Skip to content

Commit 6a65144

Browse files
SailRealSailReal
authored
Merge pull request #121 from cryptomator/feature/keycloak-26.x
Update Hub setup wizard to Hub 1.4.0 with Keycloak 26.x
2 parents e84c0ec + a919df5 commit 6a65144

File tree

1 file changed

+34
-38
lines changed

1 file changed

+34
-38
lines changed

‎assets/js/hubsetup.js‎

Lines changed: 34 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,7 @@ class HubSetup {
3333
publicUrl: 'https://domain.tld',
3434
adminUser: 'admin',
3535
adminPw: 'admin',
36-
syncerUser: 'syncer', // TODO: randomize?
37-
syncerPw: HubSetup.uuid(),
36+
systemClientSecret: HubSetup.uuid(),
3837
}
3938
}
4039
}
@@ -113,7 +112,7 @@ ${e}`;
113112
result += '# * KC_DB\n# * KC_HEALTH_ENABLED\n# * KC_HTTP_RELATIVE_PATH\n\n';
114113
}
115114

116-
result += '# Generated using script version 6\n\n';
115+
result += '# Generated using script version 7\n\n';
117116

118117
return result;
119118
}
@@ -231,16 +230,6 @@ GRANT ALL PRIVILEGES ON DATABASE hub TO hub;`);
231230
'realm-management': ['realm-admin']
232231
}
233232
}
234-
},
235-
{
236-
name: 'syncer',
237-
description: 'syncer',
238-
composite: true,
239-
composites: {
240-
client: {
241-
'realm-management': ['view-users']
242-
}
243-
}
244233
}
245234
],
246235
},
@@ -253,13 +242,11 @@ GRANT ALL PRIVILEGES ON DATABASE hub TO hub;`);
253242
realmRoles: ['admin']
254243
},
255244
{
256-
username: this.cfg.hub.syncerUser,
257-
firstName: "syncer",
258-
lastName: "syncer",
259-
email: "syncer@localhost",
245+
username: 'system',
246+
email: "system@localhost",
260247
enabled: true,
261-
credentials: [{ type: 'password', value: this.cfg.hub.syncerPw, temporary: false }],
262-
realmRoles: ['syncer']
248+
serviceAccountClientId: "cryptomatorhub-system",
249+
clientRoles: { 'realm-management' : ['realm-admin'] }
263250
}
264251
],
265252
scopeMappings: [
@@ -325,6 +312,16 @@ GRANT ALL PRIVILEGES ON DATABASE hub TO hub;`);
325312
frontchannelLogout: false,
326313
protocol: 'openid-connect',
327314
attributes: { 'pkce.code.challenge.method': 'S256' },
315+
},
316+
{
317+
clientId: 'cryptomatorhub-system',
318+
serviceAccountsEnabled: true,
319+
publicClient: false,
320+
name: 'Cryptomator Hub System',
321+
enabled: true,
322+
clientAuthenticatorType: 'client-secret',
323+
secret: this.cfg.hub.systemClientSecret,
324+
standardFlowEnabled: false,
328325
}],
329326
browserSecurityHeaders: {
330327
contentSecurityPolicy: `frame-src 'self'; frame-ancestors 'self' ${HubSetup.urlWithTrailingSlash(this.cfg.hub.publicUrl)}; object-src 'none';`
@@ -431,7 +428,7 @@ EOF`;
431428
'init-config': {condition: 'service_completed_successfully'},
432429
'postgres': {condition: 'service_healthy'}
433430
},
434-
image: 'ghcr.io/cryptomator/keycloak:24.0.4',
431+
image: 'ghcr.io/cryptomator/keycloak:26.1.5',
435432
command: startCmd,
436433
volumes: ['kc-config:/opt/keycloak/data/import'],
437434
deploy: {
