tinyauth oidc clients and keys

2026-10-20 12:05:05 +03:00
parent e9b0ae25c7
commit fce161e13e
4 changed files with 54 additions and 2 deletions
@@ -29,6 +29,26 @@ spec:
              TINYAUTH_LABELPROVIDER: none
              TINYAUTH_ANALYTICS_ENABLED: "false"
              TINYAUTH_DATABASE_DRIVER: memory
+              TINYAUTH_OIDC_PRIVATEKEYPATH: /oidc/key.pem
+              TINYAUTH_OIDC_PUBLICKEYPATH: /oidc/key.pub
+
+              TINYAUTH_OIDC_CLIENTS_FILEBROWSER_CLIENTID: filebrowser-quantum
+              TINYAUTH_OIDC_CLIENTS_FILEBROWSER_NAME: files.aggtaa.com
+              TINYAUTH_OIDC_CLIENTS_FILEBROWSER_TRUSTEDREDIRECTURIS: https://files.aggtaa.com/api/auth/oidc/callback
+              TINYAUTH_OIDC_CLIENTS_FILEBROWSER_CLIENTSECRET:
+                valueFrom:
+                  secretKeyRef:
+                    name: tinyauth-secrets
+                    key: TINYAUTH_OIDC_CLIENTS_FILEBROWSER_CLIENTSECRET
+
+              TINYAUTH_OIDC_CLIENTS_MDVAULT_CLIENTID: markdown-vault-mcp
+              TINYAUTH_OIDC_CLIENTS_MDVAULT_NAME: markdown-vault-mcp
+              TINYAUTH_OIDC_CLIENTS_MDVAULT_TRUSTEDREDIRECTURIS: https://md-vault.mcp.aggtaa.com/auth/callback
+              TINYAUTH_OIDC_CLIENTS_MDVAULT_CLIENTSECRET:
+                valueFrom:
+                  secretKeyRef:
+                    name: tinyauth-secrets
+                    key: TINYAUTH_OIDC_CLIENTS_MDVAULT_CLIENTSECRET
            probes:
              liveness:
                enabled: true
@@ -74,6 +94,12 @@ spec:
          - path: /config/users
            subPath: users
            readOnly: true
+      oidc-key:
+        type: secret
+        name: tinyauth-oidc-key
+        globalMounts:
+          - path: /oidc
+            readOnly: true
      resources:
        type: configMap
        name: tinyauth-resources
@@ -6,3 +6,4 @@ resources:
  - middleware.yaml
  - secret.enc.yaml
  - configmap.yaml
+  - oidc-key.enc.yaml
@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: tinyauth-oidc-key
+    namespace: auth
+stringData:
+    key.pem: ENC[AES256_GCM,data:1LGq+HOfsvba2hrMBgwTiaJY4oSXNVRRyBQt7k+Dv5ZunCNbc57qxGIAi259zekb4yqdnP9SHUo0Uzmz1lgOUwhw4pPNq8YmWkjoLthjBB5FaNqilifUzFXYG3+fC4WP0IxHWUFDhB4tgP9zwnc682/QnQBMKzDXAL9bnRf8OTemNLnAjHt/+vbOtW6ySSmjnF+RRS0gz9/CjPwnCwfqqqRoIaiHT2I5nKuzSggGDNRENlGHsUCBypP08ZbuyQ+wRMWNDhtuG8KY8pWxkvOfwAjbJtJ34/xTGeWwCUQ0fs6khMXzMmvnPKmG/HTAAWrgLeMlhicDLB74nBMY7zbjX1y2HzJPVXAnWNE2sbWXhBIhi+/koyRdWSoUoD7flEu1O44cgRJSh2QqEa4cw4NC+tRm0Dm0R37vOEgMHF/D3cKBxSmgKLxUKw+ZCn5aYF2+Dwo5L+HtuI0VnQ5caq0HCrPN17m63gceVS/mbGYT/A9XSvxhWh5hrtzzn1v3xER/HdOEK1GlZBOL2QPfzyRx9Yx05f/NLGghK+Jk/OBtaV8+0ORGfjJFi+uU2tus8gznESTtZGG6Oz25aIYj7cYCNM93szk2q2lle8wCK8DX48wD5LEwS/7zcWJ2J0FeH/+ihIi2N6cRAgT2P5CHATFX4ghQkAH3UZF0oC2x0EfRXmVE9K2twuD70CSqmBIZvSqC1zEb5KpL283E5lsfVZu3RRryplONMaZZM2bIJqwaEq0wqbtvTnKFTWQEA4JRzgy4i8cFyxfq8ELoEacsjVgZCrASvMjK9NmuqUt4dbKMSuIz0S780Om1V0OoshJiGi9Thu7AWIi0WURRi0ZkvaiLDuqwx+VS5Vt+1y6JByUlsKZg4Dg6saYePKEqClD5nqTv4KsVU3psldOdlS/S4MhBCK31RPAI0yZbDF7job1K4pYWpzuJNH3jh/EDqzbBbNpnTnt6VA9KJ6obJ1vzOVAQB804WB0+hM8ap8vcqHLRPhqa7wZ9mJKVkPBxcr0B3ZulXn428FpjEzCLhUPXVNdJsxpPq0LtmN4yHsfGA/BVwXveT2gLxF+cT5IHOpQVR1ZI/I62ebCfupHYPhZ5aU/UFbCykc2PPQTVM5acVKnwbkU9nR8PmrrZxNmgTQ1akrrQoAMkPkKBsE8R3MIH4md4QhH1B7NV79OwJHrShGDajCPPkGnvFP6w+S4ecdwLkutg57Vhf9Gpq81ztzaq1W/W5y1ax4rGowlRU5nOHy5hDfyLUr0O79319oit4LD7VVWzFiBxWFNaky617V9B/xXFqxInGmQAJVPoPkCE9cHCNVbrblAeND36zjcr/tEWYlNCakt3sNFRQTWaO0MoF1+iLxCQvK7dpRpA3IhOPhFdBRj11J9PI+zpeSXZHYXP2XrfYna062KYb7BxiRiCrO2HAtgKY2TTcA8LHYQ+QiNefSqiNSN3zI7vclb4D6RmDpbm8Hg+SZV1KdvBYw/laj0ctNOnTqwZY51foDgjDnhbRcR5M1mbpq3LUY6TUUoV4+blR1cUKk3pQD5eHVEB/gI5r/mLoK/aesDhVsqEsI1fmwzGESJOL2zRXwyzuPrWj65yfcN0dDK/d06o7vnHdaJIPrEaAmX0M+jD92thIrrUMgkD6r6WqtCYKy81tKqBkMIb4M4wO1ttZ/6WjM7LjNfGAeYhMOTI/LWjmHR/JKrAantSgRgsE6hNGA+C8VUQTpO1rDWFNXRb/vxsibFSypi481ydaySw6Qum/f+eLrLGJdIgWCtI3H+L42N80+k5l03pyuJixqCk0kqVrDQmITNdkGJvbqA7uR3YncSOjPIWn7q79KUca4qW+O1CwtgBJYJqSJiDCVwi3tZ6zv7eDBcq7PGrN4R3hcarY9GVo0Vr4YdSN9VU5PkaXFfG10XZyrHBOLmm4/2iy7NxxWY8d4Z3nXUjitEIAkUa/CGhA3WMiqMkkbeLeiRtmbXZ8ZcCBO5FEUSG/z11PyLRi0o5kct3GlaUtl/QRg4SBGx4t3iDf5gHPb298+ulSErL40GjKLyiZh+YfNPDqRdIXBpKTjOand1EZe1yiY3otCj9NVUdrvkSFL6lYXcCQvVtzLIvrfev/QVqpIOf9d0gxp/em4JTZ+YauRNu5fXcnqezncpQAcXy27O4y2+4cko8tk7aoBwcrl/fKp13nx22I62IJGzsLA7BNjRHUG13iddZoBOzhbJ3xlgNR0nNlIYNSQ==,iv:ZO366aMLKSUkaMdlejlGGZ8rLAQITDJ+rtqHIDjHJCk=,tag:m3eUo6FRn5Gmrf/ozMGldQ==,type:str]
+    key.pub: ENC[AES256_GCM,data:F0YQFFEAwB+bruva4HB4BKeIjAPhnssnd13JLMRMyLMfF8JdIBbjyKcz8NUVq8l5FxFDy3W3jAJmOfVqUwHfajgdT61S2Rj+dBXwV947ruwBiLS3rTnJvgfLIEOf1f4mG2hZH4X7jodInh7wL+IPC7N9Wqmccdfc1eTvn7GjM5KgU6yzsDIdq8CMTOWciRIgLz81sDCP6mLAy4AG+a6nyzhCYSfoQogbl00CP9i6JdV1FcJfrzQY2lgshgrDOynK2bNxwaRP0CVajAn5ccj8sawvIA5EgcEdoasfGGf3WCUnFKDVmYZDZjpeTGDnCRZMFIpKfXbNavaNn2Gwl1icR58UFKsi7tXCePY8MW12gseONFXDoU6OKo+xtgiEk5SPryrskK3m7Dq+9O7No12f2XNhISGlf/sRtY+WmxxXceUTywoOHVRkbcapODRs0svmJBeQZKJ85tE+Fre1l+1mjLGB4ZeaA0euKEZDtTXT95icepMaHIcbZHURwp5jRfYxp7a9VzpWY+m1rwNtnpHe4A16JoU+0ZARPLCs8kX/DqgZDaSy9f+IUjvQYbNTsUNEJCvtMZPWmr/Vz8Je61/8pGz99g==,iv:L5JDiEFJnBPcXGZMmFUVC8Uq12Bb08qYFWhdZCYBivY=,tag:Lpz7BAOaQ1GK9W6WaZ4LLw==,type:str]
+sops:
+    age:
+        - recipient: age1rvyt7nlnjqeyt6ykwh9fj9d88kjmq9vetcx667ul3ql6fyfz4gqqh9lq9q
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFZGwrK2lEVXBWQnBaeVlx
