mirror of
https://github.com/Alkatrazz24/Funk-lab.git
synced 2026-07-08 06:24:42 +02:00
feat(auth): annuaire Authentik + portail consoles Guacamole
- k8s/apps/authentik : IdP OIDC (auth.lab.local), namespace auth — server + worker 2026.5.3, Redis in-cluster, PG sur storage-01, PVC media - k8s/apps/guacamole : portail consoles SSH web s01/g01 (portail.lab.local) — guacd + webapp 1.6.0, SSO OIDC vers Authentik, Job initdb idempotent - ansible : rôle console_user (user sans sudo pour les consoles, s01 + g01), bases PG authentik/guacamole, secrets vault (mdp PG + clé SSH console) - doc : admin/k8s/auth-portal.md (déploiement, config initiale, pièges) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
parent
09ca0be469
commit
edf4a6294d
21 changed files with 775 additions and 64 deletions
15
CLAUDE.md
15
CLAUDE.md
|
|
@ -21,6 +21,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
|
||||||
- ✅ SearXNG opérationnel — `searxng.lab.local`, namespace `ai`, **méta-moteur de recherche web self-host** (privé, in-cluster) consommé par l'outil `web_search` d'Asa (API JSON). Manifests `k8s/apps/searxng/`
|
- ✅ SearXNG opérationnel — `searxng.lab.local`, namespace `ai`, **méta-moteur de recherche web self-host** (privé, in-cluster) consommé par l'outil `web_search` d'Asa (API JSON). Manifests `k8s/apps/searxng/`
|
||||||
- ✅ Ghostfolio opérationnel — `ghostfolio.lab.local`, namespace `ai`, suivi de portefeuille (PostgreSQL s01 + Redis in-cluster)
|
- ✅ Ghostfolio opérationnel — `ghostfolio.lab.local`, namespace `ai`, suivi de portefeuille (PostgreSQL s01 + Redis in-cluster)
|
||||||
- ✅ hermes-auto-improve — analyse quotidienne de `admin/` par Hermes à 22h (n8n → trigger :9095), PR sur `hermes/daily-work`
|
- ✅ hermes-auto-improve — analyse quotidienne de `admin/` par Hermes à 22h (n8n → trigger :9095), PR sur `hermes/daily-work`
|
||||||
|
- 🆕 Annuaire + portail consoles (2026-07-06) — **Authentik** (`auth.lab.local`, IdP OIDC) + **Guacamole** (`portail.lab.local`, consoles SSH web vers s01/g01 via user `console` sans sudo), namespace `auth`. Config initiale (admin Authentik, provider OIDC, connexions) : voir `admin/k8s/auth-portal.md`
|
||||||
- ⏳ WOL compute nodes non configuré (BIOS) — allumage manuel requis
|
- ⏳ WOL compute nodes non configuré (BIOS) — allumage manuel requis
|
||||||
|
|
||||||
Journal de progression : `PROGRESS.md` → `progress/YYYY-MM-DD.md`
|
Journal de progression : `PROGRESS.md` → `progress/YYYY-MM-DD.md`
|
||||||
|
|
@ -90,11 +91,11 @@ Les tags correspondent aux noms de rôles. Tous les rôles sont idempotents.
|
||||||
|
|
||||||
### Rôles — storage-01
|
### Rôles — storage-01
|
||||||
|
|
||||||
`hermes_user`, `common`, `gateway` (nftables + NAT), `dnsmasq`, `nfs_server`, `qdrant`, `postgresql`, `minio` (⚠️ rôle vide, service non déployé), `litellm`, `hermes_agent`, `rag`, `node_exporter`, `alertmanager_webhook`, `postfix_relay`, `hermes_auto_improve` (worker doc Hermes + trigger server :9095), `hermes_exec` (exécuteur d'actions vocales `hermes -z --yolo` derrière jeton, :9096)
|
`hermes_user`, `common`, `gateway` (nftables + NAT), `dnsmasq`, `nfs_server`, `qdrant`, `postgresql`, `minio` (⚠️ rôle vide, service non déployé), `litellm`, `hermes_agent`, `rag`, `node_exporter`, `alertmanager_webhook`, `postfix_relay`, `hermes_auto_improve` (worker doc Hermes + trigger server :9095), `hermes_exec` (exécuteur d'actions vocales `hermes -z --yolo` derrière jeton, :9096), `console_user` (user `console` sans sudo pour le portail Guacamole)
|
||||||
|
|
||||||
### Rôles — gpu-01
|
### Rôles — gpu-01
|
||||||
|
|
||||||
`hermes_user`, `common`, `rocm`, `nfs_client`, `llama_server`, `node_exporter`, `satisfactory_server` (serveur dédié Satisfactory `:7777`, steamcmd + systemd)
|
`hermes_user`, `common`, `rocm`, `nfs_client`, `llama_server`, `node_exporter`, `satisfactory_server` (serveur dédié Satisfactory `:7777`, steamcmd + systemd), `console_user` (idem storage-01)
|
||||||
|
|
||||||
> Chaque rôle a un `README.md` (variables, caveats, gaps IaC).
|
> Chaque rôle a un `README.md` (variables, caveats, gaps IaC).
|
||||||
> `lm_studio` est présent dans `ansible/roles/` mais n'est plus utilisé dans aucun playbook (déprécié, voir son README).
|
> `lm_studio` est présent dans `ansible/roles/` mais n'est plus utilisé dans aucun playbook (déprécié, voir son README).
