mirror of
https://github.com/funkypenguin/geek-cookbook/
synced 2026-10-22 08:43:24 +00:00
Update traefik-forward-auth for official image supporting multiple OIDC providers
This commit is contained in:
4 files changed
+32
-32
No files matched your search
@@ -2,25 +2,25 @@
|
||||
|
||||
## Subscribe to updates
|
||||
|
||||
* Email : Sign up [here](http://eepurl.com/dfx95n) (double-opt-in) to receive email updates on new and improve recipes!
|
||||
<script src="https://f.convertkit.com/ckjs/ck.5.js"></script>
|
||||
<form action="https://app.convertkit.com/forms/1413027/subscriptions" class="seva-form formkit-form" method="post" data-sv-form="1413027" data-uid="20249aa846" data-format="inline" data-version="5" data-options="{"settings":{"after_subscribe":{"action":"message","success_message":"Success! Now check your email to confirm your subscription.","redirect_url":""},"analytics":{"google":null,"facebook":null,"segment":null,"pinterest":null},"modal":{"trigger":"timer","scroll_percentage":null,"timer":5,"devices":"all","show_once_every":15},"powered_by":{"show":true,"url":"https://convertkit.com?utm_source=dynamic&utm_medium=referral&utm_campaign=poweredby&utm_content=form"},"recaptcha":{"enabled":true},"return_visitor":{"action":"custom_content","custom_content":"You're subscribed!"},"slide_in":{"display_in":"bottom_right","trigger":"timer","scroll_percentage":null,"timer":5,"devices":"all","show_once_every":15},"sticky_bar":{"display_in":"top","trigger":"timer","scroll_percentage":null,"timer":5,"devices":"all","show_once_every":15}},"version":"5"}" min-width="400 500 600 700 800" style="background-color: rgb(249, 250, 251); border-radius: 4px;"><div class="formkit-background" style="opacity: 0.2;"></div><div data-style="minimal"><div class="formkit-header" data-element="header" style="color: rgb(77, 77, 77); font-size: 27px; font-weight: 700;"><h1><span style="color:rgb(74, 74, 74)"><strong>Notify me 🔔</strong></span></h1></div><div class="formkit-subheader" data-element="subheader" style="color: rgb(104, 104, 104); font-size: 18px;"><p><span style="color:rgb(74, 74, 74)">Be the first to know when recipes are added / improved!</span></p></div><ul class="formkit-alert formkit-alert-error" data-element="errors" data-group="alert"></ul><div data-element="fields" data-stacked="true" class="seva-fields formkit-fields"><div class="formkit-field"><input class="formkit-input" aria-label="Your first name" name="fields[first_name]" placeholder="Your first name" type="text" style="color: rgb(0, 0, 0); border-color: rgb(227, 227, 227); border-radius: 4px; font-weight: 400;"></div><div class="formkit-field"><input class="formkit-input" name="email_address" placeholder="Your email address" required="" type="email" style="color: rgb(0, 0, 0); border-color: rgb(227, 227, 227); border-radius: 4px; font-weight: 400;"></div><button data-element="submit" class="formkit-submit formkit-submit" style="color: rgb(255, 255, 255); background-color: rgb(0, 0, 0); border-radius: 4px; font-weight: 400;"><div class="formkit-spinner"><div></div><div></div><div></div></div><span>Send me new recipes!</span></button></div><div class="formkit-guarantee" data-element="guarantee" style="color: rgb(77, 77, 77); font-size: 13px; font-weight: 400;"><p>We won't send you spam. Unsubscribe at any time. No monkey-business.</p></div><a href="https://convertkit.com?utm_source=dynamic&utm_medium=referral&utm_campaign=poweredby&utm_content=form" class="formkit-powered-by" data-element="powered-by" target="_blank" rel="noopener noreferrer">Powered By ConvertKit</a></div><style>.formkit-form[data-uid="20249aa846"] *{box-sizing:border-box;}.formkit-form[data-uid="20249aa846"]{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;}.formkit-form[data-uid="20249aa846"] legend{border:none;font-size:inherit;margin-bottom:10px;padding:0;position:relative;display:table;}.formkit-form[data-uid="20249aa846"] fieldset{border:0;padding:0.01em 0 0 