60 lines
2.2 KiB
YAML
60 lines
2.2 KiB
YAML
---
|
|
# ansible/roles/proxmox/tasks/oidc.yml
|
|
#
|
|
# Configures Proxmox to authenticate against Authentik via OpenID Connect.
|
|
# This only needs to run on ONE node in the cluster since realm config
|
|
# is stored in /etc/pve/domains.cfg (cluster-wide via pmxcfs).
|
|
|
|
- name: Check if OIDC realm already exists
|
|
ansible.builtin.command:
|
|
cmd: pveum realm list --output-format json
|
|
register: proxmox_realms
|
|
changed_when: false
|
|
|
|
- name: Parse existing realms
|
|
ansible.builtin.set_fact:
|
|
proxmox_realm_exists: >-
|
|
{{ proxmox_realms.stdout | from_json | selectattr('realm', 'equalto', proxmox_oidc_realm_name) | list | length > 0 }}
|
|
|
|
- name: Add OIDC realm for Authentik
|
|
ansible.builtin.shell: >-
|
|
pveum realm add {{ proxmox_oidc_realm_name }}
|
|
--type openid
|
|
--issuer-url '{{ proxmox_oidc_issuer_url }}'
|
|
--client-id '{{ proxmox_oidc_client_id }}'
|
|
--client-key '{{ proxmox_oidc_client_key }}'
|
|
--username-claim '{{ proxmox_oidc_username_claim }}'
|
|
--scopes '{{ proxmox_oidc_scopes }}'
|
|
--autocreate {{ proxmox_oidc_autocreate | ternary('1', '0') }}
|
|
--comment '{{ proxmox_oidc_comment }}'
|
|
{% if proxmox_oidc_default_realm %}--default 1{% endif %}
|
|
when: not proxmox_realm_exists
|
|
no_log: true
|
|
|
|
- name: Update OIDC realm for Authentik
|
|
ansible.builtin.shell: >-
|
|
pveum realm modify {{ proxmox_oidc_realm_name }}
|
|
--issuer-url '{{ proxmox_oidc_issuer_url }}'
|
|
--client-id '{{ proxmox_oidc_client_id }}'
|
|
--client-key '{{ proxmox_oidc_client_key }}'
|
|
--scopes '{{ proxmox_oidc_scopes }}'
|
|
--autocreate {{ proxmox_oidc_autocreate | ternary('1', '0') }}
|
|
--comment '{{ proxmox_oidc_comment }}'
|
|
{% if proxmox_oidc_default_realm %}--default 1{% endif %}
|
|
when: proxmox_realm_exists
|
|
no_log: true
|
|
|
|
# --- ACL Configuration ---
|
|
|
|
- name: Configure ACL entries for OIDC users
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
pveum acl modify {{ item.path }}
|
|
{% if item.user is defined %}--users {{ item.user }}{% endif %}
|
|
{% if item.group is defined %}--groups {{ item.group }}{% endif %}
|
|
--roles {{ item.role }}
|
|
loop: "{{ proxmox_oidc_acl_entries }}"
|
|
loop_control:
|
|
label: "{{ item.user | default(item.group) }} -> {{ item.role }} on {{ item.path }}"
|
|
when: proxmox_oidc_acl_entries | length > 0
|