[task-230] [add] authelia-for-tandoor

roles/authelia-for-tandoor/defaults/main.json

@@ -0,0 +1,5 @@
+{
+	"var_authelia_for_tandoor_tandoor_url_base": "https://tandoor.example.org",
+	"var_authelia_for_tandoor_client_id": "tandoor",
+	"var_authelia_for_tandoor_client_secret": "REPLACE_ME"
+}

roles/authelia-for-tandoor/info.md

@@ -0,0 +1,9 @@
+## Beschreibung
+
+Um [Tandoor](../tandoor) gegen [Authelia](../authelia) authentifizieren zu lassen
+
+
+## Verweise
+
+- [allauth | OpenID Connect](https://docs.allauth.org/en/latest/socialaccount/providers/openid_connect.html)
+- [Tandoor-Dokumentation | Configuration Example for Authelia](https://docs.tandoor.dev/features/authentication/#configuration-example-for-authelia)

roles/authelia-for-tandoor/tasks/main.json

@@ -0,0 +1,33 @@
+[
+	{
+		"name": "configuration | compute client secret hash",
+		"become": true,
+		"ansible.builtin.shell": {
+			"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_tandoor_client_secret}} | cut --delimiter=' ' --fields='2-'"
+		},
+		"register": "temp_authelia_for_tandoor_client_secret_hashed"
+	},
+	{
+		"name": "configuration | emplace",
+		"become": true,
+		"ansible.builtin.template": {
+			"src": "authelia-client-conf.json.j2",
+			"dest": "/etc/authelia/conf.d/clients/tandoor.json"
+		}
+	},
+	{
+		"name": "configuration | apply",
+		"become": true,
+		"ansible.builtin.command": {
+			"cmd": "/usr/bin/authelia-conf-compose"
+		}
+	},
+	{
+		"name": "restart service",
+		"become": true,
+		"ansible.builtin.systemd_service": {
+			"state": "restarted",
+			"name": "authelia"
+		}
+	}
+]

roles/authelia-for-tandoor/templates/authelia-client-conf.json.j2

@@ -0,0 +1,17 @@
+{
+	"client_id": "{{var_authelia_for_tandoor_client_id}}",
+	"client_secret": "{{temp_authelia_for_tandoor_client_secret_hashed.stdout}}",
+	"client_name": "Tandoor",
+	"public": false,
+	"authorization_policy": "one_factor",
+	"redirect_uris": [
+		"{{var_authelia_for_tandoor_tandoor_url_base}}/accounts/oidc/authelia/login/callback/"
+	],
+	"scopes": [
+		"openid",
+		"email",
+		"profile"
+	],
+	"userinfo_signed_response_alg": "none",
+	"token_endpoint_auth_method": "client_secret_basic"
+}

roles/tandoor/defaults/main.json

@@ -12,8 +12,11 @@
 	"var_tandoor_authentication_kind": "internal",
 	"var_tandoor_authentication_data_authelia_client_id": "REPLACE_ME",
 	"var_tandoor_authentication_data_authelia_client_secret": "REPLACE_ME",
-	"var_tandoor_authentication_data_authelia_url_base": "authelia.example.org",
+	"var_tandoor_authentication_data_authelia_url_base": "https://authelia.example.org",
 	"var_tandoor_authentication_data_authelia_label": "Authelia",
 	"var_tandoor_secret_key": "REPLACE_ME",
+	"var_tandoor_admin_username": "admin",
+	"var_tandoor_admin_password": "REPLACE_ME",
+	"var_tandoor_admin_email": "admin@tandoor.example.org",
 	"var_tandoor_domain": "tandoor.exmaple.org"
 }

roles/tandoor/info.md

@@ -8,4 +8,8 @@ Für Rezepte-Sammlung [Tandoor](https://tandoor.dev/)
 - [Tandoor-Dokumentation | Installation](https://docs.tandoor.dev/install/manual/)
 - [Tandoor-Dokumentation | Konfiguration](https://docs.tandoor.dev/system/configuration/)
 - [Tandoor-Dokumentation | Allauth](https://docs.tandoor.dev/features/authentication/#allauth)
-https://docs.allauth.org/en/latest/socialaccount/providers/openid_connect.html
+
+
+## ToDo
+
+- E-Mail

roles/tandoor/tasks/main.json

@@ -7,11 +7,11 @@
 			"pkg": [
 				"git",
 				"gcc",
+				"libpq-dev",
 				"libldap2-dev",
 				"libsasl2-dev",
 				"python3-venv",
 				"python3-dev",
-				"gunicorn",
 				"nodejs",
 				"yarnpkg"
 			]
@@ -57,12 +57,22 @@
 			"requirements": "{{var_tandoor_directory}}/program/requirements.txt"
 		}
 	},
+	{
+		"name": "configuration",
+		"become": true,
+		"become_user": "{{var_tandoor_user}}",
+		"ansible.builtin.template": {
+			"src": "conf.j2",
+			"dest": "{{var_tandoor_directory}}/program/.env",
+			"mode": "644"
+		}
+	},
 	{
 		"name": "initialize",
 		"become": true,
 		"become_user": "{{var_tandoor_user}}",
 		"environment": {
-			"VIRTUAL_ENV": "{{var_tandoor_directory}}/program",
+			"VIRTUAL_ENV": "{{var_tandoor_directory}}/program"
 		},
 		"loop": [
 			"migrate",
@@ -74,6 +84,19 @@
 			"cmd": "bin/python3 manage.py {{item}}"
 		}
 	},
+	{
+		"name": "admin account",
+		"become": true,
+		"become_user": "{{var_tandoor_user}}",
+		"environment": {
+			"VIRTUAL_ENV": "{{var_tandoor_directory}}/program"
+		},
+		"ansible.builtin.shell": {
+			"chdir": "{{var_tandoor_directory}}/program",
+			"cmd": "DJANGO_SUPERUSER_PASSWORD={{var_tandoor_admin_password}} bin/python3 manage.py createsuperuser --no-input --username {{var_tandoor_admin_username}} --email {{var_tandoor_admin_email}}"
+		}
+	},
+
 	{
 		"name": "frontend stuff",
 		"become": true,
@@ -83,15 +106,6 @@
 			"cmd": "yarnpkg install && yarnpkg build"
 		}
 	},
-	{
-		"name": "configuration",
-		"become": true,
-		"become_user": "{{var_tandoor_user}}",
-		"ansible.builtin.template": {
-			"src": "conf.j2",
-			"dest": "{{var_tandoor_directory}}/program/.env"
-		}
-	},
 	{
 		"name": "systemd unit",
 		"become": true,

roles/tandoor/templates/systemd-unit.j2

@@ -10,7 +10,7 @@ User={{var_tandoor_user}}
 Group=www-data
 WorkingDirectory={{var_tandoor_directory}}/program
 EnvironmentFile={{var_tandoor_directory}}/program/.env
-ExecStart={{var_tandoor_directory}}/program/bin/gunicorn --error-logfile {{var_tandoor_directory}}/program/gunicorn_err.log --log-level info --capture-output --bind unix:{{var_tandoor_directory}}/program/recipes.sock recipes.wsgi:application
+ExecStart={{var_tandoor_directory}}/program/bin/gunicorn --capture-output --bind unix:{{var_tandoor_directory}}/program/recipes.sock recipes.wsgi:application
 
 [Install]
 WantedBy=multi-user.target