a4f4c814ec
This commit converts all application secrets to SealedSecrets, preventing plaintext secrets from being stored in git. Changes: - Added .gitignore to prevent future plaintext secret commits - Created 20 SealedSecret manifests across 8 applications: * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC * Paperclip (4 secrets): main secrets, auth, OIDC, session * Forgejo (2 secrets): postgres, backup * BookStack (2 secrets): OIDC, MySQL * Passbolt (2 secrets): MariaDB, app secrets * Pocket ID (1 secret) - Removed hardcoded secrets from 6 stalwart deployment files - Replaced plaintext credentials with references to sealed secrets All sealed secrets have been applied to the cluster and services verified to be running correctly. Related: DEV-203 Co-Authored-By: Paperclip <noreply@paperclip.ing>
40 lines
1.2 KiB
YAML
Executable file
40 lines
1.2 KiB
YAML
Executable file
---
|
|
# Stalwart OIDC Configuration
|
|
# This ConfigMap configures Pocket ID as the OAuth provider for Stalwart Mail Server
|
|
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: stalwart-oidc-config
|
|
namespace: mail
|
|
data:
|
|
oauth.toml: |
|
|
# OAuth/OIDC Configuration for Pocket ID
|
|
[oauth]
|
|
|
|
# OAuth provider configuration
|
|
[oauth.pocket-id]
|
|
issuer-url = "https://auth.basicstack.de"
|
|
# client-id and client-secret loaded from SealedSecret: stalwart-oidc-sealed.yaml
|
|
client-id = "REPLACED_BY_SECRET"
|
|
client-secret = "REPLACED_BY_SECRET"
|
|
|
|
# OAuth endpoints (auto-discovered from issuer-url)
|
|
authorization-endpoint = "https://auth.basicstack.de/api/oidc/authorize"
|
|
token-endpoint = "https://auth.basicstack.de/api/oidc/token"
|
|
userinfo-endpoint = "https://auth.basicstack.de/api/oidc/userinfo"
|
|
|
|
# Scopes to request
|
|
scopes = ["openid", "profile", "email"]
|
|
|
|
# Callback URL (must match what's configured in Pocket ID)
|
|
redirect-uri = "https://mail.basicstack.de/login/oauth"
|
|
|
|
# User attribute mapping
|
|
[oauth.pocket-id.user-mapping]
|
|
username = "preferred_username"
|
|
email = "email"
|
|
name = "name"
|
|
---
|
|
# Secret managed via SealedSecrets
|
|
# See: stalwart-oidc-sealed.yaml
|