|
||||||
|
|
@ -120,6 +121,8 @@ Variables chiffrées dans `ansible/group_vars/all/vault.yml` :
|
||||||
- `vault_postfix_relay_password` — App Password Gmail (relay SMTP)
|
- `vault_postfix_relay_password` — App Password Gmail (relay SMTP)
|
||||||
- `vault_n8n_api_key` — clé API n8n (label "claude") pour gérer les workflows via `/api/v1`
|
- `vault_n8n_api_key` — clé API n8n (label "claude") pour gérer les workflows via `/api/v1`
|
||||||
- `vault_hermes_exec_token` — jeton d'auth de `hermes-exec` (actions vocales via Hermes ; même valeur dans le secret k8s `stt-server-secrets/hermes-exec-token`)
|
- `vault_hermes_exec_token` — jeton d'auth de `hermes-exec` (actions vocales via Hermes ; même valeur dans le secret k8s `stt-server-secrets/hermes-exec-token`)
|
||||||
|
- `vault_pg_authentik_password`, `vault_pg_guacamole_password` — bases PG du portail (mêmes valeurs dans les secrets k8s `auth/authentik-secret` et `auth/guacamole-secret`)
|
||||||
|
- `vault_console_ssh_private_key` — clé privée SSH des connexions Guacamole (user `console` sur s01/g01)
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|
@ -164,6 +167,8 @@ k8s/
|
||||||
│ ├── ghostfolio.yaml
|
│ ├── ghostfolio.yaml
|
||||||
│ ├── openalice.yaml
|
│ ├── openalice.yaml
|
||||||
│ ├── finlab.yaml
|
│ ├── finlab.yaml
|
||||||
|
│ ├── authentik.yaml
|
||||||
|
│ ├── guacamole.yaml
|
||||||
│ ├── monitoring.yaml
|
│ ├── monitoring.yaml
|
||||||
│ └── nfs-provisioner.yaml
|
│ └── nfs-provisioner.yaml
|
||||||
├── apps/ # Manifests raw k8s par application
|
├── apps/ # Manifests raw k8s par application
|
||||||
|
|
@ -174,6 +179,8 @@ k8s/
|
||||||
│ ├── ghostfolio/ # namespace: ai — suivi de portefeuille (ghostfolio.lab.local)
|
│ ├── ghostfolio/ # namespace: ai — suivi de portefeuille (ghostfolio.lab.local)
|
||||||
│ ├── openalice/ # namespace: ai — agent IA financier (openalice.lab.local, back-end finance d'Asa) — ⏸️ SUSPENDU
|
│ ├── openalice/ # namespace: ai — agent IA financier (openalice.lab.local, back-end finance d'Asa) — ⏸️ SUSPENDU
|
||||||
│ ├── finlab/ # namespace: ai — dashboard finance + console Claude Code (finance.lab.local, /console) + toolkit
|
│ ├── finlab/ # namespace: ai — dashboard finance + console Claude Code (finance.lab.local, /console) + toolkit
|
||||||
|
│ ├── authentik/ # namespace: auth — annuaire/IdP OIDC (auth.lab.local)
|
||||||
|
│ ├── guacamole/ # namespace: auth — portail consoles SSH web s01/g01 (portail.lab.local)
|
||||||
│ └── {external-services}/ # ExternalName/Endpoints pointant vers storage-01 ou gpu-01
|
│ └── {external-services}/ # ExternalName/Endpoints pointant vers storage-01 ou gpu-01
|
||||||
└── infra/ # Helm releases (HelmRelease + values.yaml)
|
└── infra/ # Helm releases (HelmRelease + values.yaml)
|
||||||
├── monitoring/ # kube-prometheus-stack 85.0.2
|
├── monitoring/ # kube-prometheus-stack 85.0.2
|
||||||
|
|
@ -188,7 +195,7 @@ k8s/
|
||||||
2. Créer `k8s/apps-of-apps/apps/<nom>.yaml` (ArgoCD Application CRD) — copier `n8n.yaml` comme modèle
|
2. Créer `k8s/apps-of-apps/apps/<nom>.yaml` (ArgoCD Application CRD) — copier `n8n.yaml` comme modèle
|
||||||
3. `git commit` + `git push` → ArgoCD prend en charge automatiquement
|
3. `git commit` + `git push` → ArgoCD prend en charge automatiquement
|
||||||
|
|
||||||
Namespaces actifs : `argocd`, `infra` (Traefik, MetalLB, NFS-provisioner, registry in-cluster), `monitoring` (Prometheus/Grafana), `ai` (n8n, open-webui, stt, searxng, ghostfolio, openalice, finlab), `sacrifice` (jeu FPS — déployé hors de ce repo et hors ArgoCD, cf. `admin/ops/etat-cluster.md`).
|
Namespaces actifs : `argocd`, `infra` (Traefik, MetalLB, NFS-provisioner, registry in-cluster), `monitoring` (Prometheus/Grafana), `ai` (n8n, open-webui, stt, searxng, ghostfolio, openalice, finlab), `auth` (Authentik, Guacamole), `sacrifice` (jeu FPS — déployé hors de ce repo et hors ArgoCD, cf. `admin/ops/etat-cluster.md`).
|
||||||
|
|
||||||
> Les services du namespace `ai` sont exposés via des **IngressRoute Traefik** (CRD), pas des `Ingress` standards.
|
> Les services du namespace `ai` sont exposés via des **IngressRoute Traefik** (CRD), pas des `Ingress` standards.
|
||||||
|
|
||||||
|
|
@ -344,6 +351,6 @@ talosctl etcd snapshot /path/to/backup.db --nodes compute-01
|
||||||
|
|
||||||
- **Git** : branches `main` (prod) / `feature/*` — conventional commits (`feat:`, `fix:`, `chore:`, `docs:`)
|
- **Git** : branches `main` (prod) / `feature/*` — conventional commits (`feat:`, `fix:`, `chore:`, `docs:`)
|
||||||
- **Secrets** : Ansible Vault (Ansible), SOPS+age (Talos), Sealed Secrets (k8s)
|
- **Secrets** : Ansible Vault (Ansible), SOPS+age (Talos), Sealed Secrets (k8s)
|
||||||
- **Namespaces k8s** : `argocd`, `infra`, `monitoring`, `ai`, `external` (+ `sacrifice`, hors-repo)
|
- **Namespaces k8s** : `argocd`, `infra`, `monitoring`, `ai`, `auth`, `external` (+ `sacrifice`, hors-repo)
|
||||||
- **Hermes data** : profils/données dans `/srv/data/hermes` (NVMe, bind-mount `/home/data`), code dans `/opt/hermes/` (SSD OS)
|
- **Hermes data** : profils/données dans `/srv/data/hermes` (NVMe, bind-mount `/home/data`), code dans `/opt/hermes/` (SSD OS)
|
||||||
- **RAM compute-02/03** : toujours définir `resources.requests` + `resources.limits` (8 GB RAM, OOM-killer actif)
|
- **RAM compute-02/03** : toujours définir `resources.requests` + `resources.limits` (8 GB RAM, OOM-killer actif)
|
||||||
|
|
|
||||||
103
admin/k8s/auth-portal.md
Normal file
103
admin/k8s/auth-portal.md
Normal file
|
|
@ -0,0 +1,103 @@
|
||||||
|
# Annuaire + portail consoles — Authentik & Guacamole
|
||||||
|
|
||||||
|
Annuaire d'identités **Authentik** (IdP OIDC/LDAP) et portail **Guacamole** donnant
|
||||||
|
accès aux consoles SSH de storage-01 et gpu-01 **dans le navigateur**, avec un compte
|
||||||
|
unique par utilisateur. Namespace k8s : **`auth`**.
|
||||||
|
|
||||||
|
## Vue d'ensemble
|
||||||
|
|
||||||
|
```
|
||||||
|
Utilisateur ──▶ portail.lab.local (Guacamole) ──login OIDC──▶ auth.lab.local (Authentik)
|
||||||
|
│
|
||||||
|
└──▶ guacd ──SSH (user « console », clé ed25519)──▶ s01 / g01
|
||||||
|
```
|
||||||
|
|
||||||
|
| URL | Service | Rôle |
|
||||||
|
|---|---|---|
|
||||||
|
| `http://auth.lab.local` | Authentik | Annuaire : comptes, groupes, SSO OIDC |
|
||||||
|
| `http://portail.lab.local` | Guacamole | Portail : consoles SSH web s01/g01 |
|
||||||
|
|
||||||
|
## Composants
|
||||||
|
|
||||||
|
- **Authentik** (`k8s/apps/authentik/`) : server + worker (`ghcr.io/goauthentik/server:2026.5.3`),
|
||||||
|
Redis in-cluster, PVC `authentik-media` (RWX, nfs), base **PostgreSQL sur storage-01**
|
||||||
|
(même pattern que Ghostfolio/n8n).
