 2020_) * Added recipe for [automated snapshots of Kubernetes Persistent Volumes](/kubernetes/snapshots/), instructions for using [Helm](/kubernetes/helm/), and recipe for deploying [Traefik](/kubernetes/traefik/), which completes the Kubernetes cluster design! (_9 Feb 2019_) * Added detailed description (_and diagram_) of our [Kubernetes design](/kubernetes/design/), plus a [simple load-balancer design](kubernetes/loadbalancer/) to avoid the complexities/costs of permitting ingress access to a cluster (_7 Feb 2019_) -* Added an [introductory/explanatory page, including a children's story, on Kubernetes](/kubernetes/start/) (_29 Jan 2019_) -* [NextCloud](/recipes/nextcloud/) updated to fix CalDAV/CardDAV service discovery behind Traefik reverse proxy (_12 Dec 2018_) +* Added an [introductory/explanatory page, including a children's story, on Kubernetes](/kubernetes/start/) (_29 Jan 2019_) \ No newline at end of file diff --git a/manuscript/ha-docker-swarm/traefik-forward-auth.md b/manuscript/ha-docker-swarm/traefik-forward-auth.md index dddd74e..88bbe69 100644 --- a/manuscript/ha-docker-swarm/traefik-forward-auth.md +++ b/manuscript/ha-docker-swarm/traefik-forward-auth.md @@ -29,16 +29,17 @@ Log into https://console.developers.google.com/, create a new project then searc Fill out the "OAuth Consent Screen" tab, and then click, "**Create Credentials**" > "**OAuth client ID**". Select "**Web Application**", fill in the name of your app, skip "**Authorized JavaScript origins**" and fill "**Authorized redirect URIs**" with either all the domains you will allow authentication from, appended with the url-path (*e.g. https://radarr.example.com/_oauth, https://radarr.example.com/_oauth, etc*), or if you don't like frustration, use a "auth host" URL instead, like "*https://auth.example.com/_oauth*" (*see below for details*) -Store your client ID and secret safely - you'll need them for the next step. +!!! tip + Store your client ID and secret safely - you'll need them for the next step. ### Prepare environment -Create `/var/data/config/traefik/traefik-forward-auth.env` as follows: +Create `/var/data/config/traefik-forward-auth/traefik-forward-auth.env` as follows: ``` -CLIENT_ID= -CLIENT_SECRET= +GOOGLE_CLIENT_ID= +GOOGLE_CLIENT_SECRET= OIDC_ISSUER=https://accounts.google.com SECRET= # uncomment this to use a single auth host instead of individual redirect_uris (recommended but advanced) @@ -48,12 +49,12 @@ COOKIE_DOMAINS=example.com ### Prepare the docker service config -This is a small container, you can simply add the following content to the existing `traefik-app.yml` deployed in the previous [Traefik](/recipes/traefik/) recipe: +Create `/var/data/config/traefik-forward-auth/traefik-forward-auth.yml` as follows: ``` traefik-forward-auth: - image: funkypenguin/traefik-forward-auth - env_file: /var/data/config/traefik/traefik-forward-auth.env + image: thomseddon/traefik-forward-auth:2.1.0 + env_file: /var/data/config/traefik-forward-auth/traefik-forward-auth.env networks: - traefik_public # Uncomment these lines if you're using auth host mode @@ -65,7 +66,7 @@ This is a small container, you can simply add the following content to the exist # - traefik.frontend.auth.forward.trustForwardHeader=true ``` -If you're not confident that forward authentication is working, add a simple "whoami" test container, to help debug traefik forward auth, before attempting to add it to a more complex container. +If you're not confident that forward authentication is working, add a simple "whoami" test container to the above .yml, to help debug traefik forward auth, before attempting to add it to a more complex container. ``` # This simply validates that traefik forward authentication is working @@ -91,7 +92,7 @@ If you're not confident that forward authentication is working, add a simple "wh ### Launch -Redeploy traefik with ```docker stack deploy traefik-app -c /var/data/traefik/traeifk-app.yml```, to launch the traefik-forward-auth container. +Redeploy traefik with ```docker stack deploy traefik-forward-auth -c /var/data/traefik-forward-auth/traefik-forward-auth.yml```, to launch the traefik-forward-auth stack. ### Test @@ -111,6 +112,4 @@ What have we achieved? By adding an additional three simple labels to any servic ## Chef's Notes 📓 1. Traefik forward auth replaces the use of [oauth_proxy containers](/reference/oauth_proxy/) found in some of the existing recipes -2. [@thomaseddon's original version](https://github.com/thomseddon/traefik-forward-auth) of traefik-forward-auth only works with Google currently, but I've created a [fork](https://www.github.com/funkypenguin/traefik-forward-auth) of a [fork](https://github.com/noelcatt/traefik-forward-auth), which implements generic OIDC providers. -3. I reviewed several implementations of forward authenticators for Traefik, but found most to be rather heavy-handed, or specific to a single auth provider. @thomaseddon's go-based docker image is 7MB in size, and with the generic