0;margin:0;min-width:0;}.formkit-form[data-uid="20249aa846"] body:not(:-moz-handler-blocked) fieldset{display:table-cell;}.formkit-form[data-uid="20249aa846"] h1,.formkit-form[data-uid="20249aa846"] h2,.formkit-form[data-uid="20249aa846"] h3,.formkit-form[data-uid="20249aa846"] h4,.formkit-form[data-uid="20249aa846"] h5,.formkit-form[data-uid="20249aa846"] h6{color:inherit;font-size:inherit;font-weight:inherit;}.formkit-form[data-uid="20249aa846"] p{color:inherit;font-size:inherit;font-weight:inherit;}.formkit-form[data-uid="20249aa846"] ol:not([template-default]),.formkit-form[data-uid="20249aa846"] ul:not([template-default]),.formkit-form[data-uid="20249aa846"] blockquote:not([template-default]){text-align:left;}.formkit-form[data-uid="20249aa846"] p:not([template-default]),.formkit-form[data-uid="20249aa846"] hr:not([template-default]),.formkit-form[data-uid="20249aa846"] blockquote:not([template-default]),.formkit-form[data-uid="20249aa846"] ol:not([templaLine truncated
|
||||
|
||||
Also available via:
|
||||
|
||||
* Mastodon: https://mastodon.social/@geekcookbook_changes
|
||||
* RSS: https://mastodon.social/@geekcookbook_changes.rss
|
||||
* The #changelog channel in our [Discord server](http://chat.funkypenguin.co.nz)
|
||||
|
||||
## Recent additions to work-in-progress
|
||||
|
||||
* Kubernetes recipes for UniFi controller, Miniflux, Kanboard and PrivateBin coming in March! (_19 Mar 2019_)
|
||||
|
||||
## Recently added recipes
|
||||
|
||||
* Overhauled [Ceph (Shared Storage)](https://geek-cookbook.funkypenguin.co.nz/ha-docker-swarm/shared-storage-ceph/) recipe for Ceph Octopus (v15) (_25 May 2020_)
|
||||
* Added recipe for making your own [DIY Kubernetes Cluster](/kubernetes/diycluster/) (_14 December 2019_)
|
||||
* Added recipe for [authenticating Traefik Forward Auth against KeyCloak](/ha-docker-swarm/traefik-forward-auth/keycloak/) (_16 May 2019_)
|
||||
* Added [Bitwarden](/recipes/bitwarden/), an **awesome** open-source password manager, with great mobile sync support (_14 May 2019_)
|
||||
* Added [Traefik Forward Auth](/ha-docker-swarm/traefik-forward-auth/), replacing function of multiple [oauth_proxies](/reference/oauth_proxy/) with a single, 7MB Go application, which can authenticate against Google, [KeyCloak](/recipes/keycloak/), and other OIDC providers (_10 May 2019_)
|
||||
|
||||
## Recent improvements
|
||||
|
||||
* Updated [Traefik Forward Auth](/ha-docker-swarm/traefik-forward-auth/) for latest @thomseddon image (_11 Jun 2020_)
|
||||
* Added recipe for [automated snapshots of Kubernetes Persistent Volumes](/kubernetes/snapshots/), instructions for using [Helm](/kubernetes/helm/), and recipe for deploying [Traefik](/kubernetes/traefik/), which completes the Kubernetes cluster design! (_9 Feb 2019_)
|
||||
* Added detailed description (_and diagram_) of our [Kubernetes design](/kubernetes/design/), plus a [simple load-balancer design](kubernetes/loadbalancer/) to avoid the complexities/costs of permitting ingress access to a cluster (_7 Feb 2019_)
|
||||
* Added an [introductory/explanatory page, including a children's story, on Kubernetes](/kubernetes/start/) (_29 Jan 2019_)
|
||||
* [NextCloud](/recipes/nextcloud/) updated to fix CalDAV/CardDAV service discovery behind Traefik reverse proxy (_12 Dec 2018_)
|
||||
* Added an [introductory/explanatory page, including a children's story, on Kubernetes](/kubernetes/start/) (_29 Jan 2019_)
|
||||
@@ -29,16 +29,17 @@ Log into https://console.developers.google.com/, create a new project then searc
|
||||
|
||||
Fill out the "OAuth Consent Screen" tab, and then click, "**Create Credentials**" > "**OAuth client ID**". Select "**Web Application**", fill in the name of your app, skip "**Authorized JavaScript origins**" and fill "**Authorized redirect URIs**" with either all the domains you will allow authentication from, appended with the url-path (*e.g. https://radarr.example.com/_oauth, https://radarr.example.com/_oauth, etc*), or if you don't like frustration, use a "auth host" URL instead, like "*https://auth.example.com/_oauth*" (*see below for details*)
|
||||
|
||||
Store your client ID and secret safely - you'll need them for the next step.
