diff --git a/add-ons/authentik/blueprints.yaml b/add-ons/authentik/blueprints.yaml index 813a9bc..c6261b5 100644 --- a/add-ons/authentik/blueprints.yaml +++ b/add-ons/authentik/blueprints.yaml @@ -104,15 +104,41 @@ data: metadata: name: WireGuard admin entries: - - model: authentik_providers_proxy.proxyprovider + # wg-easy rejects logins unless email_verified is true; the default email + # mapping always sends false. + - model: authentik_providers_oauth2.scopemapping + id: verified-email + identifiers: + name: wireguard-admin email + attrs: + scope_name: email + expression: | + return { + "email": request.user.email, + "email_verified": True, + } + - model: authentik_providers_oauth2.oauth2provider id: wireguard-admin-provider identifiers: name: wireguard-admin attrs: authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] - external_host: https://wg-admin.whyredfire.dev - mode: forward_single + client_id: wireguard-admin + client_secret: !Env WIREGUARD_CLIENT_SECRET + grant_types: + - authorization_code + - refresh_token + redirect_uris: + - matching_mode: strict + url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback + - matching_mode: strict + url: https://wg-admin.whyredfire.dev/api/auth/oidc/link + signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]] + property_mappings: + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]] + - !KeyOf verified-email + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]] - model: authentik_core.application id: wireguard-admin identifiers: @@ -121,20 +147,10 @@ data: name: WireGuard Admin provider: !KeyOf wireguard-admin-provider meta_launch_url: https://wg-admin.whyredfire.dev - # Issuing VPN clients is admin-only. + # wg-easy makes every user it registers an admin, so only admins may log in. - model: authentik_policies.policybinding identifiers: order: 0 target: !KeyOf wireguard-admin attrs: group: !Find [authentik_core.group, [name, admins]] - # This replaces the embedded outpost's provider list, so it also names the - # providers created in the UI. - - model: authentik_outposts.outpost - identifiers: - managed: goauthentik.io/outposts/embedded - attrs: - providers: - - !Find [authentik_providers_proxy.proxyprovider, [name, garage-ui]] - - !Find [authentik_providers_proxy.proxyprovider, [name, qbittorrent]] - - !KeyOf wireguard-admin-provider diff --git a/add-ons/authentik/referencegrant.yaml b/add-ons/authentik/referencegrant.yaml index eba9ffb..bf1d8a0 100644 --- a/add-ons/authentik/referencegrant.yaml +++ b/add-ons/authentik/referencegrant.yaml @@ -11,9 +11,6 @@ spec: - group: gateway.networking.k8s.io kind: HTTPRoute namespace: