- Harden hedgedoc config mode
- Enable keycloak authentication on HedgeDoc (and disable user registration)
- Unconfuse variable names in hedgedoc manifest
- Set session secret for hedgedoc
Related to T2951
Details
Details
- Reviewers
ardumont vsellier - Maniphest Tasks
- T2951: Integrate hedgedoc with keycloak
- Commits
- rSPSITE1c3d314fddbb: Set session secret for hedgedoc
rSPSITE1d65506caa88: Enable keycloak authentication on HedgeDoc
rSPSITEed5266af59a1: Unconfuse variable names in hedgedoc manifest
rSPSITEc9c80f291c9e: Harden hedgedoc config mode
diff origin/production/bardo.internal.admin.swh.network current/bardo.internal.admin.swh.network
*******************************************
File[/opt/hedgedoc/config.json] =>
parameters =>
content =>
@@ -1,5 +1,5 @@
{
"production": {
- "sessionSecret": "change-this-secret",
+ "sessionSecret": "hedgedoc::session_secret",
"allowAnonymous": true,
"allowAnonymousEdit": true,
@@ -10,5 +10,16 @@
"allowOrigin": [ "localhost", "hedgedoc.softwareheritage.org"],
"email": true,
- "allowEmailRegister": true,
+ "allowEmailRegister": false,
+ "oauth2": {
+ "baseURL": "https://auth.softwareheritage.org/",
+ "userProfileURL": "https://auth.softwareheritage.org/auth/realms/SoftwareHeritage/protocol/openid-connect/userinfo",
+ "userProfileUsernameAttr": "preferred_username",
+ "userProfileDisplayNameAttr": "name",
+ "userProfileEmailAttr": "email",
+ "tokenURL": "https://auth.softwareheritage.org/auth/realms/SoftwareHeritage/protocol/openid-connect/token",
+ "authorizationURL": "https://auth.softwareheritage.org/auth/realms/SoftwareHeritage/protocol/openid-connect/auth",
+ "clientID": "hedgedoc",
+ "clientSecret": "hedgedoc::keycloak::client::secret"
+ },
"hsts": {
"enable": true,
mode =>
- 0644
+ 0600
*******************************************
*** End octocatalog-diff on bardo.internal.admin.swh.networkChecked that the new config.json file works on the prod instance 0:-)
Diff Detail
Diff Detail
- Repository
- rSPSITE puppet-swh-site
- Lint
Automatic diff as part of commit; lint not applicable. - Unit
Automatic diff as part of commit; unit tests not applicable.