|
||||||
|
- **Guacamole** (`k8s/apps/guacamole/`) : webapp `guacamole/guacamole:1.6.0` + proxy
|
||||||
|
`guacamole/guacd:1.6.0`, base PostgreSQL sur storage-01 (connexions, permissions).
|
||||||
|
Le Job ArgoCD `guacamole-initdb` pose le schéma si absent (idempotent).
|
||||||
|
- **Ansible** : rôle `postgresql` (bases `authentik` + `guacamole`), rôle **`console_user`**
|
||||||
|
(user `console` **sans sudo** sur s01 et g01, clé publique Guacamole).
|
||||||
|
|
||||||
|
## Secrets
|
||||||
|
|
||||||
|
Vault Ansible (`make vault-view`) :
|
||||||
|
|
||||||
|
| Variable | Usage |
|
||||||
|
|---|---|
|
||||||
|
| `vault_pg_authentik_password` | Base PG `authentik` |
|
||||||
|
| `vault_pg_guacamole_password` | Base PG `guacamole` |
|
||||||
|
| `vault_console_ssh_private_key` | Clé privée SSH des connexions Guacamole (user `console`) |
|
||||||
|
|
||||||
|
Secrets k8s (créés à la main, **hors git**, comme `ghostfolio-secret`) — mots de passe
|
||||||
|
identiques au vault, `secret-key` = 48+ caractères aléatoires :
|
||||||
|
|
||||||
|
```bash
|
||||||
|
kubectl create ns auth
|
||||||
|
kubectl -n auth create secret generic authentik-secret \
|
||||||
|
--from-literal=secret-key='<clé aléatoire>' \
|
||||||
|
--from-literal=pg-password='<vault_pg_authentik_password>' \
|
||||||
|
--from-literal=redis-password='<aléatoire>'
|
||||||
|
kubectl -n auth create secret generic guacamole-secret \
|
||||||
|
--from-literal=pg-password='<vault_pg_guacamole_password>'
|
||||||
|
```
|
||||||
|
|
||||||
|
## Déploiement (ordre)
|
||||||
|
|
||||||
|
1. `ansible-playbook -i inventory.yml playbooks/storage-01.yml --tags postgresql,console_user`
|
||||||
|
2. `ansible-playbook -i inventory.yml playbooks/gpu-01.yml --tags console_user`
|
||||||
|
3. Créer les secrets k8s ci-dessus (avant le premier sync, sinon pods en `CreateContainerConfigError`)
|
||||||
|
4. Merge sur `main` → ArgoCD crée les Applications `authentik` et `guacamole` (~3 min)
|
||||||
|
|
||||||
|
## Configuration initiale — Authentik
|
||||||
|
|
||||||
|
1. **Compte admin** : ouvrir `http://auth.lab.local/if/flow/initial-setup/` (valable
|
||||||
|
uniquement tant qu'aucun admin n'existe) → définir mot de passe de `akadmin`.
|
||||||
|
2. **Provider OIDC** pour Guacamole — Admin → Applications → Providers → Create
|
||||||
|
→ *OAuth2/OpenID Provider* :
|
||||||
|
- Name : `guacamole` — Authorization flow : *implicit-consent*
|
||||||
|
- Client type : **Public** (Guacamole utilise le flux implicite, pas de client secret)
|
||||||
|
- Client ID : `guacamole`
|
||||||
|
- Redirect URI : `http://portail.lab.local/`
|
||||||
|
- **Signing Key : sélectionner le certificat self-signed** (sinon JWKS vide → login KO)
|
||||||
|
3. **Application** — Applications → Create : Name `Portail consoles`,
|
||||||
|
**slug `guacamole`** (doit correspondre à `/application/o/guacamole/` configuré côté
|
||||||
|
Guacamole : issuer + JWKS), Provider `guacamole`.
|
||||||
|
4. **Utilisateurs** — Directory → Users → Create (+ groupes si besoin). Le
|
||||||
|
`preferred_username` Authentik devient le nom de compte Guacamole.
|
||||||
|
|
||||||
|
## Configuration initiale — Guacamole
|
||||||
|
|
||||||
|
1. Se connecter en **`guacadmin` / `guacadmin`** (formulaire local, extension base) et
|
||||||
|
**changer ce mot de passe immédiatement** (portail exposé à tout le LAN).
|
||||||
|
2. Settings → Connections → New connection (×2) :
|
||||||
|
- Protocol `SSH` — Hostname `192.168.10.1` (s01) ou `192.168.10.20` (g01) — Port `22`
|
||||||
|
- Username `console` — Private key : coller `vault_console_ssh_private_key`
|
||||||
|
3. Settings → Users : les comptes Authentik apparaissent après leur **premier login**
|
||||||
|
(`POSTGRESQL_AUTO_CREATE_ACCOUNTS=true`) → leur assigner les connexions (READ).
|
||||||
|
|
||||||
|
## Pièges / notes
|
||||||
|
|
||||||
|
1. **Tout est en HTTP** (pas de TLS sur `*.lab.local`) — OK pour un LAN privé, mais ne
|
||||||
|
**jamais** exposer le portail sur Internet en l'état.
|
||||||
|
2. **JWKS via le Service interne** (`authentik.auth.svc.cluster.local:9000`) : l'appel
|
||||||
|
serveur→serveur de Guacamole ne dépend pas de la résolution `lab.local` des pods.
|
||||||
|
L'issuer, lui, reste `http://auth.lab.local/...` (doit matcher le claim `iss` des
|
||||||
|
tokens émis via le navigateur).
|
||||||
|
3. **`EXTENSION_PRIORITY="*, openid"`** : garde le formulaire local (guacadmin) accessible
|
||||||
|
en plus du SSO — sans ça, redirection OIDC forcée et plus d'accès admin local.
|
||||||
|
4. **User `console` sans sudo** (volontaire) : le portail sert à observer/opérer léger.
|
||||||
|
L'administration passe par les comptes admin habituels, pas par Guacamole.
|
||||||
|
5. **Enregistrement des sessions** : possible (guacd + volume partagé) mais non configuré
|
||||||
|
— gap connu, à ajouter si le portail s'ouvre à d'autres utilisateurs.
