samply/bridgehead
1
0
Fork 0
mirror of https://github.com/samply/bridgehead.git synced 2026-03-31 21:30:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add custom CA file support for OVIS oauth2-proxy in setup script and compose file

Browse Source 
Enhanced the OVIS setup by introducing support for custom OIDC CA files in the oauth2-proxy configuration. Updated the ovis-compose.yml to include new environment variables and volume mounts for trusted CA certificates. Modified the ovis-setup.sh script to detect and log the presence of custom CA files, ensuring secure communication with OIDC providers.
This commit is contained in:
tm16-medma
2026-03-26 15:41:03 +01:00
parent 1e1d0e99d0
commit fd2cf2dead
2 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ccp/modules/ovis-compose.yml
View File

@@ -6,6 +6,8 @@ services:
environment: environment:
- http_proxy=http://forward_proxy:3128 - http_proxy=http://forward_proxy:3128
- https_proxy=http://forward_proxy:3128 - https_proxy=http://forward_proxy:3128
- OAUTH2_PROXY_USE_SYSTEM_TRUST_STORE=true
- OAUTH2_PROXY_PROVIDER_CA_FILES=${OVIS_OAUTH2_PROXY_PROVIDER_CA_FILES}
- OAUTH2_PROXY_PROVIDER=oidc - OAUTH2_PROXY_PROVIDER=oidc
- OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
- OAUTH2_PROXY_OIDC_ISSUER_URL=${OIDC_PRIVATE_URL} - OAUTH2_PROXY_OIDC_ISSUER_URL=${OIDC_PRIVATE_URL}
@@ -27,6 +29,8 @@ services:
- OAUTH2_PROXY_ALLOWED_GROUPS=${OIDC_USER_GROUP} - OAUTH2_PROXY_ALLOWED_GROUPS=${OIDC_USER_GROUP}
- OAUTH2_PROXY_OIDC_GROUPS_CLAIM=${OIDC_GROUP_CLAIM} - OAUTH2_PROXY_OIDC_GROUPS_CLAIM=${OIDC_GROUP_CLAIM}
- OAUTH2_PROXY_PROXY_PREFIX=/oauth2-ovis - OAUTH2_PROXY_PROXY_PREFIX=/oauth2-ovis
volumes:
- /etc/bridgehead/trusted-ca-certs:/etc/bridgehead/trusted-ca-certs:ro
labels: labels:
- "traefik.enable=true" - "traefik.enable=true"
- "traefik.http.services.ovis-traefik-forward-auth.loadbalancer.server.port=4180" - "traefik.http.services.ovis-traefik-forward-auth.loadbalancer.server.port=4180"

15
ccp/modules/ovis-setup.sh
View File

@@ -2,6 +2,21 @@
if [ -n "$ENABLE_OVIS" ]; then if [ -n "$ENABLE_OVIS" ]; then
log INFO "OVIS setup detected -- will start OVIS services with local oauth2-proxy middleware." log INFO "OVIS setup detected -- will start OVIS services with local oauth2-proxy middleware."
TRUSTED_CA_DIR="/etc/bridgehead/trusted-ca-certs"
if [ -d "$TRUSTED_CA_DIR" ]; then
shopt -s nullglob
ca_candidates=("$TRUSTED_CA_DIR"/*.crt "$TRUSTED_CA_DIR"/*.pem)
shopt -u nullglob
if [ ${#ca_candidates[@]} -gt 0 ]; then
OVIS_OAUTH2_PROXY_PROVIDER_CA_FILES="$(IFS=,; printf '%s' "${ca_candidates[*]}")"
log INFO "OVIS oauth2-proxy will trust custom OIDC CA files from $TRUSTED_CA_DIR."
else
log INFO "No custom OIDC CA files (*.crt/*.pem) found in $TRUSTED_CA_DIR; using container system trust store only."
fi
fi
OVERRIDE+=" -f ./$PROJECT/modules/ovis-compose.yml" OVERRIDE+=" -f ./$PROJECT/modules/ovis-compose.yml"
add_private_oidc_redirect_url "/oauth2-ovis/callback" add_private_oidc_redirect_url "/oauth2-ovis/callback"
fi fi