feat(nextcloud,semaphore): wire native Keycloak OIDC SSO (break-glass admins retained)

Extends the SSO work to the two remaining `auth: oidc` apps still on local-admin logins, each as a native confidential client of the Keycloak `homelab` realm with its local admin kept as break-glass (docs/15 availability caveat; R-IDP-02/06). Realm (source of truth): add the `nextcloud` and `semaphore` confidential clients to platform/keycloak/keycloak-realm-import.yaml (modeled on grafana/gitea) + their NEXTCLOUD_CLIENT_SECRET / SEMAPHORE_CLIENT_SECRET placeholders. As before, a KeycloakRealmImport no-ops on an already-existing realm, so both live clients were ALSO created via kcadm (nextcloud e95049ed-ca10-4085-97d9-4bbef495fe61, semaphore 1835bfe9-b125-4026-8f69-33557519cf4a); the YAML keeps git authoritative. Secrets (SOPS/age): add nextcloud-client-secret + semaphore-client-secret to keycloak-realm-clients.sops.yaml (keycloak ns). Mirror the nextcloud secret as oidc-client-secret into nextcloud-bootstrap (nextcloud ns). For semaphore, the whole SEMAPHORE_OIDC_PROVIDERS JSON (which embeds the client secret) is held encrypted as oidc-providers-json in semaphore-bootstrap (semaphore ns). All values verified == the live clients; existing keys untouched; no plaintext in git. App config (catalog source + re-render): - nextcloud: add NEXTCLOUD_OIDC_CLIENT_SECRET env + an idempotent postStart hook that installs/enables user_oidc and runs `occ user_oidc:provider keycloak` (create-or-update; secret via --clientsecret-env so it never hits argv; occ as www-data; group provisioning on the `groups` claim). Syntax verified against the running user_oidc 8.11.0 on Nextcloud 31.0.14; su-to-www-data env passthrough verified. Missing-secret/not-installed guards prevent crashloops. - semaphore: add SEMAPHORE_OIDC_PROVIDERS env sourced from the encrypted oidc-providers-json (provider_url=realm issuer/auto-discovery, redirect /api/auth/oidc/keycloak/redirect). Mechanism verified against semaphore v2.19.10 source (util ConfigType oidc_providers env tag + OidcProvider struct + router redirect path); no kubelet service-link env collision. apps/wave-1/{nextcloud,semaphore}.yaml re-rendered via `render.py --no-image-automation` (diffs are env/lifecycle-only). Verified: realm import Done=True/HasErrors=False and platform-config Ready=True/Healthy=True (unchanged); edited realm YAML passes server dry-run; live homelab clients now include gitea/nextcloud/semaphore; static gate (lint/l0/l1) green. Browser SSO login for each still needs a human check. Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-27 17:17:13 -05:00
1 parent 87388712f0
commit f163026954
@@ -8,6 +8,8 @@ stringData:
    grafana-client-secret: ENC[AES256_GCM,data:J6grYrkJVubGNS+z1WrcUuvjKu2Z/fETWNXsKkjQnk/RlitaMjDqkazglKgy8PkEymNLNuVao48gksnuNLQ6aA==,iv:9sw5IdW+7GuwsRjn4NSi2JVZh9mTE2hiWJQYQS7w2bA=,tag:2hOUFeFqcQJsPeC8e6U4RA==,type:str]
    oauth2-proxy-client-secret: ENC[AES256_GCM,data:hE9mN6A6uTL3GpqOCGb3T0qVR9bcY4wcqNlgcrs9+uezSeci/Vs9uiXeFzfD57klHe8nEqxF1bCftD0GVFadhQ==,iv:rP2CbbGG4LWmGyV0adrlsmn2GtQLH8hSlqbioOAD824=,tag:p28vfuSZxYMs7XnAjslBWg==,type:str]
    gitea-client-secret: ENC[AES256_GCM,data:ObU5sWSq2xEZKgqwccFo/kzs/nfhOVJ0NceBlgxgy6a6iOWeUN079iQpJ0ADoJyjsoQk1IQediFD06rwVSvNIQ==,iv:Bc4L8MngA6YKNRQRwEQojnUo5ixdS2t1AocvGMwE0oQ=,tag:YsozaKtL6CR68sPmGiL5wA==,type:str]
+    nextcloud-client-secret: ENC[AES256_GCM,data:Uh3+EqIr88CNNt3KfDYP8lbNIhcB9iQrxJvbaxek40hD+JYAJmUP31WQypyDY3BiSvkjE6urr9PJmYoDgz7tkw==,iv:Tg4WAgyydIUBB1mqdOZPt0HsCkWSGNPvbI4WtFKj9V8=,tag:1LgZYdDPVEM+9UROanBllw==,type:str]
+    semaphore-client-secret: ENC[AES256_GCM,data:BX5lXhFNX6vQh67G2+XM2vt9wymhL8Psx+NqQJneFup7gdZRjhk8paEU5dOfugZNwooieara7UFyAFm5+1BJFg==,iv:kmmz0ZiCZgsSowns3hjDTQzoD2lPCr9Oz1iS5WgbhEE=,tag:BbesQX6lxAhaGiqPqMQ9vA==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -23,8 +25,8 @@ sops:
            YXJGUUJiTnFndFhDZDU1bmxXTENCbmsKuhb3RQ3LZmuTPAXEck8b6iuZ5vxLb9fV
            +fQELmU4kOTbZrPSxy+kpttLG5Cy5d6X2ieZXBf6opzpLTUhlBOkHA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-27T21:58:13Z"
-    mac: ENC[AES256_GCM,data:+QNCSmJMoAAUibsQZ7by/Neno6VfxLoxCNUoRwHAW+T3SDrgQI7hkrVcWr39bpCne7AAGnlyVS7Zd4m3lk/ZGs90LbSx5xdFyGPQ7vpI774aaIMQJe+84pBPLGw1NH8bVmDOS99P0rlIG0lGBixl4UqrQ3BWhgnd63tAvnKnCBU=,iv:K4Wi+LvKhszj3bnRBuheHdbS2UwhlN6hBJP/H3nEo9M=,tag:P4+14EaB88QQNzDvCUlnJA==,type:str]