|
||||||
|
6. La config Authentik (provider, app, utilisateurs) et les connexions Guacamole vivent
|
||||||
|
**en base, pas en IaC** — comme le Server Manager Satisfactory. Backup PG = gap connu.
|
||||||
|
|
@ -1,60 +1,102 @@
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
62336439366562363937663535393663306632313861393832323863633936383638633031386539
|
63626530633434376333636639326132353064366166363136306366656434626262353435396430
|
||||||
3936393362663037373862616335346461343464663031310a373137373561323838663561313632
|
3563386431623536653366333461376263643232393964330a313832333139643136356636396334
|
||||||
34653562386463633037313136636165343937396437663237353339363935306437663930663135
|
38313365386166626264353664343533663130353466316535323663636433333962336534623963
|
||||||
3036373732633030380a323562383239356335343366623338373335323937653638386439343032
|
6463646663353730640a303939646534663939356432396535386534653235636161333132663434
|
||||||
32663236363262666434666462643236376439393635336637373261323033353530346331633565
|
37653365643537626538303336316637656539366636633331323264626336393539393264393264
|
||||||
61343664333064653831646562363837306230353038656666663139333538313738633137303238
|
66306363336434383064333565613933393439333133623364366361643434666363333437643662
|
||||||
37303862636261336662363733333234393130656661303663323530613736383233656639363837
|
34363538633236623361363065303135383732383530333962323365386232623039386566353730
|
||||||
32313262383464363030333833633863376332616434336564613265383738316464333261616533
|
30386237623333616531373630613736313961633936623934326636366531373337653365663039
|
||||||
61653763346633313830346130303137306164366664346132306363373164653063396237333837
|
65613466356466643438643937363961303137303534626432656435396531306235646661633634
|
||||||
61306533663435313666333461323662636237393164323136353936393266343338666266653066
|
64653361366430396534306233333139623632393563353638303730393935303830616264386133
|
||||||
61333761383335306164323830383139323736336332343931646365646565396666643337333932
|
61626166646665326430636461653663333639633336653237383764633138356165333066386361
|
||||||
31363131306339353837396261316632303839303737353831636237383033633431386662306539
|
37626538366236383362633032333834343566383135376430393635363830373135376334336236
|
||||||
38623565316162323437333838636163323134643634613231336432373331336666663032643438
|
32643263386337383632616630376133353337653033336463613832646435336563326332306231
|
||||||
32373130356564666339386535613330393936323561346361366534346163313461363662303636
|
33636639343632643966633031353063353735346431356166333838656636656134323166656361
|
||||||
39393664333330373238353332373061626166376662656336613735646139326563346634306637
|
62323337313062393633613237646463346561393465663062663232343937386235333430346633
|
||||||
66633264393966383563376265356239383265333065396564653931386462646161633932646262
|
34666532663365613665653735646638643765613366663638373030313534373237343331623264
|
||||||
39663464633739363738376638396236303338396461306466333636306532646463383265356661
|
63393738333634343435646565616563663863373865373761373336386433623166353638346436
|
||||||
31326665336663653832663433653932313464363334356365343466376165613331333863386236
|
39393830623333366639363262616437393838303634633037393466323734303637643539666536
|
||||||
62383065636636333432623564616235313739643265616137316461346162613638376131333931
|
35303665333864393730646639323532656635623163636138386639333535346339376365656235
|
||||||
39333863366166643831663839303832643331636639346639646234643738636361303737653937
|
63613264343631353034343465326632623633363930373866323663333236633031366630626364
|
||||||
35353731626438663836343264343661393632353437316266313435666665663065663565333937
|
36623835383463636632346330303439343262333932656534313261653961646462643563663638
|
||||||
33396163383534646533373335623365386661353065313865643533663637636237626465393964
|
37643764373039643534303338326335393866616435626261386463323364373565633939343632
|
||||||
35326663313164623835386439383131386531373339643864646136303532626561373661396365
|
39626163613639303930393330363232366461333134653831663736643237663530376137373266
|
||||||
34326261333430663261663263306131336331386538623739376437333862386531623531366332
|
62616539326335366138306136336432633931303637653137313761626261643866323764613064
|
||||||
63643033363263623736636636343830313063326161326466323965366663333436626530623830
|
62373738313732643639373737663439313837663334323665353030366239393732613865303837
|
||||||
36306665373531636236656130333063643934333037303636386538363835653332363932663839
|
34653537393739366538306339633237333565633866383730396664643132316662306138376666
|
||||||
34663363333766353635316236373034656333616162613338633338396261323339346439643836
|
30343139653538653431343938613531313138313733373962613432646434653635643765623538
|
||||||
38346264653838336561383631363132333235383733326363663837633934656162633031363734
|
66653932646464663166636535663666353764376136616334626463353033376434316130356638
|
||||||
61393432393662663063666236666135633331646465373163316238633233643734323265346466
|
63303264623461323737643363643062303237613665366161643933316161343235376131396162
|
||||||
35643937386534626161613131343131323037636261333863316437643463643363336333323636
|
36363538363138633333653634303734656232353461366131643635353662643732356538306434
|
||||||
65353932643830343636663734326637353365353430313830323535313538663834623335666662
|
65383365396439663963353239663730313339663361323730613834326432643738653632656463
|
||||||
63313532303839326261636561333937656364333339313236613139663761356166613935396435
|
33633961623633666361643834366662386266343836303565306666626238363661303563303365
|
||||||
37346139323533336131656266376437356536626131313366383433353834633533616634376361
|
33623531343763636334363432356537366566323362316335626366656330616235626538336263
|
||||||
63633334313230323566646461356234393538626230646161326638656231313961336435336537
|
36343736356566323966353166633662613531633835366536356366373136663730326236616266
|
||||||
39653836643436396661626334616630633231333165336438313265393537303162313134356633
|
38343436376666613835646463306662333561356330303961383934366235356631303565616663
|
||||||
63396139663562333437353861653432636236613864323839366231373930353132666534656337
|
33376236316263373734343635383361356361336366396265663336306337343965643063613861
|
||||||
34376235373365316533653533316331326162396563313262373835663861323664383765613934
|
32306431613338356131613562313732643765643731613838323566333231323761383161623237
|
||||||
37663730393363656661633338363330663964353864626365636263303036346566343430666435
|
38343235316239613338616639343665326639656463303435653732663963326434343930613661
|
||||||
34663966323532313661326638396265306338616361326561313361353236393962656334666366
|
34316334666563643133636264643739666337356431336261363833363561373034633834643031
|
||||||
36613466626234303730333539316265306264663766616565366635363931653166646263666365
|
32373538643037626466306364326235366363653539613330306665303630633031386361386431
|
||||||
37396636303930623636353238386465643739643537303937663437386465663036663862646537
|
30363434386336613134346365383138616136643638306333646164333737643932326233323033
|
||||||
66386536316137316234636565633639663765633563323766366536373430373534326233346232
|
61363065636331326432373162646235346133373139326636646331626465646238383966373963
|
||||||
65323361613263663834613337386438663531303535613533336665336539666363383262643338
|
61363533373764306431386661346332356333613866313331653966386633326230346131623737
|
||||||