+            aUVPQVRyOTB2WE5HdWR2VldUbmQxZTBuTFIwCks1dkc5aGVXWnpIN1NYNVA0em14
+            c3h4K3hLYkZlU0VhRUEyajFEZzI3UDgKLS0tIFpLQkxlWGtUTGhoVUpiSW9WOStT
+            blZOcjI3TS84K1hZY0ZxbS95SndsUUEKt3ZYkU2/5uPeU7C72luZYP3tLJJ73ERX
+            A8eUMsVOI5T7Y6/i4B1OQSt1xFBXkMSJu3YU739fxFumdb8juALxzg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-10-20T08:48:16Z"
+    mac: ENC[AES256_GCM,data:IcHXiY7PJpNy/sGirwh7rm8XzyuC/ZfajaxolOgfP0p1bMF6yn2tzgf1vyHJszVEwXE7rLZEriR357PaHyGgkIxDnb76FwLTiw+feEBgpl/77HY1oOnI4yc0LrHh5fkanxadw/krJoQ8JD827Ek9h1LR7ICTJ40EDSpdfwdH/1E=,iv:OXMfJyXrXH4S5v2cTdwJijzE2/4L475ZArA/nw06s48=,tag:ykl0rz2xmhJ9NZIjuU111A==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
@@ -5,6 +5,8 @@ metadata:
    namespace: auth
 stringData:
    users: ENC[AES256_GCM,data:C3Dhfymnr+WLWy18EpY9upXn+f7sY6w0cf3oXO9352PTPCP+rLYQTm8eiJtsU8gp/Uea7lMpsRPHSy8CoRdI8DOGT+hyPyK1ovjLdyO7bEiq0TtYOIFlHSR7Kwo0Cm+pZegSN9e1dm/v51+YyFfX3JpLaymYrlmXL3sFPQ0yOzEuMp3zXSV3VAkJe6gZrswIAUNhY0xmaGItr4Vc2isItDuc16lx7tW2wJHI7NgLI98p9FyU8HlXd9MsiPMxDaXSGeAwnjGU+TEvQv9NbhcZO0sUocSi2zgnRbi0i8Zt,iv:5OVryBqH4VNC71QdZkqZsoDrfbT5++Z5xZjgCFNOAu0=,tag:V+OC7Mad6Dw38u91gp6d/Q==,type:str]
+    TINYAUTH_OIDC_CLIENTS_FILEBROWSER_CLIENTSECRET: ENC[AES256_GCM,data:kBA3jDc+xFyvLNtfPjO+gYtRrT3HgdsoC1MktIgFomA=,iv:JKStNWy9BHcpkSwAG917sC4zzStKcgtU7ZXpKdSraRQ=,tag:VV96+U1EaIQevZHnCDmQag==,type:str]
+    TINYAUTH_OIDC_CLIENTS_MDVAULT_CLIENTSECRET: ENC[AES256_GCM,data:SiipG4qFp536YfrMqfjeZyIA5hxXfDH1JgGGDrkz0bb2mwdSV2S3szLffxNwibL9xAF/dST6I++N5ErLXGH10w==,iv:hzJyoLO1z4eBuDmBYJ5AfSh4RPggJN07EWeKbP+FFV4=,tag:R46K78XLC0BmQ0n6b+irQA==,type:str]
 sops:
    age:
        - recipient: age1rvyt7nlnjqeyt6ykwh9fj9d88kjmq9vetcx667ul3ql6fyfz4gqqh9lq9q
@@ -16,7 +18,7 @@ sops:
            ajBNVW1pa20zKzhISmFBUmdiazA4T1UK0wyvTMGsyJthx2Py1LITvRePQsjKN/9v
            jqKjeeCuVutQCo3FvoVrlkkmiD19jqPDoXjWz95sTN6QjWmP7u6AIA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-10-20T07:13:27Z"
-    mac: ENC[AES256_GCM,data:oLDi3nfNcZir32V88C9q7wDH0Dsgt+ik54XJ+N41bYZSX745T1DFpLyUus5Xy0GKfSHXyjxWKoBuQ3ccEC5IrTE/xLM4XBCQfvV6hh/OtGA5TteCBeWII21YDikkIV12c9T7gHmT3hnUR2ICzPI9Ipsc9TpYG1NPHhrgZRuhJOI=,iv:kuXOPZTeOkMzd9jbdprCgsdPx/kIMFwC065sWx4FVIQ=,tag:ktIi29LDEtfCePWoQ3DHBA==,type:str]
+    lastmodified: "2026-10-20T08:39:59Z"
+    mac: ENC[AES256_GCM,data:pKMx3OwJ5x41WghATDCwDNJADs2KCQkDmDsjfbL6Vx98jFOL+MwvCRujOM2UzzAl8QnNLFddimmpNwoFBifQEbeHTpVnT1uqZkiSV89mM1nIoyYIo3exNoynVUoqp1NXxhfwRrRVC3beF3keTxES//kh8/W3as16R1vgBSLoj6s=,iv:AAiLBicP0tywLWXA67cin51TqV8TBXtlpjazta2PyFs=,tag:wSkJBOIhryUNVlGeKrgmnA==,type:str]
    encrypted_regex: ^(data|stringData)$
    version: 3.11.0