Skip to content

Commit d33260d

Browse files
Brutus5000Brutus5000
committed
Ory Hydra improvements
1 parent 9df251a commit d33260d

File tree

7 files changed

+205
-192
lines changed

7 files changed

+205
-192
lines changed

‎apps/ory-hydra2/templates/deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ spec:
2121
prometheus.io/scrape: 'false'
2222
spec:
2323
containers:
24-
- image: oryd/hydra:v2.3.0
24+
- image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
2525
imagePullPolicy: Always
2626
name: ory-hydra2
2727
envFrom:

‎apps/ory-hydra2/templates/init-clients.yaml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{{- $wave := 1 }}
2+
{{- range .Values.clients }}
3+
---
4+
apiVersion: batch/v1
5+
kind: Job
6+
metadata:
7+
name: ory-hydra-create-client-{{ $wave }}
8+
namespace: faf-apps
9+
labels:
10+
app: ory-hydra-create-clients
11+
argocd.argoproj.io/instance: hydra-clients
12+
annotations:
13+
argocd.argoproj.io/hook: PostSync
14+
#argocd.argoproj.io/hook-delete-policy: HookSucceeded
15+
argocd.argoproj.io/sync-wave: '{{ $wave }}'
16+
spec:
17+
backoffLimit: 1
18+
template:
19+
spec:
20+
containers:
21+
- name: ory-hydra-create-client
22+
image: {{ $.Values.image.repository }}:{{ $.Values.image.tag }}
23+
imagePullPolicy: Always
24+
envFrom:
25+
- configMapRef:
26+
name: ory-hydra2
27+
- secretRef:
28+
name: ory-hydra2
29+
env:
30+
- name: BASE_DOMAIN
31+
value: {{ $.Values.baseDomain }}
32+
- name: ORY_SDK_URL
33+
value: http://ory-hydra2:4445
34+
{{- if .secret }}
35+
- name: OAUTH_SECRET
36+
valueFrom:
37+
secretKeyRef:
38+
name: {{ .secret.name }}
39+
key: {{ .secret.key }}
40+
{{- end}}
41+
command: ["/bin/sh", "-c"]
42+
args:
43+
- |
44+
if ! hydra get oauth2-client "{{ .id }}" >/dev/null 2>&1; then
45+
hydra create oauth2-client \
46+
--name "{{ .name }}" \
47+
--id "{{ .id }}" \
48+
--grant-type "{{ .grantType }}" \
49+
--scope "{{ .scope }}" \
50+
{{- if .secret }}
51+
--secret "$OAUTH_SECRET" \
52+
{{- end}}
53+
{{- if .skipConsent }}
54+
--skip-consent \
55+
{{- end }}
56+
{{- if .redirectUri }}
57+
--redirect-uri "{{ .redirectUri }}" \
58+
{{- end }}
59+
{{- if .logoUri }}
60+
--logo-uri "{{ .logoUri }}" \
61+
{{- end }}
62+
{{- if .tosUri }}
63+
--tos-uri "{{ .tosUri }}" \
64+
{{- end }}
65+
{{- if .policyUri }}
66+
--policy-uri "{{ .policyUri }}" \
67+
{{- end }}
68+
{{- if .tokenEndpointAuthMethod }}
69+
--token-endpoint-auth-method "{{ .tokenEndpointAuthMethod }}"
70+
{{- end }}
71+
{{- if .owner }}
72+
--owner "{{ .owner }}"
73+
{{- end }}
74+
else
75+
echo "Client {{ .id }} already exists, skipping."
76+
fi
77+
restartPolicy: Never
78+
{{- $wave = add $wave 1 }}
79+
{{- end }}

‎apps/ory-hydra2/templates/janitor-cronjob.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ spec:
2020
template:
2121
spec:
2222
containers:
23-
- image: oryd/hydra:v2.3.0
23+
- image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
2424
imagePullPolicy: Always
2525
name: ory-hydra
2626
envFrom:

‎apps/ory-hydra2/templates/migration-cronjob.yaml‎

Lines changed: 0 additions & 35 deletions
This file was deleted.

‎apps/ory-hydra2/templates/migration-job.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
kind: Job
2+
apiVersion: batch/v1
3+
metadata:
4+
name: ory-hydra2-migration
5+
namespace: faf-apps
6+
labels:
7+
app: ory-hydra-migration
8+
annotations:
9+
argocd.argoproj.io/hook: PreSync
10+
argocd.argoproj.io/hook-delete-policy: HookSucceeded
11+
argocd.argoproj.io/sync-wave: '-1'
12+
spec:
13+
backoffLimit: 1
14+
template:
15+
spec:
16+
containers:
17+
- image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
18+
imagePullPolicy: Always
19+
name: ory-hydra-migration
20+
envFrom:
21+
- configMapRef:
22+
name: ory-hydra2
23+
- secretRef:
24+
name: ory-hydra2
25+
ports:
26+
- containerPort: 4444
27+
- containerPort: 4445
28+
args: [ "migrate", "sql", "--read-from-env", "--yes"]
29+
restartPolicy: Never