@@ -441,7 +438,7 @@ EOF`;
441438
},
442439
...(!this.cfg.compose.includeTraefik && {ports: [`${this.getPort(this.cfg.keycloak.publicUrl)}:8080`]}),
443440
healthcheck: {
444-
test: ['CMD', 'curl', '-f', `http://localhost:8080${this.getPathname(HubSetup.urlWithTrailingSlash(this.cfg.keycloak.publicUrl))}health/live`],
441+
test: ['CMD', 'curl', '-f', `http://localhost:9000${this.getPathname(HubSetup.urlWithTrailingSlash(this.cfg.keycloak.publicUrl))}health/live`],
445442
interval: '60s',
446443
timeout: '3s',
447444
},
@@ -454,10 +451,10 @@ EOF`;
454451
KC_DB_USERNAME: 'keycloak',
455452
KC_DB_PASSWORD: this.cfg.db.keycloakPw,
456453
KC_HEALTH_ENABLED: 'true',
457-
KC_HOSTNAME: devMode ? null : this.getHostname(this.cfg.keycloak.publicUrl),
454+
KC_HOSTNAME: devMode ? null : 'https://' + this.getHostname(this.cfg.keycloak.publicUrl),
458455
// KC_HOSTNAME_PORT: devMode ? null : this.getPort(this.cfg.keycloak.publicUrl), // FIXME as string!! FIXME does not work at all!!
459456
KC_HTTP_ENABLED: 'true',
460-
KC_PROXY: 'edge',
457+
KC_PROXY_HEADERS: 'xforwarded',
461458
KC_HTTP_RELATIVE_PATH: this.getPathname(this.cfg.keycloak.publicUrl),
462459
},
463460
...(this.cfg.compose.includeTraefik && this.getTraefikConfig(this.cfg.keycloak.publicUrl, 'kc'))
@@ -478,7 +475,7 @@ EOF`;
478475
},
479476
...(!this.cfg.compose.includeTraefik && {ports: [`${this.getPort(this.cfg.hub.publicUrl)}:8080`]}),
480477
healthcheck: {
481-
test: ['CMD-SHELL', '(curl -f http://localhost:8080/q/health/live && curl -f http://localhost:8080/api/config) || exit 1'],
478+
test: ['CMD-SHELL', '(curl -f http://localhost:9000/q/health/live && curl -f http://localhost:8080/api/config) || exit 1'],
482479
interval: '10s',
483480
timeout: '3s',
484481
},
@@ -488,9 +485,8 @@ EOF`;
488485
HUB_KEYCLOAK_PUBLIC_URL: this.cfg.keycloak.publicUrl,
489486
HUB_KEYCLOAK_LOCAL_URL: !this.cfg.keycloak.useExternal ? `http://keycloak:8080${this.getPathname(this.cfg.keycloak.publicUrl)}` : this.cfg.keycloak.publicUrl,
490487
HUB_KEYCLOAK_REALM: this.cfg.keycloak.realmId,
491-
HUB_KEYCLOAK_SYNCER_USERNAME: this.cfg.hub.syncerUser,
492-
HUB_KEYCLOAK_SYNCER_PASSWORD: this.cfg.hub.syncerPw,
493-
HUB_KEYCLOAK_SYNCER_CLIENT_ID: 'admin-cli',
488+
HUB_KEYCLOAK_SYSTEM_CLIENT_ID: 'cryptomatorhub-system',
489+
HUB_KEYCLOAK_SYSTEM_CLIENT_SECRET: this.cfg.hub.systemClientSecret,
494490
HUB_KEYCLOAK_SYNCER_PERIOD: '5m', // TODO make configurable?
495491
HUB_KEYCLOAK_OIDC_CRYPTOMATOR_CLIENT_ID: 'cryptomator',
496492
QUARKUS_OIDC_AUTH_SERVER_URL: new URL(`realms/${this.cfg.keycloak.realmId}`, HubSetup.urlWithTrailingSlash(!this.cfg.keycloak.useExternal ? `http://keycloak:8080${this.getPathname(this.cfg.keycloak.publicUrl)}` : this.cfg.keycloak.publicUrl)).href, // network-internal URL
@@ -499,6 +495,7 @@ EOF`;
499495
QUARKUS_DATASOURCE_JDBC_URL: 'jdbc:postgresql://postgres:5432/hub',
500496
QUARKUS_DATASOURCE_USERNAME: 'hub',
501497
