55 lines
1.6 KiB
YAML
55 lines
1.6 KiB
YAML
---
|
|
- name: Read OIDC client secret for Forgejo
|
|
set_fact:
|
|
forgejo_oidc_client_secret: "{{ AUTHELIA_OIDC_FORGEJO_CLIENT_SECRET | default(lookup('env', 'AUTHELIA_OIDC_FORGEJO_CLIENT_SECRET')) }}"
|
|
no_log: true
|
|
|
|
- name: Fail if OIDC client secret for Forgejo is missing
|
|
fail:
|
|
msg: "AUTHELIA_OIDC_FORGEJO_CLIENT_SECRET is required"
|
|
when: forgejo_oidc_client_secret | length == 0
|
|
|
|
- name: Create Forgejo directory
|
|
file:
|
|
path: /opt/forgejo
|
|
state: directory
|
|
|
|
- name: Copy Docker Compose file for Forgejo
|
|
template:
|
|
src: docker-compose.yml.j2
|
|
dest: /opt/forgejo/docker-compose.yml
|
|
|
|
- name: Deploy Forgejo
|
|
command: docker compose up -d --force-recreate
|
|
args:
|
|
chdir: /opt/forgejo
|
|
|
|
- name: Run Forgejo database migrations
|
|
command: docker exec --user 1000:1000 forgejo-forgejo-1 forgejo migrate
|
|
changed_when: false
|
|
|
|
- name: Configure Forgejo OIDC auth source (Authelia)
|
|
shell: |
|
|
set -euo pipefail
|
|
cid=$(docker ps -q --filter name=forgejo-forgejo-1 | head -n1)
|
|
if [ -z "$cid" ]; then
|
|
exit 1
|
|
fi
|
|
|
|
if docker exec --user 1000:1000 "$cid" forgejo admin auth list | grep -q "authelia"; then
|
|
exit 0
|
|
fi
|
|
|
|
docker exec --user 1000:1000 "$cid" forgejo admin auth add-oauth \
|
|
--provider=openidConnect \
|
|
--name=authelia \
|
|
--key=forgejo \
|
|
--secret="$FORGEJO_OIDC_CLIENT_SECRET" \
|
|
--auto-discover-url=https://{{ auth_hostname }}/.well-known/openid-configuration \
|
|
--scopes='openid email profile groups' \
|
|
--group-claim-name=groups \
|
|
--admin-group=admins
|
|
changed_when: false
|
|
environment:
|
|
FORGEJO_OIDC_CLIENT_SECRET: "{{ forgejo_oidc_client_secret }}"
|
|
no_log: true
|