38333363373332633430313038636530643731366433353832346535363562313632613230656235
|
63323937386338313531343064343539353631393738366232303534303038383137303033383138
|
||||||
62666231306465333730663263303533333836646533373339653961616639363738363366643032
|
63633639633935613564343933393164663233376561356334646466353030636531326534623864
|
||||||
63653766383663636566303833306464393135306535313565373364646164333339343031353561
|
35656335386231636466323366323532363839646332343339353763626630326333393361393365
|
||||||
62363062613165306233623962396463316230633561643262323030636430373835653837326166
|
66326234616434623535623832346230383162363065303436353036306133633534633031373136
|
||||||
62626430643037333865326333346464363662323361306539313162306639393133646334326233
|
36626137383531366531366137356230616239313734343438336332636563616637653733613265
|
||||||
34306264323962393763633965653838353733646236313061356236366630373934363261666665
|
32386463323435343438336231373330323663353334613364313531343737383532303766303666
|
||||||
39393632623664333138393738353363343039376166343437666236313762326231316337376439
|
64323365326239323739623436363666326366363434306631366435383332363938313039363063
|
||||||
37386539303064363665613662346561623230353535386565393866623961343564316230663066
|
39373739613766333261636332663366366135313363356237616266383434353536663061313634
|
||||||
37313034396630613031366365343064313333373365343832306238663930326361613534653436
|
38646266393565656331393030383439613235656666376361623333373031343262616461633034
|
||||||
33383036623633656435356133623965616566623333303862633431326538366536656333306232
|
31336437653362326362316364316536326336613937393365303331663466653238316262626334
|
||||||
66646562343034653235373936633537383932333732623938393964326530366532663438643330
|
37353061393231313931333633353530633834626263663161653761653233623936653339396162
|
||||||
34323062336434626361333662363335316366333837353734376438373834633735633530376131
|
34386362363232313033643134623536333132333666326135316535323237346333393063326262
|
||||||
61636363613531366230346163383563316134666335373433333930646330633030613435373339
|
66313563613865303530346433363862353637343434643537303933646338376539363164316439
|
||||||
63656333353436323262303364396264303330316263373661653533643165343238393464663338
|
62363936666334353766653533366139306538323037633766306361373062626266663163313764
|
||||||
39343537376438353235306536316465356464313030373236323331353538353030323039623937
|
32653736656235363130343939613131666533326163363664353966356634333663336565313231
|
||||||
626661643166633933323038363237633665
|
37643566613930646131633635393636663064306533613930353735326139396634643731306331
|
||||||
|
34346432383337323336313037653931366435373263656261393630366662656134623531653330
|
||||||
|
30656665393835653434323665316138613561616466656638376233323766623936303061626335
|
||||||
|
31613365633362356164646265386637643061653132346436353634386633323566323165383162
|
||||||
|
61386437386163613534643762646334303032613661656365626564656466323734656436356366
|
||||||
|
64386436656631303766313663373962613736316530363734393763323166633132633630373331
|
||||||
|
62383630336334636165363331346632636232613832626636326661613561303763313830383061
|
||||||
|
38383732393063626338353963373132363133316562666136613964633861386636636436646434
|
||||||
|
31383138636161343333636466353732376664626363653135326339623862373563396534383663
|
||||||
|
37356461323563363333626530626432353737616431323563653764613535353131323038636264
|
||||||
|
63646536393462323538663530323739666266376333316331386666336531353539626562356166
|
||||||
|
30663137376432633434323131653939306238326362636238383766333666633434313635653132
|
||||||
|
30666463363632643432383337356633323137313934643761393733653233643530386134636130
|
||||||
|
36303833623661393631323339663263623032663531653162326534393163333835323936363531
|
||||||
|
32346639663730663038616234303330386236373662356661323365343536396136343737376330
|
||||||
|
61303061393133303231343039616632663633666464616134656462363934386465633561393035
|
||||||
|
64303338373838343438353236386332366433366664646163343931383463373934633831343365
|
||||||
|
37383064366238623366356330613237343562383662363437336265313065303531313335346566
|
||||||
|
37363065356538633830626637363161663937623236626437656438623736663336643164313436
|
||||||
|
35353933613265363138356335316465336137616537313264303838653362343661336464393431
|
||||||
|
66373238613534643837383063366438323139666530363736383366666664623434366164323238
|
||||||
|
63626461623033366463616339623863363136643764353962333835333762393038626130306262
|
||||||
|
39656238653863346366383434333961643239643939356630366462643138643362633433653765
|
||||||
|
32393332326333383737376263636165323834313034663666623131323237363262323562366433
|
||||||
|
64363138663964396563356337666361643732333237353165383532616339633137653566623464
|
||||||
|
34656331303334373937336331303863643962306231663436646266376130623530343464626536
|
||||||
|
39383836383762663666656132306331373365346561333735343561313764313431316236626365
|
||||||
|
62376231303733383931666562336336303636353236663333363066666636666533363761343430
|
||||||
|
65653436396237666236626638393061636631343134383131393438333264393364346133666436
|
||||||
|
65623264393166393830653032643661323030633137663339363330303533633339336232623535
|
||||||
|
33356264653432663761316530313538663536633238326238633864313338386334343365336335
|
||||||
|
62613462363130613938353631666438653164303763643963326162656332376265663965336537
|
||||||
|
66303232663037383035373664393635613932363232383664613330353665613638626261303033
|
||||||
|
63396238373961663635363730333762313135366237383532626338666230663665373863623030
|
||||||
|
36393766313562613033613564306235363637653966356135613230643839616537373963636431
|
||||||
|
34306263353636383531386133386462386539663637353338323665653134323733623462336164
|
||||||
|
38613431386362373637313731313265623537633232323034623730346230333339666432316538
|
||||||
|
61386235393564353030633864396166343833646564613330326234613963643366323737646134
|
||||||
|
66373638343361396363373436313739316164313164393038363132306130616436313366656433
|
||||||
|
35613234643865313266333134333863346133333539313636306463656537376661363064343731
|
||||||
|
62613237366234323835346466326439373165666135653338373635646235333936643435366564
|
||||||
|
65376264336161343665373330333966383836653539343164306666376364623438653832613232
|
||||||
|
65363039326130363938373738363536333332656331343566633663323061393932
|
||||||
|
|
|
||||||
|
|
@ -9,3 +9,4 @@
|
||||||
- { role: llama_server, tags: [llama_server] }
|
- { role: llama_server, tags: [llama_server] }
|
||||||
- { role: node_exporter, tags: [node_exporter] }
|
- { role: node_exporter, tags: [node_exporter] }
|
||||||
- { role: satisfactory_server, tags: [satisfactory_server] }
|
- { role: satisfactory_server, tags: [satisfactory_server] }
|
||||||
|
- { role: console_user, tags: [console_user] }
|
||||||
|
|
|
||||||
|
|
@ -18,3 +18,4 @@
|
||||||
- { role: postfix_relay, tags: [postfix_relay] }
|
- { role: postfix_relay, tags: [postfix_relay] }
|
||||||
- { role: hermes_auto_improve, tags: [hermes_auto_improve] }
|
- { role: hermes_auto_improve, tags: [hermes_auto_improve] }
|
||||||
- { role: hermes_exec, tags: [hermes_exec] }
|
- { role: hermes_exec, tags: [hermes_exec] }
|
||||||
|
- { role: console_user, tags: [console_user] }
|
||||||
|
|
|
||||||
27
ansible/roles/console_user/README.md
Normal file
27
ansible/roles/console_user/README.md
Normal file
|
|
@ -0,0 +1,27 @@
|
||||||
|
# Rôle `console_user`
|
||||||
|
|
||||||
|
Crée l'utilisateur **`console`** (non privilégié, sans sudo) sur les hôtes AlmaLinux.
