scottk/homelab
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/homelab.git synced 2025-11-01 02:18:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(authelia): harden oidc clients

Browse Source
This commit is contained in:
Vegard Hagen
2025-01-11 10:41:59 +01:00
parent ae355bb427
commit d816953b98
4 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
k8s/infra/auth/authelia/values.yaml
View File

@@ -75,42 +75,54 @@ configMap:
allowed_origins_from_client_redirect_uris: true allowed_origins_from_client_redirect_uris: true
endpoints: [ userinfo, authorization, token, revocation, introspection ] endpoints: [ userinfo, authorization, token, revocation, introspection ]
clients: clients:
- client_id: argocd - client_id: argocd
client_secret: { path: /secrets/client-argocd/client_secret.txt } client_secret: { path: /secrets/client-argocd/client_secret.txt }
client_name: Argo CD client_name: Argo CD
public: false public: false
authorization_policy: two_factor authorization_policy: two_factor
pre_configured_consent_duration: 1 month
redirect_uris: redirect_uris:
- https://argocd.stonegarden.dev/auth/callback - https://argocd.stonegarden.dev/auth/callback
- https://argocd.stonegarden.dev/applications - https://argocd.stonegarden.dev/applications
scopes: [ openid, groups, email, profile, offline_access ] scopes: [ openid, groups, email, profile, offline_access ]
userinfo_signed_response_alg: none userinfo_signed_response_alg: none
id_token_signed_response_alg: ES256 id_token_signed_response_alg: ES256
access_token_signed_response_alg: ES256
- client_id: argocd-cli - client_id: argocd-cli
client_name: Argo CD (CLI) client_name: Argo CD (CLI)
public: true public: true
authorization_policy: two_factor authorization_policy: two_factor
pre_configured_consent_duration: 1 month
redirect_uris: [ http://localhost:8085/auth/callback ] redirect_uris: [ http://localhost:8085/auth/callback ]
scopes: [ openid, groups, email, profile, offline_access ] scopes: [ openid, groups, email, profile, offline_access ]
userinfo_signed_response_alg: none id_token_signed_response_alg: ES256
access_token_signed_response_alg: ES256
- client_id: kubectl - client_id: kubectl
client_name: kubectl client_name: kubectl
public: true public: true
authorization_policy: two_factor authorization_policy: two_factor
pre_configured_consent_duration: 1 month
require_pkce: true
redirect_uris: [ http://localhost:8000, http://localhost:18000 ] redirect_uris: [ http://localhost:8000, http://localhost:18000 ]
scopes: [ openid, groups, email, profile, offline_access ] scopes: [ openid, groups, email, profile, offline_access ]
userinfo_signed_response_alg: none
- client_id: netbird - client_id: netbird
client_secret: { path: /secrets/client-netbird/client_secret.txt } client_secret: { path: /secrets/client-netbird/client_secret.txt }
client_name: NetBird client_name: NetBird
public: false public: false
authorization_policy: two_factor authorization_policy: two_factor
pre_configured_consent_duration: 1 month
require_pkce: true
pkce_challenge_method: S256
audience: [ netbird ] audience: [ netbird ]
redirect_uris: redirect_uris:
- http://localhost:53000 - http://localhost:53000
- https://netbird.stonegarden.dev/callback - https://netbird.stonegarden.dev/callback
- https://netbird.stonegarden.dev/silent-callback - https://netbird.stonegarden.dev/silent-callback
scopes: [ openid, profile, email ] scopes: [ openid, profile, email, offline_access ]
token_endpoint_auth_method: client_secret_post token_endpoint_auth_method: client_secret_post
secret: secret:

2
k8s/infra/vpn/netbird/agent/daemon-set.yaml
View File

@@ -40,7 +40,7 @@ spec:
mountPath: /var/lib/netbird mountPath: /var/lib/netbird
resources: resources:
requests: requests:
memory: 192Mi memory: 128Mi
cpu: 100m cpu: 100m
limits: limits:
memory: 256Mi memory: 256Mi

2
k8s/infra/vpn/netbird/management/deployment.yaml
View File

@@ -80,7 +80,7 @@ spec:
containerPort: 80 containerPort: 80
resources: resources:
requests: requests:
memory: 256Mi memory: 64Mi
cpu: 200m cpu: 200m
limits: limits:
memory: 512Mi memory: 512Mi

7
k8s/infra/vpn/netbird/relay/deployment.yaml
View File

@@ -35,3 +35,10 @@ spec:
- containerPort: 80 - containerPort: 80
name: relay name: relay
protocol: TCP protocol: TCP
resources:
requests:
memory: 16Mi
cpu: 10m
limits:
memory: 64Mi
cpu: 4000m