setup oidc for dozzle

butane/monitor.yaml.tftpl

@@ -3,6 +3,12 @@ version: 1.0.0
 
 # Dozzle log viewer hub.
 #
+# Rendered with templatefile(): the OIDC client id and secret come from
+# Infisical (DOZZLE_OIDC_CLIENT_ID / DOZZLE_OIDC_CLIENT_SECRET in
+# secrets.tmpl), so neither is committed. The secret does still land in
+# plaintext in the rendered Ignition snippet on the node, and in
+# "systemctl show dozzle.service" -- same caveat as headscale_authkey.
+#
 # Aggregates container logs from the dozzle agents running on the other Flatcar
 # VMs (see the dozzle-agent units in the other butane configs) and, via the
 # local socket, from this host's own containers. Reachable on :8080.
@@ -41,6 +47,20 @@ systemd:
         Environment="DOZZLE_HOSTNAME=Oswald Logs"
         Environment="DOZZLE_ENABLE_MCP=true"
         Environment="DOZZLE_REMOTE_AGENT=192.168.7.60:7007|oswald-runner|Goose,192.168.7.61:7007|ai|Goose,192.168.7.62:7007|oswl-connector|Goose,192.168.7.64:7007|cisa-kev-rss|Goose"
+        # OIDC via Authelia. Dozzle builds its redirect from the incoming
+        # request, so the proxy in front must pass the real Host and
+        # X-Forwarded-Proto; the URI to register in Authelia is
+        # https://dozzle.oswaldtheotter.net/api/auth/callback
+        # Authelia publishes no "roles"/"dozzle_roles" claim, only "groups",
+        # so the groups claim is requested as an extra scope and pointed at
+        # directly -- otherwise Dozzle finds no roles and nobody gets admin.
+        Environment="DOZZLE_AUTH_PROVIDER=oidc"
+        Environment="DOZZLE_AUTH_OIDC_ISSUER=https://auth.atlashorizon.net"
+        Environment="DOZZLE_AUTH_OIDC_CLIENT_ID=${dozzle_oidc_client_id}"
+        Environment="DOZZLE_AUTH_OIDC_CLIENT_SECRET=${dozzle_oidc_client_secret}"
+        Environment="DOZZLE_AUTH_OIDC_NAME=AtlasHorizon"
+        Environment="DOZZLE_AUTH_OIDC_SCOPES=dozzle_roles"
+        Environment="DOZZLE_AUTH_OIDC_ROLES_CLAIM=dozzle_roles"
         # Pulled up front so a slow first pull is not mistaken for a hung unit.
         ExecStartPre=/usr/bin/docker pull amir20/dozzle:v11.1.1
         # Leading "-" so a missing container is not a failure.
@@ -58,6 +78,13 @@ systemd:
           -e DOZZLE_HOSTNAME \
           -e DOZZLE_ENABLE_MCP \
           -e DOZZLE_REMOTE_AGENT \
+          -e DOZZLE_AUTH_PROVIDER \
+          -e DOZZLE_AUTH_OIDC_ISSUER \
+          -e DOZZLE_AUTH_OIDC_CLIENT_ID \
+          -e DOZZLE_AUTH_OIDC_CLIENT_SECRET \
+          -e DOZZLE_AUTH_OIDC_NAME \
+          -e DOZZLE_AUTH_OIDC_SCOPES \
+          -e DOZZLE_AUTH_OIDC_ROLES_CLAIM \
           amir20/dozzle:v11.1.1
         ExecStop=/usr/bin/docker stop dozzle
         Restart=always