QUARKUS_DATASOURCE_PASSWORD: this.cfg.db.hubPw,
498+
QUARKUS_HTTP_PROXY_PROXY_ADDRESS_FORWARDING: true,
502499
QUARKUS_HTTP_HEADER__CONTENT_SECURITY_POLICY__VALUE: `default-src 'self'; connect-src 'self' api.cryptomator.org ${HubSetup.urlWithTrailingSlash(this.cfg.keycloak.publicUrl)}; object-src 'none'; child-src 'self'; img-src * data:; frame-ancestors 'none'`
503500
},
504501
...(this.cfg.compose.includeTraefik && this.getTraefikConfig(this.cfg.hub.publicUrl, 'hub')),
@@ -608,8 +605,7 @@ class KubernetesConfigBuilder extends ConfigBuilder {
608605
'db_admin_pass': this.cfg.db.adminPw,
609606
'db_hub_pass': this.cfg.db.hubPw,
610607
...(!this.cfg.keycloak.useExternal) && { 'db_kc_pass': this.cfg.db.keycloakPw },
611-
'hub_syncer_user': this.cfg.hub.syncerUser,
612-
'hub_syncer_pass': this.cfg.hub.syncerPw,
608+
'hub_system_client_secret': this.cfg.hub.systemClientSecret,
613609
'initdb.sql': this.getInitDbSQL(),
614610
...(!this.cfg.keycloak.useExternal) && { 'realm.json': JSON.stringify(realmCfg, null, 2) }
615611
}
@@ -657,7 +653,7 @@ class KubernetesConfigBuilder extends ConfigBuilder {
657653
args: [
658654
'/bin/sh',
659655
'-c',
660-
`set -x; while ! wget -q --spider "http://keycloak-svc:8080${this.getPathname(HubSetup.urlWithTrailingSlash(this.cfg.keycloak.publicUrl))}health/live" 2>>/dev/null; do sleep 10; done`
656+
`set -x; while ! wget -q --spider "http://keycloak-svc:9000${this.getPathname(HubSetup.urlWithTrailingSlash(this.cfg.keycloak.publicUrl))}health/live" 2>>/dev/null; do sleep 10; done`
661657
]
662658
}] : [])],
663659
containers: [{
@@ -683,9 +679,8 @@ class KubernetesConfigBuilder extends ConfigBuilder {
683679
{name: 'HUB_KEYCLOAK_PUBLIC_URL', value: this.cfg.keycloak.publicUrl},
684680
{name: 'HUB_KEYCLOAK_LOCAL_URL', value: !this.cfg.keycloak.useExternal ? `http://keycloak-svc:8080${this.getPathname(this.cfg.keycloak.publicUrl)}` : this.cfg.keycloak.publicUrl},
685681
{name: 'HUB_KEYCLOAK_REALM', value: this.cfg.keycloak.realmId},
686-
{name: 'HUB_KEYCLOAK_SYNCER_USERNAME', valueFrom: {secretKeyRef: {name: 'hub-secrets', key: 'hub_syncer_user'}}},
687-
{name: 'HUB_KEYCLOAK_SYNCER_PASSWORD', valueFrom: {secretKeyRef: {name: 'hub-secrets', key: 'hub_syncer_pass'}}},
688-
{name: 'HUB_KEYCLOAK_SYNCER_CLIENT_ID', value: 'admin-cli'},
682+
{name: 'HUB_KEYCLOAK_SYSTEM_CLIENT_ID', value: 'cryptomatorhub-system'},
683+
{name: 'HUB_KEYCLOAK_SYSTEM_CLIENT_SECRET', valueFrom: {secretKeyRef: {name: 'hub-secrets', key: 'hub_system_client_secret'}}},
689684
{name: 'HUB_KEYCLOAK_SYNCER_PERIOD', value: '5m'}, // TODO make configurable?
690685
{name: 'HUB_KEYCLOAK_OIDC_CRYPTOMATOR_CLIENT_ID', value: 'cryptomator'},
691686
{name: 'QUARKUS_OIDC_AUTH_SERVER_URL', value: new URL(`realms/${this.cfg.keycloak.realmId}`, HubSetup.urlWithTrailingSlash(!this.cfg.keycloak.useExternal ? `http://keycloak-svc:8080${this.getPathname(this.cfg.keycloak.publicUrl)}` : this.cfg.keycloak.publicUrl)).href},