qbit - - group: gateway.networking.k8s.io - kind: HTTPRoute - namespace: wireguard to: - group: "" kind: Service diff --git a/add-ons/authentik/sealed-secret.yaml b/add-ons/authentik/sealed-secret.yaml index 0eda694..f1be567 100644 --- a/add-ons/authentik/sealed-secret.yaml +++ b/add-ons/authentik/sealed-secret.yaml @@ -12,6 +12,7 @@ spec: GOOGLE_CLIENT_ID: AgCV2Rwe/bHbkQ3nkkIs4EFTbsEqQWRaWlXa/fHzkDyNKpd0CTOgqVb6Rd2KYyvoT9iDR0xt/8reLPd9e7B3G3V1oVFV7G1XiErBmzvxr6591+tXzo8JLVpIy0363R87idi2xIKGVii+G5aJvxxhua8IRsNfi4SRtoqpDzjgNbFtm5UDhhlCzcRKkm0zHgLw83d4Uwszu9X9II2A4FuMPD6KvsTFrgHevR1v3OerKl5kvTlUx0O3XEg5mnNUVk46J+D9wfg58bIlgUhMV8NtfKa8I5zmRKhCJySks1zlCgIudCLX7wPYupFgt0nrZjJGx7a546ntPdMVE4IJ+VhlQ94gjdWsVFm07espaQLph9T4CZDKxb6TwyNswhfFxH1Z9auyFf3Cfk2wx5GChNOL0mZ8Zrzcw008c8IUShF8je8JZ60teBffbBNao7XN6JM6a4ac5aKnNwFch9IJUU1qkvcJaZk5hAkeGO9uHrICb6lkr5Rj7t4h9l4mvgfIKXP5YCCKZ+yqrSI8Jpkch/cB0Sphgp7m7QXgGwmWRgdKEk1rP7ioIfoF66mLsfgvOkc+1ySvPgW/rCLbHwzMqJn1Fkk/afbRoWp/guFj1cOY9MrEQIn8ftugeV/0xWiL+y5RyJm7QZc1z5fSj/NTrVCZV0LhBHttPZzoGGWEqjLYQnyJ8p38lK7EU6Pmk4WrEMj7mmdYHEijyPhab+b7guOc+ULbPT7k7sBHXbKrTTUJa09jIqSS4jl2PNrzPCPDIvRpG/cMgNklhNPfvpDQcLdVRA7bsf7navZvDsQ= GOOGLE_CLIENT_SECRET: AgDNFpqV5LGekTMvOBtPE9c6ZVPtT6wN+nCFRhZnvBKIz4I7U9jzisEN7yhc4ud22XJXpS5oR8hN4H+V6Js/bCZMDJefYcdstmHku14kUvoLRUtwPV9tdjiihmb57VLTnT1s1OzbnOqZPwXoCAmGAPLDgZrghBi0id21GgjU41jCHDJCcH1j9RHhE20JwsVG2uz9Tcp6MVYh94aq53V4//bvFXz4xQgVlN8c1jJ/W4rrNM9vmYdMwKyB5509oVWJigowsRlji0FXurR8ovz1AXpMuGj6hUGxLp0uHsqz7FV/0lsd4B2BR9cVRChAR8zDCiiKb4TH2Kmn676/Z+gtJ8vcOQg/WDT1ENzOr6dyndCLVxJvJuvl1EqinzhSqJjUy11HxqULApKKbX1iRJIAIGb6dpeKVoHDKg5xtcWGwaD6epG/tz20agkWBMCFNq5aS80npz28W5GeOQ8aF4X/rpjuEHVLrN+n0pgyS4wjwniB6UJMYRIYk45r0ICUtqyFjOiNzpU70NsPmEjDyItW1EVo+6tb0lRmOI5apm/9yayZXjFISwTAFPdBMrQL+ij4AGw4HMWMmN0aqDO+Kd1c9Jg6wUKluN2Lb6CaxehWeSJiz2wTEhEz8KBkInfezgSekNkw4wjJiBEZ4/M3G6Y/C61ekuVFarRc87cY+S3SomVZDGQcPysfQlieMVpHlfXq/CSDgHhZV3Q+S/wqpy5ZcfsyaU+v4PmvyEc12MZxQ1RGngVJow== GRAFANA_CLIENT_SECRET: AgBSE0QjGwtnyAjO/cy/TBKg+fuyKMSRgeQM/i7tPi9QcLpDjEHquGKmdBHUaeSaon3LRH3CPYQJ61T4d4xsp7EXzCM47MhO/rJ+6Xx+dGiIg071Ijj1qOBYszMNPXLZCst/9EfDEBRXQYmtr8X5UfcyXv8RHewvuqxcwy8qzsPsP5G/CpchGWlZRV3x+R+yCjVmTP7VuatPAltvGuAHsAv3Gh1aEXMJ1F3SsW/SP025V/bMiz1wKWe7/bkqJnXjLkNXWI/lpwzYWQl4/9v1Oiiw+1osH6fHNzXM6RA0ei1/FmlRwS9EqnUnl9hGE76GSllhwU9L6K9boJrKRnZIP6xBOJfrqimZciutTfiu6urghyimVACafQLWkeEB8m/zX1CSxVQ5M95n/dtdlBsWofMVyEtoeTip1HXZF1iee4yMv2yEg8yNSWmnb87fSYIMwpMiv5dYQTLg2WslnEe0DxcnyH+O0/MsmWHFz2f/Z4J6h+kWwMEv1pt8l+xkgbUthGGDx+HIcU9SZ/jyZjnzTt4i4BIbejAoXzMmm6q4zE0BD+9AbAQvEDOg6DW1TIu2mupoKVlqYljNE/9zVOAIBcFL0cJ4HNnW13+ufS4KoptZE3Rfv1tpU6g2MZ4y+QBCOczd+5HgXMtv3P9OweZg/l/LRdbFyH3OZviW/4suJFNbWZNgGUlqT/xyk/C5rn7uGSjSinp0lwkAqfxx7To/KP0jE7hJkVOH1vh+7COpFABJEx/cLAXAaIaVJsio38p5i4s+SMEq85Ew3uI46YKD8ljY7AQN3k66U7xQkLgjAT170Q== + WIREGUARD_CLIENT_SECRET: AgA4hqEjY0IfLpOpi02zj8hyNd+LCYtcmrRkumSR/8hGcccu6o3NJymoIrp32SbXG8triVM6EK16jVioT5Lgt/fCvNp5bWH78TSgzrSGsf8scK0DHTearXpEzk6XLL8OVORLloQRYIejS3QZo17eohAuZ8Mg0XZHTtfO1oJ5lHubu7y6WPKLnQEbNee+PKYpcRbMf+4b3eaRsEGtddneiZ+oowd1j308AwMxBDXN5NCJQepAZrCJp8csIgmkIEk6vSThKHikpkeO2xXmfmurKzJdEqSKoZOgBX6zSV3AycPHOocD49ZVw143J7Q5TqotznCpCxu2R4ogoA6zNPTuXBoEF6zRVDlNoTnh53cWhOWS7DApNMvnM/clWNdE4AdvXj5YpKgp8jgshQrLJMDd1IoenqBl1QdrptA5QVxRsTg/lkwXd8MQSRnB/sqGzQAB2Z/rrCvOBk21M7qJFoJUoLYXMpQY1I7qcJ9ydcGER4sRwdfWs/33C4vq9nw1gMtPFc/+VFpDagLeJ0/y82oQ4Ip1mMz7uTAZTXFFWT04byq7QV5WdwHaIAwJWNGRIi9GG/NvPLZUoJpgX0BQA7Ve0p/f38m48gaq53a/ynRwUF+a6+d2zeA8xjadqdXEIt1SY5LwMLW8mLhVxSfTbJJ/pGw8lJaJ1dtDw9NIm5Jl0ask6ndE30xOs581olJNb/7RshfB5Fczf+hdBlkKyhmQXHukRcZRI/muSDkjgVRteORGZfcr3vPEgstonEE/9SfuuKsGlVFQLw5272qKZVd4RF4f template: metadata: name: authentik-secrets diff --git a/apps/wireguard/deployment.yaml b/apps/wireguard/deployment.yaml index aef3a4f..18de01e 100644 --- a/apps/wireguard/deployment.yaml +++ b/apps/wireguard/deployment.yaml @@ -23,6 +23,10 @@ spec: for b in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do ln -sf xtables-nft-multi "/usr/sbin/$b" done + # Only used to skip the first-run setup; password login is + # disabled in favour of authentik. + INIT_PASSWORD="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')" + export INIT_PASSWORD exec /usr/bin/dumb-init node server/index.mjs command: - /bin/sh @@ -30,16 +34,41 @@ spec: env: - name: DISABLE_IPV6 value: "true" - - name: INIT_ENABLED + - name: DISABLE_PASSWORD_AUTH value: "true" - name: INIT_ALLOWED_IPS value: 192.168.2.0/24 - name: INIT_DNS value: 192.168.2.1 + - name: INIT_ENABLED + value: "true" + - name: INIT_HOST + value: wg.whyredfire.dev + - name: INIT_PORT + value: "27299" + - name: INIT_USERNAME + value: admin + - name: OAUTH_AUTO_LAUNCH + value: oidc + - name: OAUTH_AUTO_REGISTER + value: "true" + - name: OAUTH_OIDC_CLIENT_ID + value: wireguard-admin + - name: OAUTH_OIDC_CLIENT_SECRET + valueFrom: + secretKeyRef: + key: oidc-client-secret + name: wireguard + - name: OAUTH_OIDC_NAME + value: authentik + - name: OAUTH_OIDC_SERVER + value: https://auth.whyredfire.dev/application/o/wireguard-admin/ + - name: OAUTH_PROVIDERS + value: oidc image: ghcr.io/wg-easy/wg-easy:15.4.0 name: wg-easy ports: - - containerPort: 51820 + - containerPort: 27299 name: wireguard protocol: UDP - containerPort: 51821 diff --git a/apps/wireguard/httproute.yaml b/apps/wireguard/httproute.yaml index 