|
||||
!!! tip
|
||||
Store your client ID and secret safely - you'll need them for the next step.
|
||||
|
||||
|
||||
### Prepare environment
|
||||
|
||||
Create `/var/data/config/traefik/traefik-forward-auth.env` as follows:
|
||||
Create `/var/data/config/traefik-forward-auth/traefik-forward-auth.env` as follows:
|
||||
|
||||
```
|
||||
CLIENT_ID=<your client id>
|
||||
CLIENT_SECRET=<your client secret>
|
||||
GOOGLE_CLIENT_ID=<your client id>
|
||||
GOOGLE_CLIENT_SECRET=<your client secret>
|
||||
OIDC_ISSUER=https://accounts.google.com
|
||||
SECRET=<a random string, make it up>
|
||||
# uncomment this to use a single auth host instead of individual redirect_uris (recommended but advanced)
|
||||
@@ -48,12 +49,12 @@ COOKIE_DOMAINS=example.com
|
||||
|
||||
### Prepare the docker service config
|
||||
|
||||
This is a small container, you can simply add the following content to the existing `traefik-app.yml` deployed in the previous [Traefik](/recipes/traefik/) recipe:
|
||||
Create `/var/data/config/traefik-forward-auth/traefik-forward-auth.yml` as follows:
|
||||
|
||||
```
|
||||
traefik-forward-auth:
|
||||
image: funkypenguin/traefik-forward-auth
|
||||
env_file: /var/data/config/traefik/traefik-forward-auth.env
|
||||
image: thomseddon/traefik-forward-auth:2.1.0
|
||||
env_file: /var/data/config/traefik-forward-auth/traefik-forward-auth.env
|
||||
networks:
|
||||
- traefik_public
|
||||
# Uncomment these lines if you're using auth host mode
|
||||
@@ -65,7 +66,7 @@ This is a small container, you can simply add the following content to the exist
|
||||
# - traefik.frontend.auth.forward.trustForwardHeader=true
|
||||
```
|
||||
|
||||
If you're not confident that forward authentication is working, add a simple "whoami" test container, to help debug traefik forward auth, before attempting to add it to a more complex container.
|
||||
If you're not confident that forward authentication is working, add a simple "whoami" test container to the above .yml, to help debug traefik forward auth, before attempting to add it to a more complex container.
|
||||
|
||||
```
|
||||
# This simply validates that traefik forward authentication is working
|
||||
@@ -91,7 +92,7 @@ If you're not confident that forward authentication is working, add a simple "wh
|
||||
|
||||
### Launch
|
||||
|
||||
Redeploy traefik with ```docker stack deploy traefik-app -c /var/data/traefik/traeifk-app.yml```, to launch the traefik-forward-auth container.
|
||||
Redeploy traefik with ```docker stack deploy traefik-forward-auth -c /var/data/traefik-forward-auth/traefik-forward-auth.yml```, to launch the traefik-forward-auth stack.
|
||||
|
||||
### Test
|
||||
|
||||
@@ -111,6 +112,4 @@ What have we achieved? By adding an additional three simple labels to any servic
|
||||
## Chef's Notes 📓
|
||||
|
||||
1. Traefik forward auth replaces the use of [oauth_proxy containers](/reference/oauth_proxy/) found in some of the existing recipes
|
||||
2. [@thomaseddon's original version](https://github.com/thomseddon/traefik-forward-auth) of traefik-forward-auth only works with Google currently, but I've created a [fork](https://www.github.com/funkypenguin/traefik-forward-auth) of a [fork](https://github.com/noelcatt/traefik-forward-auth), which implements generic OIDC providers.
|
||||
3. I reviewed several implementations of forward authenticators for Traefik, but found most to be rather heavy-handed, or specific to a single auth provider. @thomaseddon's go-based docker image is 7MB in size, and with the generic OIDC patch (above), it can be extended to work with any OIDC provider.
|
||||
4. No, not github natively, but you can ferderate GitHub into KeyCloak, and then use KeyCloak as the OIDC provider.
|
||||
2. I reviewed several implementations of forward authenticators for Traefik, but found most to be rather heavy-handed, or specific to a single auth provider. @thomaseddon's go-based docker image is 7MB in size, and can be extended to work with any OIDC provider.
