bitborg/bitborg-infra
Bevaka
2
0
Avgrena
Du har redan avgrenat bitborg-infra
 0
Kod Ärenden 64 Ändringsförfrågningar 3 Projekt 1 Utgåvor Paket Wiki Aktiviteter Actions

docs(runbook): control-panel bitborg-web OAuth2 client bootstrap (#47) #98

Sammanfogat
supernaut sammanfogade 1 incheckning från feat/47-control-panel-kanidm-client in i main 2026-07-18 15:48:03 +00:00
Konversation 0 Incheckningar 1 Ändrade filer 1 +39
supernaut kommenterad 2026-07-18 07:17:42 +00:00
Ägare
Kopiera länk

Closes #47.

Finding: the code plumbing already exists

The web role already injects the control-panel OIDC config end-to-end, gated on web_auth_enabled (= both vault_web_oidc_client_secret and vault_web_session_secret set):

  • bitborg-web.container.j2: OIDC_ISSUER/CLIENT_ID/REDIRECT_URI/ADMIN_GROUP env + OIDC_CLIENT_SECRET/SESSION_SECRET podman secrets.
  • group_vars: web_oidc_client_id, web_oidc_issuer, web_oidc_admin_group.

So #47's only real gap was the Kanidm bitborg-web OAuth2 client — which, like the Forgejo and Grafana clients, is created out-of-band (the provision state's systems.oauth2 is intentionally empty).

Change

Runbook subsection mirroring the Forgejo bootstrap: create the bitborg-web client (redirect /auth/callback, PKCE on, forgejo_users scope map, groups claim → forgejo_admins = panel admin), vault the client secret + an openssl rand session key, apply --tags web, verify, rotate. Notes the panel stays 404 until both secrets exist, so applying on prod before bootstrap is safe.

Pairs with bitborg-web#36 (JWKS verify + security review — done on branch feat/36-oidc-security-review).

Verification

  • markdownlint clean. No code change (plumbing pre-existed and was re-read to confirm).

Apply-day

Operator runs the Kanidm bootstrap (needs idm_admin), vaults the two secrets, site.yml --tags web. Verify /account login end-to-end.

Closes #47. ## Finding: the code plumbing already exists The web role already injects the control-panel OIDC config end-to-end, gated on `web_auth_enabled` (= both `vault_web_oidc_client_secret` and `vault_web_session_secret` set): - `bitborg-web.container.j2`: `OIDC_ISSUER/CLIENT_ID/REDIRECT_URI/ADMIN_GROUP` env + `OIDC_CLIENT_SECRET`/`SESSION_SECRET` podman secrets. - group_vars: `web_oidc_client_id`, `web_oidc_issuer`, `web_oidc_admin_group`. So #47's only real gap was the **Kanidm `bitborg-web` OAuth2 client** — which, like the Forgejo and Grafana clients, is created out-of-band (the provision state's `systems.oauth2` is intentionally empty). ## Change Runbook subsection mirroring the Forgejo bootstrap: create the `bitborg-web` client (redirect `/auth/callback`, PKCE on, `forgejo_users` scope map, `groups` claim → `forgejo_admins` = panel admin), vault the client secret + an `openssl rand` session key, `apply --tags web`, verify, rotate. Notes the panel stays 404 until both secrets exist, so applying on prod before bootstrap is safe. Pairs with bitborg-web#36 (JWKS verify + security review — done on branch `feat/36-oidc-security-review`). ## Verification - markdownlint clean. No code change (plumbing pre-existed and was re-read to confirm). ## Apply-day Operator runs the Kanidm bootstrap (needs `idm_admin`), vaults the two secrets, `site.yml --tags web`. Verify `/account` login end-to-end.
supernaut tvångsskickade feat/47-control-panel-kanidm-client från 805ba84ac6
Alla kontroller lyckades
ci / ci (pull_request) Successful in 1m36s
Detaljer
till 263f331a88
Alla kontroller lyckades
ci / ci (pull_request) Successful in 1m39s
Detaljer
2026-07-18 14:58:38 +00:00 Jämför
supernaut tvångsskickade feat/47-control-panel-kanidm-client från 263f331a88
Alla kontroller lyckades
ci / ci (pull_request) Successful in 1m39s
Detaljer
till 508237c7ee
Alla kontroller lyckades
ci / ci (pull_request) Successful in 1m42s
Detaljer
2026-07-18 15:23:44 +00:00 Jämför
supernaut sammanfogade incheckning 6b1d83e7ce till main 2026-07-18 15:48:03 +00:00
supernaut tog bort grenen feat/47-control-panel-kanidm-client 2026-07-18 15:48:03 +00:00
supernaut ändrade titeln från docs(runbook): control-panel gitborg-web OAuth2 client bootstrap (#47) till docs(runbook): control-panel bitborg-web OAuth2 client bootstrap (#47) 2026-08-03 09:58:44 +00:00
Logga in för att delta i denna konversation.
Granskare
Inga granskare
Etiketter
Rensa etiketter
  
area/backups
Backup & restore

  
area/ci
Actions / runners

  
area/control-panel
Logged-in self-service area

  
area/identity
Kanidm / OIDC / entitlements

  
area/infra
Infrastructure (OpenTofu/Ansible/host)

  
area/observability
Monitoring / logs / analytics

  
area/payments
Billing / payment providers

  
area/security
Security & compliance (incl. ISO 27001)

  
area/storage
Volumes / data / LFS

  
area/web
Public web portal (gitborg-web)

  
blocked
Evaluated and specified, but waiting on an external dependency

  
needs-info
Waiting on the reporter for more information

  
needs-triage
Not yet evaluated

  
ready-for-implementation
Fully specified, ready to be picked up

  
type
bug
 Something is broken

  
type
chore
 Maintenance / housekeeping

  
type
docs
 Documentation

  
type
epic
 High-level roadmap item

  
type
feature
 New capability

  
type
task
 Concrete unit of work

  
wontfix
Will not be actioned

Inga etiketter
area/backups
area/ci
area/control-panel
area/identity
area/infra
area/observability
area/payments
area/security
area/storage
area/web
blocked
needs-info
needs-triage
ready-for-implementation
type
bug
type
chore
type
docs
type
epic
type
feature
type
task
wontfix
Milstolpe
Rensa milstolpe
Inga objekt
Ingen milstolpe
Projekt
Rensa projekt
Inga objekt
Inget projekt
Tilldelade
Rensa tilldelade
Inga tilldelade
1 deltagare
Notiser
Förfallodatum
Förfallodatumet är ogiltigt eller utanför gränserna. Använd formatet "åååå-mm-dd".

Inget förfallodatum satt.

Beroenden

Inga beroenden satta

Referens
bitborg/bitborg-infra!98
Ingen beskrivning angiven.