|
||||||
|
C'est le compte que **Guacamole** (`portail.lab.local`) utilise pour ouvrir les
|
||||||
|
consoles SSH web vers storage-01 et gpu-01.
|
||||||
|
|
||||||
|
## Variables
|
||||||
|
|
||||||
|
| Variable | Défaut | Rôle |
|
||||||
|
|---|---|---|
|
||||||
|
| `console_user_name` | `console` | Nom du compte |
|
||||||
|
| `console_user_home` | `/home/console` | Home |
|
||||||
|
| `console_user_public_key` | clé ed25519 (défauts) | Clé publique autorisée — appairée avec `vault_console_ssh_private_key` |
|
||||||
|
|
||||||
|
## Caveats
|
||||||
|
|
||||||
|
- La **clé privée** correspondante est dans le vault (`vault_console_ssh_private_key`) ;
|
||||||
|
elle se colle dans les paramètres de connexion Guacamole (UI → stockée dans la base
|
||||||
|
`guacamole` sur storage-01). `make vault-view` pour la récupérer.
|
||||||
|
- `exclusive: true` sur `authorized_keys` : toute clé ajoutée à la main sur ce compte
|
||||||
|
sera supprimée au run suivant.
|
||||||
|
- **Pas de sudo** volontairement. Pour de l'administration, ouvrir une session avec un
|
||||||
|
compte admin classique, pas via le portail.
|
||||||
|
- Rotation de clé : régénérer une paire ed25519, remplacer la clé publique ici et la
|
||||||
|
privée dans le vault + dans les connexions Guacamole, puis re-appliquer le rôle.
|
||||||
|
|
||||||
|
Doc portail complète : `admin/k8s/auth-portal.md`.
|
||||||
7
ansible/roles/console_user/defaults/main.yml
Normal file
7
ansible/roles/console_user/defaults/main.yml
Normal file
|
|
@ -0,0 +1,7 @@
|
||||||
|
---
|
||||||
|
console_user_name: console
|
||||||
|
console_user_home: /home/console
|
||||||
|
|
||||||
|
# Clé publique appairée avec vault_console_ssh_private_key (vault) — la clé privée
|
||||||
|
# est collée dans les paramètres de connexion Guacamole (UI, stockée dans sa base).
|
||||||
|
console_user_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKdt0yocK6OvPewhO8l3zHT3t37D+agl9sl0oj4r1OgT console@guacamole-portail"
|
||||||
19
ansible/roles/console_user/tasks/main.yml
Normal file
19
ansible/roles/console_user/tasks/main.yml
Normal file
|
|
@ -0,0 +1,19 @@
|
||||||
|
---
|
||||||
|
# Utilisateur non privilégié pour les consoles SSH du portail Guacamole
|
||||||
|
# (portail.lab.local). Pas de sudo : les utilisateurs du portail observent,
|
||||||
|
# l'administration reste sur les comptes habituels.
|
||||||
|
|
||||||
|
- name: Create console user
|
||||||
|
ansible.builtin.user:
|
||||||
|
name: "{{ console_user_name }}"
|
||||||
|
shell: /bin/bash
|
||||||
|
home: "{{ console_user_home }}"
|
||||||
|
create_home: true
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Authorize Guacamole SSH key
|
||||||
|
ansible.posix.authorized_key:
|
||||||
|
user: "{{ console_user_name }}"
|
||||||
|
key: "{{ console_user_public_key }}"
|
||||||
|
exclusive: true
|
||||||
|
state: present
|
||||||
|
|
@ -12,13 +12,16 @@ postgresql_shared_buffers: "256MB"
|
||||||
# Bases et utilisateurs à créer
|
# Bases et utilisateurs à créer
|
||||||
# Mots de passe dans le vault : vault_pg_hermes_password, vault_pg_litellm_password,
|
# Mots de passe dans le vault : vault_pg_hermes_password, vault_pg_litellm_password,
|
||||||
# vault_pg_openwebui_password, vault_pg_n8n_password,
|
# vault_pg_openwebui_password, vault_pg_n8n_password,
|
||||||
# vault_pg_ghostfolio_password
|
# vault_pg_ghostfolio_password, vault_pg_authentik_password,
|
||||||
|
# vault_pg_guacamole_password
|
||||||
postgresql_databases:
|
postgresql_databases:
|
||||||
- name: hermes
|
- name: hermes
|
||||||
- name: litellm
|
- name: litellm
|
||||||
- name: openwebui
|
- name: openwebui
|
||||||
- name: n8n
|
- name: n8n
|
||||||
- name: ghostfolio
|
- name: ghostfolio
|
||||||
|
- name: authentik
|
||||||
|
- name: guacamole
|
||||||
|
|
||||||
postgresql_users:
|
postgresql_users:
|
||||||
- name: hermes
|
- name: hermes
|
||||||
|
|
@ -36,3 +39,9 @@ postgresql_users:
|
||||||
- name: ghostfolio
|
- name: ghostfolio
|
||||||
password: "{{ vault_pg_ghostfolio_password }}"
|
password: "{{ vault_pg_ghostfolio_password }}"
|
||||||
db: ghostfolio
|
db: ghostfolio
|
||||||
|
- name: authentik
|
||||||
|
password: "{{ vault_pg_authentik_password }}"
|
||||||
|
db: authentik
|
||||||
|
- name: guacamole
|
||||||
|
password: "{{ vault_pg_guacamole_password }}"
|
||||||
|
db: guacamole
|
||||||
|
|
|
||||||
24
k8s/apps-of-apps/apps/authentik.yaml
Normal file
24
k8s/apps-of-apps/apps/authentik.yaml
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: authentik
|
||||||
|
namespace: argocd
|
||||||
|
finalizers:
|
||||||
|
- resources-finalizer.argocd.argoproj.io
|
||||||
|
spec:
|
||||||
|
project: default
|
||||||
|
source:
|
||||||
|
repoURL: git@github.com:Alkatrazz24/Funk-lab.git
|
||||||
|
targetRevision: main
|
||||||
|
path: k8s/apps/authentik
|
||||||
|
directory:
|
||||||
|
recurse: true
|
||||||
|
destination:
|
||||||
|
server: https://kubernetes.default.svc
|
||||||
|
namespace: auth
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
prune: true
|
||||||
|
selfHeal: true
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
24
k8s/apps-of-apps/apps/guacamole.yaml
Normal file
24
k8s/apps-of-apps/apps/guacamole.yaml
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: guacamole
|
||||||
|
namespace: argocd
|
||||||
|
finalizers:
|
||||||
|
- resources-finalizer.argocd.argoproj.io
|
||||||
|
spec:
|
||||||
|
project: default
|
||||||
|
source:
|
||||||
|
repoURL: git@github.com:Alkatrazz24/Funk-lab.git
|
||||||
|
targetRevision: main
|
||||||
|
path: k8s/apps/guacamole
|
||||||
|
directory:
|
||||||
|
recurse: true
|
||||||
|
destination:
|
||||||
|
server: https://kubernetes.default.svc
|
||||||
|
namespace: auth
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
prune: true
|
||||||
|
selfHeal: true
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
135
k8s/apps/authentik/deployment.yaml
Normal file
135
k8s/apps/authentik/deployment.yaml
Normal file
|
|
@ -0,0 +1,135 @@
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: authentik-server
|
||||||
|
namespace: auth
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: authentik-server
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: authentik-server