‎apps/ory-hydra2/values.yaml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
image:
2+
repository: "oryd/hydra"
3+
tag: "v25.4.0"
4+
clients:
5+
- name: "FAF Client"
6+
id: "2e8808cf-5889-469b-b2c3-01f0cc58c4af"
7+
grantType: "authorization_code,refresh_token"
8+
scope: "openid,email,offline,public_profile,lobby,upload_map,upload_mod"
9+
redirectUri: "http://127.0.0.1"
10+
logoUri: "https://$BASE_DOMAIN/images/faf-logo.png"
11+
tosUri: "https://$BASE_DOMAIN/tos"
12+
policyUri: "https://$BASE_DOMAIN/privacy"
13+
tokenEndpointAuthMethod: "none"
14+
15+
- name: "FAF Moderator Client"
16+
id: "8ff5c14f-60e2-41b9-b594-a641dc5013be"
17+
grantType: "authorization_code"
18+
scope: "openid,public_profile,upload_avatar,administrative_actions,read_sensible_userdata,manage_vault"
19+
redirectUri: "http://localhost,http://localhost:8080/,http://127.0.0.1"
20+
logoUri: "https://$BASE_DOMAIN/images/faf-logo.png"
21+
tosUri: "https://$BASE_DOMAIN/tos"
22+
policyUri: "https://$BASE_DOMAIN/privacy"
23+
clientUri: "https://github.com/FAForever/faf-moderator-client"
24+
tokenEndpointAuthMethod: "none"
25+
26+
- name: "Ethereal FAF client"
27+
id: "b05039ed-e2ab-4fb6-8a7f-e6ecdcc2edcd"
28+
grantType: "authorization_code,refresh_token"
29+
scope: "openid,offline,public_profile,lobby,upload_map,upload_mod"
30+
redirectUri: "http://localhost,http://localhost:57728,http://localhost:59573,http://localhost:58256,http://localhost:53037,http://localhost:51360"
31+
logoUri: "https://raw.githubusercontent.com/Eternal-ll/Ethereal-FAF-Client/master/Logo/OAuth.svg"
32+
clientUri: "https://github.com/Eternal-ll/Ethereal-FAF-Client"
33+
tokenEndpointAuthMethod: "none"
34+
35+
- name: "www.$BASE_DOMAIN"
36+
id: "c5613672-0ee5-4956-8b03-c7951ef25640"
37+
secret:
38+
name: faf-website
39+
key: OAUTH_CLIENT_SECRET
40+
skipConsent: true
41+
grantType: "authorization_code,refresh_token"
42+
scope: "openid,offline,public_profile,write_account_data"
43+
redirectUri: "https://www.$BASE_DOMAIN/callback,https://www.$BASE_DOMAIN/auth"
44+
tosUri: "https://$BASE_DOMAIN/tos"
45+
policyUri: "https://$BASE_DOMAIN/privacy"
46+
logoUri: "https://$BASE_DOMAIN/images/faf-logo.png"
47+
clientUri: "https://github.com/FAForever/faf-moderator-client"
48+
tokenEndpointAuthMethod: "client_secret_post"
49+
50+
- name: "voting.$BASE_DOMAIN"
51+
id: "e3dfa9e8-93ad-4593-8b3c-900005439354"
52+
secret:
53+
name: faf-voting
54+
key: CLIENT_SECRET
55+
skipConsent: true
56+
grantType: "authorization_code,refresh_token"
57+
scope: "openid,public_profile"
58+
redirectUri: "https://wiki.$BASE_DOMAIN/login/9edbd0f7-b647-46dc-97c9-3a20293cd830/callback"
59+
tosUri: "https://$BASE_DOMAIN/tos"
60+
policyUri: "https://$BASE_DOMAIN/privacy"
61+
logoUri: "https://$BASE_DOMAIN/images/faf-logo.png"
62+
tokenEndpointAuthMethod: "client_secret_post"
63+
64+
- name: "forum.$BASE_DOMAIN"
65+
id: "97853a31-d7fc-424b-a4c2-f8cd053d10d2"
66+
secret:
67+
name: nodebb
68+
key: OAUTH_SECRET
69+
skipConsent: true
70+
grantType: "authorization_code,refresh_token"
71+
scope: "openid,email,public_profile,lobby"
72+
redirectUri: "https://forum.$BASE_DOMAIN/auth/faf-nodebb/callback"
73+
tosUri: "https://$BASE_DOMAIN/tos"
74+
policyUri: "https://$BASE_DOMAIN/privacy"
75+
logoUri: "https://$BASE_DOMAIN/images/faf-logo.png"
76+
tokenEndpointAuthMethod: "client_secret_post"
77+
78+
- name: "brackman-discord"
79+
id: "fbdc5ce5-9888-4ace-8ccc-378fbcb18992"
80+
secret:
81+
name: ory-hydra2
82+
key: BRACKMAN_DISCORD_SECRET
83+
grantType: "client_credentials"
84+
scope: "public_profile"
85+
tokenEndpointAuthMethod: "client_secret_post"
86+
owner: "Paul Wayper"
87+
88+
- name: "faf-qai"
89+
id: "5eecb64d-0f67-4a72-ac2b-717b8c7efa98"
90+
secret:
91+
name: ory-hydra2
92+
key: FAF_QAI_SECRET
93+
grantType: "client_credentials"
94+
scope: "public_profile"
95+
tokenEndpointAuthMethod: "client_secret_post"

0 commit comments

Comments
 (0)