@@ -694,6 +689,7 @@ class KubernetesConfigBuilder extends ConfigBuilder {
694689
{name: 'QUARKUS_DATASOURCE_JDBC_URL', value: 'jdbc:postgresql://postgres-svc:5432/hub'},
695690
{name: 'QUARKUS_DATASOURCE_USERNAME', value: 'hub'},
696691
{name: 'QUARKUS_DATASOURCE_PASSWORD', valueFrom: {secretKeyRef: {name: 'hub-secrets', key: 'db_hub_pass'}}},
692+
{name: 'QUARKUS_HTTP_PROXY_PROXY_ADDRESS_FORWARDING', value: 'true'},
697693
...(this.cfg.keycloak.useExternal || this.getHostname(this.cfg.hub.publicUrl) != this.getHostname(this.cfg.keycloak.publicUrl) ? [{name: 'QUARKUS_HTTP_HEADER__CONTENT_SECURITY_POLICY__VALUE', value: `default-src 'self'; connect-src 'self' api.cryptomator.org ${HubSetup.urlWithTrailingSlash(this.cfg.keycloak.publicUrl)}; object-src 'none'; child-src 'self'; img-src * data:; frame-ancestors 'none'`}] : [])
698694
]
699695
}]
@@ -775,11 +771,11 @@ class KubernetesConfigBuilder extends ConfigBuilder {
775771
{name: 'KC_DB_PASSWORD', valueFrom: {secretKeyRef: {name: 'hub-secrets', key: 'db_kc_pass'}}},
776772
{name: 'KC_HEALTH_ENABLED', value: 'true'},
777773
{name: 'KC_HTTP_ENABLED', value: 'true'},
778-
{name: 'KC_PROXY', value: 'edge'},
774+
{name: 'KC_PROXY_HEADERS', value: 'xforwarded'},
779775
{name: 'KC_HTTP_RELATIVE_PATH', value: this.getPathname(this.cfg.keycloak.publicUrl)}
780776
];
781777
if (!devMode) {
782-
env.push({name: 'KC_HOSTNAME', value: this.getHostname(this.cfg.keycloak.publicUrl)});
778+
env.push({name: 'KC_HOSTNAME', value: 'https://' + this.getHostname(this.cfg.keycloak.publicUrl)});
783779
// env.push({name: 'KC_HOSTNAME_PORT', value: '' + this.getPort(this.cfg.keycloak.publicUrl)}); // FIXME as string!! FIXME does not work at all!!
784780
}
785781
let deployment = {
@@ -803,20 +799,20 @@ class KubernetesConfigBuilder extends ConfigBuilder {
803799
}],
804800
containers: [{
805801
name: 'keycloak',
806-
image: 'ghcr.io/cryptomator/keycloak:24.0.4',
802+
image: 'ghcr.io/cryptomator/keycloak:26.1.5',
807803
command: startCmd,
808804
ports: [{containerPort: 8080}],
809805
resources: {
810806
requests: {cpu: '25m', memory: '512Mi'},
811807
limits: {cpu: '1000m', memory: '1024Mi'},
812808
},
813809
livenessProbe: {
814-
httpGet: {path: `${this.getPathname(HubSetup.urlWithTrailingSlash(this.cfg.keycloak.publicUrl))}health/live`, port: 8080},
810+
httpGet: {path: `${this.getPathname(HubSetup.urlWithTrailingSlash(this.cfg.keycloak.publicUrl))}health/live`, port: 9000},
815811
initialDelaySeconds: 120,
816812
periodSeconds: 60
817813
},
818814
readinessProbe: {
819-
httpGet: {path: `${this.getPathname(HubSetup.urlWithTrailingSlash(this.cfg.keycloak.publicUrl))}health/ready`, port: 8080},
815+
httpGet: {path: `${this.getPathname(HubSetup.urlWithTrailingSlash(this.cfg.keycloak.publicUrl))}health/ready`, port: 9000},
820816
initialDelaySeconds: 10,
821817
periodSeconds: 3
822818
},

0 commit comments

Comments
 (0)