From 1ace03569c50a6fdbb3617a76a36e8b5814a366c Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 9 Nov 2026 16:29:29 -0600 Subject: [PATCH] Added required keycloak config --- platform/keycloak/client-urls.yaml | 8 ++++++ .../keycloak/keycloak-realm-clients.sops.yaml | 5 ++-- .../keycloak-realm-clients.sops.yaml.example | 1 + platform/keycloak/keycloak-realm-import.yaml | 27 +++++++++++++++++++ ...scanner-oauth2-proxy-credentials.sops.yaml | 6 ++--- 5 files changed, 42 insertions(+), 5 deletions(-) diff --git a/platform/keycloak/client-urls.yaml b/platform/keycloak/client-urls.yaml index 8fe5123..570941a 100644 --- a/platform/keycloak/client-urls.yaml +++ b/platform/keycloak/client-urls.yaml @@ -153,5 +153,13 @@ data: "webOrigins": [ "https://sonarr.${BASE_DOMAIN}" ] + }, + "vuln-scanner": { + "redirectUris": [ + "https://cve.${BASE_DOMAIN}/oauth2/callback" + ], + "webOrigins": [ + "https://cve.${BASE_DOMAIN}" + ] } } diff --git a/platform/keycloak/keycloak-realm-clients.sops.yaml b/platform/keycloak/keycloak-realm-clients.sops.yaml index 3e81068..bba3cb8 100644 --- a/platform/keycloak/keycloak-realm-clients.sops.yaml +++ b/platform/keycloak/keycloak-realm-clients.sops.yaml @@ -17,6 +17,7 @@ stringData: qbittorrent-client-secret: ENC[AES256_GCM,data:jXNg4mF9Li0ilsV53iYeVJCGavVGFjvLk9jKBrRgcH6id1QCzsjs0bbMqJO5nALWfKhD8+CEmYJRrfABYTFKZA==,iv:XbLkX7/tfB/DLeMriHA3Oo2M6hgF1Z6RbHBXmdwUJoA=,tag:gikgdU0ajNKZxxYEUGc1aw==,type:str] radarr-client-secret: ENC[AES256_GCM,data:acsBXdewKB/gJNyoo1CsPLCvZe6fuJWbrKLim1/57OPnDHNoA+OvkQqt12Y4VMAXjzl7BWD2afFTIkIcaNGgaQ==,iv:VSvMaDZeuFyIAWpUoa++khvx07hY6g7X8PxORtjFTVI=,tag:jY5QSw6cMvUhCfX32RNgXA==,type:str] sonarr-client-secret: ENC[AES256_GCM,data:6cCVadKAKh5YbZIPocXG8pNY/AZbo3zCUP/19a0aHK0fIx6QzvBBl7v2vTsY/tq5tiVx8Uzr6oQNo/xt6pIgIA==,iv:EBXBZgpgdt7GiIS0w/Uj/vNE9EBgSgrbaMOKP346GKA=,tag:I2skAB+fdfQTsMgcywOrAg==,type:str] + vuln-scanner-client-secret: ENC[AES256_GCM,data:8LHIcFx42UzW3XMqgDe+lPJD6cdj8m/AWQa7tNPweIFZ7dZgvsDp5zjOUN8z+F+BnAVgMlt4fwHh6F/OyRy12w==,iv:BxdvgUWFyGPcFpWx+rYu2GDwc+cUEKqQGBxtBiuu/Lc=,tag:WQ322UyYtxSewyQBo5Ec1w==,type:str] sops: kms: [] gcp_kms: [] @@ -32,8 +33,8 @@ sops: YXJGUUJiTnFndFhDZDU1bmxXTENCbmsKuhb3RQ3LZmuTPAXEck8b6iuZ5vxLb9fV +fQELmU4kOTbZrPSxy+kpttLG5Cy5d6X2ieZXBf6opzpLTUhlBOkHA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-31T13:42:49Z" - mac: ENC[AES256_GCM,data:/sOLb/XYQ2WB+mPgnTfYXD3y7xwDi926v0e2upBqgcCugtfKHg+Q1C9+XUiG2qE/iIBJyYVtOu9pmiMMNyT9hJ9vm7WFOC6gqukFMo42PjAI4I4PExfjVMKt76kKJ4OZZrKF2IKLjccZFuKDQhfADIR3zl6UNf/x5wz7XpXPEvI=,iv:iV4eOcRxsgTm1uNVMkMwsspj9glKCSZQlBciRY+MDJY=,tag:c72Pks1VJH+gmfP5FOQPSw==,type:str] + lastmodified: "2026-11-09T22:22:55Z" + mac: ENC[AES256_GCM,data:xZTYvTnXI/W5bKpa5orycFIK00+oZXtck9XASOulL9pvvZL+g3VR79mSN5bjmKHvA7LNcd8z2SJhNVqDxuEs1ciOiFHDgMq/ZNS4l0xmy3LJPFKKvgTYjKWgEfGJM9xxzr3SkrTtIFllydQ/7Q2RhHhb5m4pbr2HCLpANkp5bKo=,iv:tYOuIkS5oS2h623gIRUar5M75xd8E1TKTlkloHft3iU=,tag:/rYmgOs9Pz4D0kO53uaoTw==,type:str] pgp: [] encrypted_regex: ^(data|stringData)$ version: 3.9.4 diff --git a/platform/keycloak/keycloak-realm-clients.sops.yaml.example b/platform/keycloak/keycloak-realm-clients.sops.yaml.example index 5bdd6d3..a236295 100644 --- a/platform/keycloak/keycloak-realm-clients.sops.yaml.example +++ b/platform/keycloak/keycloak-realm-clients.sops.yaml.example @@ -40,3 +40,4 @@ stringData: headlamp-client-secret: REPLACE-ME # Mirror into platform/crafty/crafty-oauth2-proxy-credentials.sops.yaml (key: client-secret). crafty-client-secret: REPLACE-ME + vuln-scanner-client-secret: REPLACE-ME diff --git a/platform/keycloak/keycloak-realm-import.yaml b/platform/keycloak/keycloak-realm-import.yaml index d666556..d7ce0a1 100644 --- a/platform/keycloak/keycloak-realm-import.yaml +++ b/platform/keycloak/keycloak-realm-import.yaml @@ -43,6 +43,10 @@ spec: secret: name: keycloak-realm-clients key: crafty-client-secret + VULN_SCANNER_CLIENT_SECRET: + secret: + name: keycloak-realm-clients + key: vuln-scanner-client-secret PIHOLE_CLIENT_SECRET: secret: name: keycloak-realm-clients @@ -525,6 +529,29 @@ spec: # the SAME value is mirrored in apps/wave-0/pihole-oauth2-proxy-credentials.sops.yaml (cross- # namespace mirror). Provisioned live via kcadm at authoring time (2026-08-31) and captured here # as the durable GitOps source of truth (the operator imports the realm once; kcadm is authoritative). + - clientId: vuln-scanner + name: CVE report (oauth2-proxy) + protocol: openid-connect + enabled: true + publicClient: false + standardFlowEnabled: true + directAccessGrantsEnabled: false + secret: "$(env:VULN_SCANNER_CLIENT_SECRET)" + redirectUris: + - https://cve.${BASE_DOMAIN}/oauth2/callback + webOrigins: + - https://cve.${BASE_DOMAIN} + defaultClientScopes: [email, profile, roles] + protocolMappers: + - name: groups + protocol: openid-connect + protocolMapper: oidc-group-membership-mapper + config: + "full.path": "false" + "id.token.claim": "true" + "access.token.claim": "true" + "userinfo.token.claim": "true" + "claim.name": groups - clientId: pihole name: PiHole (oauth2-proxy) protocol: openid-connect diff --git a/platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml b/platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml index 731d484..28cce6b 100644 --- a/platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml +++ b/platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml @@ -6,7 +6,7 @@ metadata: type: Opaque stringData: client-id: ENC[AES256_GCM,data:9n9fMQyIq+JmfgXy,iv:8FLkOTc6Rmck33ecd4A3DXP2CiGrAkxMJ8Q7nmI9naE=,tag:4wb8rAXx+KAIhWAviEKTJQ==,type:str] - client-secret: ENC[AES256_GCM,data:JQCSBroPwd1KxZhdOw9zYkA9krYdK79QpnP/WW3ZIYVoyvHGVKJ2OVPpvgtWy20Ex0yWCTtmpghn87r+4Kkrfw==,iv:RFuDweYB7z5fykB/Ued2Z7MdO9VVY2XoO4gwekxMo0U=,tag:UseTecg5dJMNR1SN6ZUZ7g==,type:str] + client-secret: ENC[AES256_GCM,data:LSfQvWKkIHzdn95JEsXihM4C6V2UVKYYo7O02Xlsc2F1gZknt7BWcv5MYMxlPBAe/tYbiNDdFwj1j7PhNi3DrA==,iv:k3sQ/AxUOh0Qx1WB5L7+JlVdTv+Hj8Ev+DJK+tFIvGU=,tag:be9SGyGa7tupjfLlpv4Rrw==,type:str] cookie-secret: ENC[AES256_GCM,data:F7McZBTr10fnpTEz8cYjXsvrwRgqiKrlcaL/mSZKjOjuPfaSvq4sV3YBuQc=,iv:2vDEqmUHFFpUsRkBSqj3X92eT2bP8VTj2BiAr/8+7ak=,tag:rdHVky9JmlcEEhsxV6OtnA==,type:str] sops: kms: [] @@ -23,8 +23,8 @@ sops: cUhWcGNGSThYTkRaV0NSOUZrM2ZmS1UKjFe6iGia0+QOZgWcSFoH0LLEp1f2M2ds V8bIBIFTtRDTKp6kgt0nee+Sgb7g5D5NIGTrRDGE256I8jdiNDcMpw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-11-09T15:43:11Z" - mac: ENC[AES256_GCM,data:jXBQdruY8yLD4k3iRHqn78Pq0iXzETDk/S8qyXSVFHsacqUvmtzdOw6ajJDg7hAkVGN9PXqH+lsz45wR3a3YVODbQZJyS0+cKuQ1cVWlV/wcWOlNSdeKSLRe8h658KjXGUPQubaDFB4rloBfUr5ebuGQGr4ZEj7g241xjrsjBic=,iv:asoMnTjsIIb1AgrgE9dERixbpw94TpQWCPRwAT3mXYM=,tag:uwCVmjDr3gDQAqWsmiF0tA==,type:str] + lastmodified: "2026-11-09T22:22:55Z" + mac: ENC[AES256_GCM,data:cC/ciBcVf6ORsjajmvGjiBdUemzP2/UKWRRAJI0I/yM5/XIlF32n/pnah2T2l6bXfCxkzohXgzGB6fc+d65jH27znr4iZ9ZWLsS3K6S6xTcJXaj0TFX+X5xZKhZyn45//4qae4AZa+2PlojaRNBytScj7HvfS62MA/Id2L1A3vA=,iv:IT8DM7Ebp8yjUYQ/FGZtA91rIRTIL62jlqsf9k2Fm6Y=,tag:HEX2gVJ80FM60TynRJME/A==,type:str] pgp: [] encrypted_regex: ^(data|stringData)$ version: 3.9.4