9c7a67d..fed45e9 100644 --- a/apps/wireguard/httproute.yaml +++ b/apps/wireguard/httproute.yaml @@ -14,23 +14,9 @@ spec: namespace: traefik sectionName: websecure rules: - - backendRefs: - - name: authentik-server - namespace: authentik - port: 80 - matches: - - path: - type: PathPrefix - value: /outpost.goauthentik.io - backendRefs: - name: wireguard-admin port: 51821 - filters: - - extensionRef: - group: traefik.io - kind: Middleware - name: authentik - type: ExtensionRef matches: - path: type: PathPrefix diff --git a/apps/wireguard/kustomization.yaml b/apps/wireguard/kustomization.yaml index dbaae86..04acdc5 100644 --- a/apps/wireguard/kustomization.yaml +++ b/apps/wireguard/kustomization.yaml @@ -1,9 +1,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: + - sealed-secret.yaml - pvc.yaml - deployment.yaml - service.yaml - service-admin.yaml - - middleware.yaml - httproute.yaml diff --git a/apps/wireguard/middleware.yaml b/apps/wireguard/middleware.yaml deleted file mode 100644 index 9db9a90..0000000 --- a/apps/wireguard/middleware.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - annotations: - argocd.argoproj.io/sync-wave: "1" - name: authentik - namespace: wireguard -spec: - forwardAuth: - address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik - authResponseHeaders: - - X-authentik-username - - X-authentik-groups - - X-authentik-email - - X-authentik-name - - X-authentik-uid - trustForwardHeader: true diff --git a/apps/wireguard/sealed-secret.yaml b/apps/wireguard/sealed-secret.yaml new file mode 100644 index 0000000..cb6a982 --- /dev/null +++ b/apps/wireguard/sealed-secret.yaml @@ -0,0 +1,12 @@ +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: wireguard + namespace: wireguard +spec: + encryptedData: + oidc-client-secret: AgB6atYW4UwwRNY+w7qjuDGY3HzgdvuS4yir22mjjAHzxOoKzy2bnsUZ4JAjco3/BWk42KGeoVmtgU7NDfGkcj5IJLSpDM/Xkq6jReVjMyfvuzuhhJH/goHVxlTg3bHmUJdgUjMyJlZ3pT6K6AQXSdLG8pbveTQQT7YKwiwtlm3R4fibpYSbKMmg3NK9COndlVR+j8nQmxyzyISA1ZapIpj7t1DobpdjKYnk9q8e64f4p6x4sd68Astz/hELNAfgAI/M/Ga0StmOG8Hj63XtIL8Z/IJUGcrHny1hESERIgLB0OiIa4HoWBHl2ioGUEdf9NMcldE3iyfZ0WRH+GrIUFLJdwJneg7VZvHsreaV4tV4Io4kBvKaAGWPJBx8AhAcSqoSeSSbakacyFhlk7tl4m7iFGvmYRlvyfGxERpqNZX/ebf8aR7sHFyPSzQ11EyJ+Nbk0sjns+7otPBkJC3hA66nKN8OtwbruvP124tgkMT1qD/xjpO6sA6BHM5mxBSFtYvfxN6nZvt/5BVPUgidS9vhM1vXovpENFIPs2AiWajHX1DDEMXM2QTgFyt2H9z2tnsZE1sTtuMw2s1iAK6D8YlReZ2IQXjQV4Gga9SbzBNykF5jidHLz+wUKvHhTQgPLF7Hl9v5T6qos2RrG3XmbmKEVLF3G2CLXv0cVwrutknoyCScXEFUn18RYL6aEN+JYt3CnO1L8DxVaoWK/YE2mHBV6v8iJg3JFOKQ/WxxKUKhrm5uJdvyX1p6fv1bxH8uOK676XXCcO2joWvGVWV1xbuY + template: + metadata: + name: wireguard + namespace: wireguard