27 lines
1.5 KiB
Bash
Executable File
27 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
umask 077
|
|
cd "$(dirname "${BASH_SOURCE[0]}")"
|
|
[[ $(kubectl config current-context) == kubernetes-admin@kubernetes ]] || { echo 'Wrong Kubernetes context' >&2; exit 1; }
|
|
|
|
workdir=$(mktemp -d)
|
|
chmod 700 "$workdir"
|
|
trap 'rm -rf "$workdir"' EXIT
|
|
|
|
if kubectl -n paperless-ngx get secret paperless-oidc -o jsonpath='{.data.providers}' 2>/dev/null | base64 -d > "$workdir/providers.json" && [[ -s "$workdir/providers.json" ]]; then
|
|
echo 'Keeping the existing Paperless OIDC client secret.'
|
|
else
|
|
openssl rand -hex 32 | tr -d '\n' > "$workdir/client-secret"
|
|
jq -n --rawfile secret "$workdir/client-secret" '{openid_connect:{OAUTH_PKCE_ENABLED:true,APPS:[{provider_id:"authentik",name:"authentik",client_id:"paperless-ngx",secret:$secret,settings:{server_url:"https://auth.brunner.ninja/application/o/paperless-ngx/.well-known/openid-configuration",fetch_userinfo:true}}],SCOPE:["openid","profile","email"]}}' > "$workdir/providers.json"
|
|
kubectl -n paperless-ngx create secret generic paperless-oidc --from-file="providers=$workdir/providers.json"
|
|
fi
|
|
|
|
jq -er '.openid_connect.APPS[] | select(.provider_id == "authentik") | .secret' "$workdir/providers.json" | tr -d '\n' > "$workdir/client-secret"
|
|
{
|
|
printf 'CLIENT_SECRET = '
|
|
jq -Rs . < "$workdir/client-secret"
|
|
cat authentik-setup.py
|
|
} > "$workdir/setup.py"
|
|
chmod 600 "$workdir"/*
|
|
kubectl -n authentik exec -i deployment/authentik-worker -- ak shell --no-imports --interface python < "$workdir/setup.py"
|