OIDC patch (above), it can be extended to work with any OIDC provider. -4. No, not github natively, but you can ferderate GitHub into KeyCloak, and then use KeyCloak as the OIDC provider. +2. I reviewed several implementations of forward authenticators for Traefik, but found most to be rather heavy-handed, or specific to a single auth provider. @thomaseddon's go-based docker image is 7MB in size, and can be extended to work with any OIDC provider. \ No newline at end of file diff --git a/manuscript/premix/ansible/operation.md b/manuscript/premix/ansible/operation.md index fb6ff2c..14a77ac 100644 --- a/manuscript/premix/ansible/operation.md +++ b/manuscript/premix/ansible/operation.md @@ -25,7 +25,7 @@ k3s_masters k3s_workers [proxmox_servers] -splinter ansible_host=192.168.29.3 ansible_user=root +splinter ansible_host=192.168.29.3 ansible_user=root template_vm_id=201 # Declare your desired proxmox VMs here. Note that the MAC address "lines up" with_ # the IP address - this makes troubleshooting L2 issues easier under some circumstances, @@ -33,12 +33,12 @@ splinter ansible_host=192.168.29.3 ansible_user=root # when re-running the playbook. [proxmox_vms] -raphael ansible_host=192.168.38.101 mac=52:54:00:38:01:01 -donatello ansible_host=192.168.38.102 mac=52:54:00:38:01:02 -leonardo ansible_host=192.168.38.103 mac=52:54:00:38:01:03 -shredder ansible_host=192.168.38.201 mac=52:54:00:38:02:01 -rocksteady ansible_host=192.168.38.202 mac=52:54:00:38:02:02 -bebop ansible_host=192.168.38.203 mac=52:54:00:38:02:03 +donatello ansible_host=192.168.38.102 mac=52:54:00:38:01:02 proxmox_node=splinter +leonardo ansible_host=192.168.38.103 mac=52:54:00:38:01:03 proxmox_node=splinter +shredder ansible_host=192.168.38.201 mac=52:54:00:38:02:01 proxmox_node=splinter +raphael ansible_host=192.168.38.101 mac=52:54:00:38:01:01 proxmox_node=splinter +rocksteady ansible_host=192.168.38.202 mac=52:54:00:38:02:02 proxmox_node=splinter +bebop ansible_host=192.168.38.203 mac=52:54:00:38:02:03 proxmox_node=splinter [swarm_nodes] raphael ansible_host=192.168.38.101 keepalived_priority=101 @@ -60,12 +60,11 @@ bebop ansible_host=192.168.38.203 ### Config -The variables used in the playbook are defined in `ansible/group_vars/all/main.yml`. **Your** variables are going to be defined in a group_vars file based on your username, so that they're [treated with a higher preference](https://docs.ansible.com/ansible/latest/user_guide/playbooks_variables.html#variable-precedence-where-should-i-put-a-variable) than the default values. +The variables used in the playbook are defined in the `ansible/group_vars/all/main.yml`. **Your** variables are going to be defined in a group_vars file based on your username, so that they're [treated with a higher preference](https://docs.ansible.com/ansible/latest/user_guide/playbooks_variables.html#variable-precedence-where-should-i-put-a-variable) than the default values. -Create a folder under `ansible/group_vars/` to match the group name you inserted in line \#1 of your hosts file, and copy `ansible/group_vars/all/main.yml` into this folder. Any values found in this file will override any values specified in `ansible/group_vars/all/main.yml`, but any values _not_ found in your file will be inherited from `ansible/group_vars/all/main.yml`. +Create a folder under `ansible/group_vars/` to match the group name you inserted in line \#1 of your hosts file, and copy `ansible/group_vars/all/main.yml` into this folder. Any variables found in this file will override any variables specified in `ansible/group_vars/all/main.yml`, but any variables _not_ found in your file will be inherited from `ansible/group_vars/all/main.yml`. -!!! tip "Go to town with your delete key" - To keep your version clean, edit `ansible/group_vars//main.yml` and delete anything you don't care to change. This will keep your "override" file nice and clean. +To further streamline config, a "empty" dictionary variable named `recipe_config` is configured in `ansible/group_vars/all/main.yml`. In your own vars file (`ansible/group_vars//main.yml`), populate this variable with your own preferred values, copied from `recipe_default_config`. When the playbook runs, your values will be combined with the default values. !!! tip "Commit `ansible/group_vars//` to your own repo" For extra geek-fu, you could commit the contents of ``ansible/group_vars//` to your own repo, so that you can version/track your own config! diff --git a/scripts/recipe-footer.md b/scripts/recipe-footer.md index 8afb830..eae6efe 100644 --- a/scripts/recipe-footer.md +++ b/scripts/recipe-footer.md @@ -6,7 +6,9 @@ Did you receive excellent service? Want to make your waiter happy? (_..and suppo Want to know now when this recipe gets updated, or when future recipes are added? Subscribe to the [RSS feed](https://mastodon.social/@geekcookbook_changes.atom), or leave your email address below, and we'll keep you updated. (*double-opt-in, no monkey business, no spam) -
+
+ + ## Your comments? 💬