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: authentik
|
||||||
|
image: ghcr.io/goauthentik/server:2026.5.3
|
||||||
|
args: ["server"]
|
||||||
|
ports:
|
||||||
|
- containerPort: 9000
|
||||||
|
env:
|
||||||
|
- name: AUTHENTIK_SECRET_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: secret-key
|
||||||
|
# PostgreSQL sur storage-01 (hors cluster) — même pattern que Ghostfolio/n8n
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__HOST
|
||||||
|
value: "192.168.10.1"
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__NAME
|
||||||
|
value: "authentik"
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__USER
|
||||||
|
value: "authentik"
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: pg-password
|
||||||
|
# Redis (in-cluster)
|
||||||
|
- name: AUTHENTIK_REDIS__HOST
|
||||||
|
value: "authentik-redis"
|
||||||
|
- name: AUTHENTIK_REDIS__PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: redis-password
|
||||||
|
- name: TZ
|
||||||
|
value: "Europe/Paris"
|
||||||
|
volumeMounts:
|
||||||
|
- name: media
|
||||||
|
mountPath: /media
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 200m
|
||||||
|
memory: 700Mi
|
||||||
|
limits:
|
||||||
|
cpu: 1000m
|
||||||
|
memory: 1536Mi
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /-/health/ready/
|
||||||
|
port: 9000
|
||||||
|
initialDelaySeconds: 30
|
||||||
|
periodSeconds: 15
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /-/health/live/
|
||||||
|
port: 9000
|
||||||
|
initialDelaySeconds: 60
|
||||||
|
periodSeconds: 30
|
||||||
|
volumes:
|
||||||
|
- name: media
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: authentik-media
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: authentik-worker
|
||||||
|
namespace: auth
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: authentik-worker
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: authentik-worker
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: authentik
|
||||||
|
image: ghcr.io/goauthentik/server:2026.5.3
|
||||||
|
args: ["worker"]
|
||||||
|
env:
|
||||||
|
- name: AUTHENTIK_SECRET_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: secret-key
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__HOST
|
||||||
|
value: "192.168.10.1"
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__NAME
|
||||||
|
value: "authentik"
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__USER
|
||||||
|
value: "authentik"
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: pg-password
|
||||||
|
- name: AUTHENTIK_REDIS__HOST
|
||||||
|
value: "authentik-redis"
|
||||||
|
- name: AUTHENTIK_REDIS__PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: redis-password
|
||||||
|
- name: TZ
|
||||||
|
value: "Europe/Paris"
|
||||||
|
volumeMounts:
|
||||||
|
- name: media
|
||||||
|
mountPath: /media
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 500Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 1Gi
|
||||||
|
volumes:
|
||||||
|
- name: media
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: authentik-media
|
||||||
14
k8s/apps/authentik/ingress.yaml
Normal file
14
k8s/apps/authentik/ingress.yaml
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: IngressRoute
|
||||||
|
metadata:
|
||||||
|
name: authentik
|
||||||
|
namespace: auth
|
||||||
|
spec:
|
||||||
|
entryPoints:
|
||||||
|
- web
|
||||||
|
routes:
|
||||||
|
- match: Host(`auth.lab.local`)
|
||||||
|
kind: Rule
|
||||||
|
services:
|
||||||
|
- name: authentik
|
||||||
|
port: 9000
|
||||||
13
k8s/apps/authentik/pvc.yaml
Normal file
13
k8s/apps/authentik/pvc.yaml
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: authentik-media
|
||||||
|
namespace: auth
|
||||||
|
spec:
|
||||||
|
# RWX : partagé entre server et worker (icônes, templates)
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
storageClassName: nfs
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
57
k8s/apps/authentik/redis.yaml
Normal file
57
k8s/apps/authentik/redis.yaml
Normal file
|
|
@ -0,0 +1,57 @@
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: authentik-redis
|
||||||
|
namespace: auth
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: authentik-redis
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: authentik-redis
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: redis
|
||||||
|
image: redis:7-alpine
|
||||||
|
args:
|
||||||
|
- "--requirepass"
|
||||||
|
- "$(REDIS_PASSWORD)"
|
||||||
|
- "--maxmemory"
|
||||||
|
- "128mb"
|
||||||
|
- "--maxmemory-policy"
|
||||||
|
- "allkeys-lru"
|
||||||
|
ports:
|
||||||
|
- containerPort: 6379
|
||||||
|
env:
|
||||||
|
- name: REDIS_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: redis-password
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 50m
|
||||||
|
memory: 64Mi
|
||||||
|
limits:
|
||||||
|
cpu: 250m
|
||||||
|
memory: 192Mi
|
||||||
|
readinessProbe:
|
||||||
|
exec:
|
||||||
|
command: ["sh", "-c", "redis-cli -a \"$REDIS_PASSWORD\" ping | grep -q PONG"]
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: authentik-redis
|
||||||
|
namespace: auth
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
app: authentik-redis
|
||||||
|
ports:
|
||||||
|
- port: 6379
|
||||||
|
targetPort: 6379
|
||||||
11
k8s/apps/authentik/service.yaml
Normal file
11
k8s/apps/authentik/service.yaml
Normal file
|
|
@ -0,0 +1,11 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: authentik
|
||||||
|
namespace: auth
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
app: authentik-server
|
||||||
|
ports:
|
||||||
|
- port: 9000
|
||||||
|
targetPort: 9000
|
||||||
85
k8s/apps/guacamole/deployment.yaml
Normal file
85
k8s/apps/guacamole/deployment.yaml
Normal file
|
|
@ -0,0 +1,85 @@
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: guacamole
|
||||||
|
namespace: auth
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: guacamole
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: guacamole
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: guacamole
|
||||||
|
image: guacamole/guacamole:1.6.0
|
||||||
|
ports:
|
||||||
|
- containerPort: 8080
|
||||||
|
env:
|
||||||
|
- name: GUACD_HOSTNAME
|
||||||
|