|
||||
@@ -25,7 +25,7 @@ k3s_masters
|
||||
k3s_workers
|
||||
|
||||
[proxmox_servers]
|
||||
splinter ansible_host=192.168.29.3 ansible_user=root
|
||||
splinter ansible_host=192.168.29.3 ansible_user=root template_vm_id=201
|
||||
|
||||
# Declare your desired proxmox VMs here. Note that the MAC address "lines up" with_
|
||||
# the IP address - this makes troubleshooting L2 issues easier under some circumstances,
|
||||
@@ -33,12 +33,12 @@ splinter ansible_host=192.168.29.3 ansible_user=root
|
||||
# when re-running the playbook.
|
||||
|
||||
[proxmox_vms]
|
||||
raphael ansible_host=192.168.38.101 mac=52:54:00:38:01:01
|
||||
donatello ansible_host=192.168.38.102 mac=52:54:00:38:01:02
|
||||
leonardo ansible_host=192.168.38.103 mac=52:54:00:38:01:03
|
||||
shredder ansible_host=192.168.38.201 mac=52:54:00:38:02:01
|
||||
rocksteady ansible_host=192.168.38.202 mac=52:54:00:38:02:02
|
||||
bebop ansible_host=192.168.38.203 mac=52:54:00:38:02:03
|
||||
donatello ansible_host=192.168.38.102 mac=52:54:00:38:01:02 proxmox_node=splinter
|
||||
leonardo ansible_host=192.168.38.103 mac=52:54:00:38:01:03 proxmox_node=splinter
|
||||
shredder ansible_host=192.168.38.201 mac=52:54:00:38:02:01 proxmox_node=splinter
|
||||
raphael ansible_host=192.168.38.101 mac=52:54:00:38:01:01 proxmox_node=splinter
|
||||
rocksteady ansible_host=192.168.38.202 mac=52:54:00:38:02:02 proxmox_node=splinter
|
||||
bebop ansible_host=192.168.38.203 mac=52:54:00:38:02:03 proxmox_node=splinter
|
||||
|
||||
[swarm_nodes]
|
||||
raphael ansible_host=192.168.38.101 keepalived_priority=101
|
||||
@@ -60,12 +60,11 @@ bebop ansible_host=192.168.38.203
|
||||
|
||||
### Config
|
||||
|
||||
The variables used in the playbook are defined in `ansible/group_vars/all/main.yml`. **Your** variables are going to be defined in a group_vars file based on your username, so that they're [treated with a higher preference](https://docs.ansible.com/ansible/latest/user_guide/playbooks_variables.html#variable-precedence-where-should-i-put-a-variable) than the default values.
|
||||
The variables used in the playbook are defined in the `ansible/group_vars/all/main.yml`. **Your** variables are going to be defined in a group_vars file based on your username, so that they're [treated with a higher preference](https://docs.ansible.com/ansible/latest/user_guide/playbooks_variables.html#variable-precedence-where-should-i-put-a-variable) than the default values.
|
||||
|
||||
Create a folder under `ansible/group_vars/<your-username>` to match the group name you inserted in line \#1 of your hosts file, and copy `ansible/group_vars/all/main.yml` into this folder. Any values found in this file will override any values specified in `ansible/group_vars/all/main.yml`, but any values _not_ found in your file will be inherited from `ansible/group_vars/all/main.yml`.
|
||||
Create a folder under `ansible/group_vars/<your-username>` to match the group name you inserted in line \#1 of your hosts file, and copy `ansible/group_vars/all/main.yml` into this folder. Any variables found in this file will override any variables specified in `ansible/group_vars/all/main.yml`, but any variables _not_ found in your file will be inherited from `ansible/group_vars/all/main.yml`.
|
||||
|
||||
!!! tip "Go to town with your delete key"
|
||||
To keep your version clean, edit `ansible/group_vars/<your-username>/main.yml` and delete anything you don't care to change. This will keep your "override" file nice and clean.
|
||||
To further streamline config, a "empty" dictionary variable named `recipe_config` is configured in `ansible/group_vars/all/main.yml`. In your own vars file (`ansible/group_vars/<your-username>/main.yml`), populate this variable with your own preferred values, copied from `recipe_default_config`. When the playbook runs, your values will be combined with the default values.
|
||||
|
||||
!!! tip "Commit `ansible/group_vars/<your-username>/` to your own repo"
|
||||
For extra geek-fu, you could commit the contents of ``ansible/group_vars/<your-username>/` to your own repo, so that you can version/track your own config!
|
||||
|
||||
Reference in new issue
Block a user