a5fe631717
## Changes ### Identity Provider (Authentik) - ✅ Deployed Authentik 2025.10.3 as identity provider - ✅ Configured automatic bootstrap with admin account (akadmin) - ✅ Fixed OIDC provider creation with correct redirect_uris format - ✅ Added automated OAuth2/OIDC provider configuration for Nextcloud - ✅ API-driven provider setup eliminates manual configuration ### Nextcloud Configuration - ✅ Fixed reverse proxy header configuration (trusted_proxies) - ✅ Added missing database indices (fs_storage_path_prefix) - ✅ Ran mimetype migrations for proper file type handling - ✅ Verified PHP upload limits (16GB upload_max_filesize) - ✅ Configured OIDC integration with Authentik - ✅ "Login with Authentik" button auto-configured ### Automation Scripts - ✅ Added deploy-client.sh for automated client deployment - ✅ Added rebuild-client.sh for infrastructure rebuild - ✅ Added destroy-client.sh for cleanup - ✅ Full deployment now takes ~10-15 minutes end-to-end ### Documentation - ✅ Updated README with automated deployment instructions - ✅ Added SSO automation workflow documentation - ✅ Added automation status tracking - ✅ Updated project reference with Authentik details ### Technical Fixes - Fixed Authentik API redirect_uris format (requires list of dicts with matching_mode) - Fixed Nextcloud OIDC command (user_oidc:provider not user_oidc:provider:add) - Fixed file lookup in Ansible (changed to slurp for remote files) - Updated Traefik to v3.6 for Docker API 1.44 compatibility - Improved error handling in app installation tasks ## Security - All credentials stored in SOPS-encrypted secrets - Trusted proxy configuration prevents IP spoofing - Bootstrap tokens auto-generated and secured ## Result Fully automated SSO deployment - no manual configuration required! 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
67 lines
2.3 KiB
YAML
67 lines
2.3 KiB
YAML
---
|
|
# Deploy applications to client servers
|
|
# This playbook deploys Authentik, Nextcloud, and other applications
|
|
|
|
- name: Deploy applications to client servers
|
|
hosts: all
|
|
become: yes
|
|
|
|
pre_tasks:
|
|
- name: Gather facts
|
|
setup:
|
|
|
|
- name: Determine client name from hostname
|
|
set_fact:
|
|
client_name: "{{ inventory_hostname }}"
|
|
|
|
- name: Load client secrets
|
|
community.sops.load_vars:
|
|
file: "{{ playbook_dir }}/../../secrets/clients/{{ client_name }}.sops.yaml"
|
|
name: client_secrets
|
|
age_keyfile: "{{ lookup('env', 'SOPS_AGE_KEY_FILE') }}"
|
|
no_log: true
|
|
|
|
- name: Set client domain from secrets
|
|
set_fact:
|
|
client_domain: "{{ client_secrets.client_domain }}"
|
|
when: client_secrets.client_domain is defined
|
|
|
|
- name: Set Authentik domain from secrets
|
|
set_fact:
|
|
authentik_domain: "{{ client_secrets.authentik_domain }}"
|
|
when: client_secrets.authentik_domain is defined
|
|
|
|
roles:
|
|
- role: authentik
|
|
- role: nextcloud
|
|
|
|
post_tasks:
|
|
- name: Display deployment summary
|
|
debug:
|
|
msg: |
|
|
============================================================
|
|
🎉 Deployment complete for client: {{ client_name }}
|
|
============================================================
|
|
|
|
Services deployed and configured:
|
|
✓ Authentik SSO: https://{{ authentik_domain }}
|
|
✓ Nextcloud: https://nextcloud.{{ client_domain }}
|
|
✓ SSO Integration: Fully automated (OAuth2/OIDC)
|
|
|
|
Authentik Admin Access:
|
|
- Username: akadmin
|
|
- Password: {{ client_secrets.authentik_bootstrap_password }}
|
|
- API Token: Configured automatically
|
|
|
|
Nextcloud Admin Access:
|
|
- Username: {{ client_secrets.nextcloud_admin_user }}
|
|
- Password: {{ client_secrets.nextcloud_admin_password }}
|
|
|
|
End User Access:
|
|
1. Create users in Authentik: https://{{ authentik_domain }}
|
|
2. Users login to Nextcloud via "Login with Authentik" button
|
|
3. First login creates linked Nextcloud account automatically
|
|
|
|
============================================================
|
|
Ready to use! No manual configuration required.
|
|
============================================================
|