Stefan Bethke
32b5f147bc
Adds a keycloak_auth_flow role that locally validates flow definitions (structure, nesting depth, known provider IDs, and a set of Keycloak authentication-flow gotchas: conditions silently ignored outside a Conditional subflow, keycloak/keycloak#29515's OTP+WebAuthn sibling bug, conditional-credential config shape/semantics, and more) before deploying them idempotently via middleware_automation.keycloak.keycloak_authentication_v2. Includes the CCCHH realm's actual "browser passkey and token" flow (the realm's real browserFlow binding, not the untouched built-in "browser" flow), exported from the live server so it's now reviewable and redeployable from this repo instead of only editable in the Keycloak admin console.
23 lines
1.1 KiB
YAML
23 lines
1.1 KiB
YAML
docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2') }}"
|
|
docker_compose__configuration_files: [ ]
|
|
|
|
certbot__acme_account_email_address: j+letsencrypt-ccchh@jsts.xyz
|
|
certbot__certificate_domains:
|
|
- "id.hamburg.ccc.de"
|
|
- "keycloak-admin.hamburg.ccc.de"
|
|
- "invite.hamburg.ccc.de"
|
|
certbot__new_cert_commands:
|
|
- "systemctl reload nginx.service"
|
|
|
|
nginx__version_spec: ""
|
|
nginx__configurations:
|
|
- name: id.hamburg.ccc.de
|
|
content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf') }}"
|
|
- name: keycloak-admin.hamburg.ccc.de
|
|
content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf') }}"
|
|
- name: invite.hamburg.ccc.de
|
|
content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/keycloak/nginx/invite.hamburg.ccc.de.conf') }}"
|
|
|
|
keycloak_auth_flow__admin_password: "{{ secret__keycloak_admin_password }}"
|
|
keycloak_auth_flow__flows:
|
|
- "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/keycloak/auth_flows/browser.yaml') | from_yaml }}"
|