34 lines
2.1 KiB
Bash
Executable File
34 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
umask 077
|
|
cd "$(dirname "${BASH_SOURCE[0]}")"
|
|
[[ $(kubectl config current-context) == kubernetes-admin@kubernetes ]] || { echo 'Wrong Kubernetes context' >&2; exit 1; }
|
|
|
|
workdir=$(mktemp -d)
|
|
display_name='brunner.ninja Auth'
|
|
chmod 700 "$workdir"
|
|
trap 'rm -rf "$workdir"' EXIT
|
|
|
|
if kubectl -n paperless-ngx get secret paperless-oidc -o jsonpath='{.data.providers}' 2>/dev/null | base64 -d > "$workdir/providers.json" && [[ -s "$workdir/providers.json" ]]; then
|
|
echo 'Keeping the existing Paperless OIDC client secret.'
|
|
else
|
|
openssl rand -hex 32 | tr -d '\n' > "$workdir/client-secret"
|
|
jq -n --arg name "$display_name" --rawfile secret "$workdir/client-secret" '{openid_connect:{OAUTH_PKCE_ENABLED:true,APPS:[{provider_id:"authentik",name:$name,client_id:"paperless-ngx",secret:$secret,settings:{server_url:"https://auth.brunner.ninja/application/o/paperless-ngx/.well-known/openid-configuration",fetch_userinfo:true}}],SCOPE:["openid","profile","email"]}}' > "$workdir/providers.json"
|
|
kubectl -n paperless-ngx create secret generic paperless-oidc --from-file="providers=$workdir/providers.json"
|
|
fi
|
|
|
|
if ! jq -e --arg name "$display_name" '.openid_connect.APPS[] | select(.provider_id == "authentik" and .name == $name)' "$workdir/providers.json" >/dev/null; then
|
|
jq --arg name "$display_name" '(.openid_connect.APPS[] | select(.provider_id == "authentik") | .name) = $name' "$workdir/providers.json" > "$workdir/providers-updated.json"
|
|
kubectl -n paperless-ngx create secret generic paperless-oidc --from-file="providers=$workdir/providers-updated.json" --dry-run=client -o yaml | kubectl apply -f -
|
|
cp "$workdir/providers-updated.json" "$workdir/providers.json"
|
|
fi
|
|
|
|
jq -er '.openid_connect.APPS[] | select(.provider_id == "authentik") | .secret' "$workdir/providers.json" | tr -d '\n' > "$workdir/client-secret"
|
|
{
|
|
printf 'CLIENT_SECRET = '
|
|
jq -Rs . < "$workdir/client-secret"
|
|
cat authentik-setup.py
|
|
} > "$workdir/setup.py"
|
|
chmod 600 "$workdir"/*
|
|
kubectl -n authentik exec -i deployment/authentik-worker -- ak shell --no-imports --interface python < "$workdir/setup.py"
|