value: "guacd"
|
||||||
|
- name: GUACD_PORT
|
||||||
|
value: "4822"
|
||||||
|
# Base sur storage-01 (schéma posé par le Job guacamole-initdb)
|
||||||
|
- name: POSTGRESQL_HOSTNAME
|
||||||
|
value: "192.168.10.1"
|
||||||
|
- name: POSTGRESQL_DATABASE
|
||||||
|
value: "guacamole"
|
||||||
|
- name: POSTGRESQL_USERNAME
|
||||||
|
value: "guacamole"
|
||||||
|
- name: POSTGRESQL_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: guacamole-secret
|
||||||
|
key: pg-password
|
||||||
|
# Les comptes venant d'Authentik sont créés automatiquement dans la base
|
||||||
|
# (sinon un utilisateur OIDC arrive sans aucune connexion assignable)
|
||||||
|
- name: POSTGRESQL_AUTO_CREATE_ACCOUNTS
|
||||||
|
value: "true"
|
||||||
|
# Servir sur / plutôt que /guacamole
|
||||||
|
- name: WEBAPP_CONTEXT
|
||||||
|
value: "ROOT"
|
||||||
|
# --- SSO OIDC → Authentik (app « guacamole » à créer dans l'UI Authentik) ---
|
||||||
|
# Endpoints navigateur : via l'IngressRoute ; JWKS : appel serveur→serveur,
|
||||||
|
# on passe par le Service interne pour ne pas dépendre du DNS lab.local des pods
|
||||||
|
- name: OPENID_AUTHORIZATION_ENDPOINT
|
||||||
|
value: "http://auth.lab.local/application/o/authorize/"
|
||||||
|
- name: OPENID_JWKS_ENDPOINT
|
||||||
|
value: "http://authentik.auth.svc.cluster.local:9000/application/o/guacamole/jwks/"
|
||||||
|
- name: OPENID_ISSUER
|
||||||
|
value: "http://auth.lab.local/application/o/guacamole/"
|
||||||
|
- name: OPENID_CLIENT_ID
|
||||||
|
value: "guacamole"
|
||||||
|
- name: OPENID_REDIRECT_URI
|
||||||
|
value: "http://portail.lab.local/"
|
||||||
|
- name: OPENID_USERNAME_CLAIM_TYPE
|
||||||
|
value: "preferred_username"
|
||||||
|
- name: OPENID_SCOPE
|
||||||
|
value: "openid profile email"
|
||||||
|
# L'extension base (autorisation/connexions) passe avant l'OIDC (authentification)
|
||||||
|
- name: EXTENSION_PRIORITY
|
||||||
|
value: "*, openid"
|
||||||
|
- name: TZ
|
||||||
|
value: "Europe/Paris"
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 200m
|
||||||
|
memory: 512Mi
|
||||||
|
limits:
|
||||||
|
cpu: 1000m
|
||||||
|
memory: 1Gi
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /
|
||||||
|
port: 8080
|
||||||
|
initialDelaySeconds: 30
|
||||||
|
periodSeconds: 15
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /
|
||||||
|
port: 8080
|
||||||
|
initialDelaySeconds: 60
|
||||||
|
periodSeconds: 30
|
||||||
39
k8s/apps/guacamole/guacd.yaml
Normal file
39
k8s/apps/guacamole/guacd.yaml
Normal file
|
|
@ -0,0 +1,39 @@
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: guacd
|
||||||
|
namespace: auth
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: guacd
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: guacd
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: guacd
|
||||||
|
image: guacamole/guacd:1.6.0
|
||||||
|
ports:
|
||||||
|
- containerPort: 4822
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 512Mi
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: guacd
|
||||||
|
namespace: auth
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
app: guacd
|
||||||
|
ports:
|
||||||
|
- port: 4822
|
||||||
|
targetPort: 4822
|
||||||
14
k8s/apps/guacamole/ingress.yaml
Normal file
14
k8s/apps/guacamole/ingress.yaml
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: IngressRoute
|
||||||
|
metadata:
|
||||||
|
name: guacamole
|
||||||
|
namespace: auth
|
||||||
|
spec:
|
||||||
|
entryPoints:
|
||||||
|
- web
|
||||||
|
routes:
|
||||||
|
- match: Host(`portail.lab.local`)
|
||||||
|
kind: Rule
|
||||||
|
services:
|
||||||
|
- name: guacamole
|
||||||
|
port: 8080
|
||||||
68
k8s/apps/guacamole/init-job.yaml
Normal file
68
k8s/apps/guacamole/init-job.yaml
Normal file
|
|
@ -0,0 +1,68 @@
|
||||||
|
# Pose le schéma Guacamole dans la base « guacamole » (storage-01) si absent.
|
||||||
|
# Hook ArgoCD : recréé à chaque sync, mais le garde-fou (table guacamole_user)
|
||||||
|
# le rend idempotent — il ne rejoue jamais le schéma sur une base déjà peuplée.
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
name: guacamole-initdb
|
||||||
|
namespace: auth
|
||||||
|
annotations:
|
||||||
|
argocd.argoproj.io/hook: Sync
|
||||||
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
||||||
|
spec:
|
||||||
|
backoffLimit: 3
|
||||||
|
template:
|
||||||
|
spec:
|
||||||
|
restartPolicy: Never
|
||||||
|
initContainers:
|
||||||
|
- name: generate-schema
|
||||||
|
image: guacamole/guacamole:1.6.0
|
||||||
|
command: ["sh", "-c", "/opt/guacamole/bin/initdb.sh --postgresql > /work/initdb.sql"]
|
||||||
|
volumeMounts:
|
||||||
|
- name: work
|
||||||
|
mountPath: /work
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 512Mi
|
||||||
|
containers:
|
||||||
|
- name: apply-schema
|
||||||
|
image: postgres:16-alpine
|
||||||
|
command:
|
||||||
|
- sh
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
if psql -tAc "SELECT 1 FROM information_schema.tables WHERE table_name='guacamole_user'" | grep -q 1; then
|
||||||
|
echo "Schéma déjà présent — rien à faire"
|
||||||
|
else
|
||||||
|
psql -v ON_ERROR_STOP=1 -f /work/initdb.sql
|
||||||
|
echo "Schéma Guacamole appliqué"
|
||||||
|
fi
|
||||||
|
env:
|
||||||
|
- name: PGHOST
|
||||||
|
value: "192.168.10.1"
|
||||||
|
- name: PGDATABASE
|
||||||
|
value: "guacamole"
|
||||||
|
- name: PGUSER
|
||||||
|
value: "guacamole"
|
||||||
|
- name: PGPASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: guacamole-secret
|
||||||
|
key: pg-password
|
||||||
|
volumeMounts:
|
||||||
|
- name: work
|
||||||
|
mountPath: /work
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 50m
|
||||||
|
memory: 64Mi
|
||||||
|
limits:
|
||||||
|
cpu: 250m
|
||||||
|
memory: 128Mi
|
||||||
|
volumes:
|
||||||
|
- name: work
|
||||||
|
emptyDir: {}
|
||||||
11
k8s/apps/guacamole/service.yaml
Normal file
11
k8s/apps/guacamole/service.yaml
Normal file
|
|
@ -0,0 +1,11 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: guacamole
|
||||||
|
namespace: auth
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
app: guacamole
|
||||||
|
ports:
|
||||||
|
- port: 8080
|
||||||
|
targetPort: 8080
|
||||||
Loading…
Add table
Add a link
Reference in a new issue