+    lastmodified: "2026-08-27T22:12:32Z"
+    mac: ENC[AES256_GCM,data:nruWApjP/BK694O9/BtSsQExmjtWTBNCfq+FyXDtockjRdDHRmyxuePVdfvm2F/OO7AuxI2EPYhr+a1SiB+RYGWfz7GCtbKW1iDPPmgiAnGxFH/HiuEGpa7S4+CVkNaD1j/z6jBkYe6oPko2IO/ezVtcTG/x7Wzst8vRDeid5Tw=,iv:wzuEl5cnycPMpoBGWrx1F2YoIgFufZ9se0yzVcQznEQ=,tag:B5pSL2IEC9T5maa7UZhYJw==,type:str]
    pgp: []
    encrypted_regex: ^(data|stringData)$
    version: 3.9.4
@@ -27,6 +27,14 @@ spec:
      secret:
        name: keycloak-realm-clients
        key: gitea-client-secret
+    NEXTCLOUD_CLIENT_SECRET:
+      secret:
+        name: keycloak-realm-clients
+        key: nextcloud-client-secret
+    SEMAPHORE_CLIENT_SECRET:
+      secret:
+        name: keycloak-realm-clients
+        key: semaphore-client-secret
  realm:
    realm: homelab
    enabled: true
@@ -182,6 +190,68 @@ spec:
              "access.token.claim": "true"
              "userinfo.token.claim": "true"
              "claim.name": groups
+      # nextcloud — native OIDC SSO for the file-sync host (catalog/nextcloud.yaml auth.mode oidc; docs/13
+      # SSO row, docs/15; R-IDP-02). Confidential auth-code client modeled on grafana. Redirect URI is the
+      # user_oidc app's callback (/apps/user_oidc/code). The `groups` claim drives group provisioning in
+      # Nextcloud (user_oidc --group-provisioning; R-IDP-06). The LOCAL Nextcloud admin stays break-glass
+      # (docs/15). Secret injected from the SOPS keycloak-realm-clients Secret via NEXTCLOUD_CLIENT_SECRET.
+      - clientId: nextcloud
+        name: Nextcloud
+        protocol: openid-connect
+        enabled: true
+        publicClient: false
+        standardFlowEnabled: true
+        directAccessGrantsEnabled: false
+        secret: "$(env:NEXTCLOUD_CLIENT_SECRET)"
+        redirectUris:
+          - https://nextcloud.home.keithjackson.dev/apps/user_oidc/code
+        webOrigins:
+          - https://nextcloud.home.keithjackson.dev
+        defaultClientScopes:
+          - email
+          - profile
+          - roles
+        protocolMappers:
+          - name: groups
+            protocol: openid-connect
+            protocolMapper: oidc-group-membership-mapper
+            config:
+              "full.path": "false"
+              "id.token.claim": "true"
+              "access.token.claim": "true"
+              "userinfo.token.claim": "true"
+              "claim.name": groups
+      # semaphore — native OIDC SSO for the Ansible UI (catalog/semaphore.yaml auth.mode oidc; docs/13 SSO
+      # row, docs/15; R-IDP-02). Confidential auth-code client modeled on grafana. Redirect URI is
+      # Semaphore's OIDC callback (/api/auth/oidc/<provider>/redirect for provider `keycloak`). The
+      # `groups` claim is exposed for authorization (R-IDP-06). The LOCAL Semaphore admin stays break-glass
+      # (docs/15). Secret injected from the SOPS keycloak-realm-clients Secret via SEMAPHORE_CLIENT_SECRET.
+      - clientId: semaphore
+        name: Semaphore
+        protocol: openid-connect
+        enabled: true
+        publicClient: false
+        standardFlowEnabled: true
+        directAccessGrantsEnabled: false
+        secret: "$(env:SEMAPHORE_CLIENT_SECRET)"
+        redirectUris:
+          - https://semaphore.home.keithjackson.dev/api/auth/oidc/keycloak/redirect
+        webOrigins:
+          - https://semaphore.home.keithjackson.dev
+        defaultClientScopes:
+          - email
+          - profile
+          - roles
+        protocolMappers:
+          - name: groups
+            protocol: openid-connect
+            protocolMapper: oidc-group-membership-mapper
+            config:
+              "full.path": "false"
+              "id.token.claim": "true"
+              "access.token.claim": "true"
+              "userinfo.token.claim": "true"
+              "claim.name": groups
    # --- MFA for platform-admins (R-IDP-04): a browser flow whose OTP step is CONDITIONAL on the
    #     platform-admin role. Non-admins log in without OTP; platform-admins must enroll/present TOTP.
    #     Set as the realm browserFlow below. VERIFY at bring-up (see runbook): a malformed flow fails