setup oidc for dozzle
This commit is contained in:
nick committed
1 parent
4910bc3fad
commit
a79f49c046
3 files changed
+30
-1
No files matched your search
@@ -0,0 +1,130 @@
|
||||
variant: flatcar
|
||||
version: 1.0.0
|
||||
|
||||
# Dozzle log viewer hub.
|
||||
#
|
||||
# Rendered with templatefile(): the OIDC client id and secret come from
|
||||
# Infisical (DOZZLE_OIDC_CLIENT_ID / DOZZLE_OIDC_CLIENT_SECRET in
|
||||
# secrets.tmpl), so neither is committed. The secret does still land in
|
||||
# plaintext in the rendered Ignition snippet on the node, and in
|
||||
# "systemctl show dozzle.service" -- same caveat as headscale_authkey.
|
||||
#
|
||||
# Aggregates container logs from the dozzle agents running on the other Flatcar
|
||||
# VMs (see the dozzle-agent units in the other butane configs) and, via the
|
||||
# local socket, from this host's own containers. Reachable on :8080.
|
||||
#
|
||||
# No state is kept on disk: /data is a tmpfs, so the container is fully
|
||||
# disposable and there is nothing to back up. That is also why simple auth
|
||||
# (users.yml) is not used -- it would need a persistent /data.
|
||||
#
|
||||
# Hub <-> agent traffic is TLS, using the certificate pair baked into the
|
||||
# dozzle image. Every hub and agent on the same image version shares it, so
|
||||
# nothing needs mounting here -- which is also why the agents must stay pinned
|
||||
# to the same tag as the hub. To move to a custom pair later, generate one
|
||||
# with (writes into $PWD):
|
||||
#
|
||||
# docker run --rm -v "$PWD":/out amir20/dozzle:v11.1.1 generate-certs \
|
||||
# --cert-out /out/dozzle_cert.pem --key-out /out/dozzle_key.pem
|
||||
#
|
||||
# ...then mount it at /dozzle_cert.pem and /dozzle_key.pem (read-only) on the
|
||||
# hub and on every agent. Keep the key out of this file: it would end up in
|
||||
# plaintext in the rendered Ignition snippet on the node's storage.
|
||||
|
||||
systemd:
|
||||
units:
|
||||
- name: dozzle.service
|
||||
enabled: true
|
||||
contents: |
|
||||
[Unit]
|
||||
Description=Dozzle log viewer hub
|
||||
After=docker.service
|
||||
Requires=docker.service
|
||||
[Service]
|
||||
TimeoutStartSec=0
|
||||
# Kept as unit environment rather than inline -e values so that
|
||||
# wait-for-agents.sh can read the agent list from the same place the
|
||||
# container does. docker run forwards them by bare name below.
|
||||
Environment="DOZZLE_HOSTNAME=Oswald Logs"
|
||||
Environment="DOZZLE_ENABLE_MCP=true"
|
||||
Environment="DOZZLE_REMOTE_AGENT=192.168.7.60:7007|oswald-runner|Goose,192.168.7.61:7007|ai|Goose,192.168.7.62:7007|oswl-connector|Goose,192.168.7.64:7007|cisa-kev-rss|Goose"
|
||||
# OIDC via Authelia. Dozzle builds its redirect from the incoming
|
||||
# request, so the proxy in front must pass the real Host and
|
||||
# X-Forwarded-Proto; the URI to register in Authelia is
|
||||
# https://dozzle.oswaldtheotter.net/api/auth/callback
|
||||
# Authelia publishes no "roles"/"dozzle_roles" claim, only "groups",
|
||||
# so the groups claim is requested as an extra scope and pointed at
|
||||
# directly -- otherwise Dozzle finds no roles and nobody gets admin.
|
||||
Environment="DOZZLE_AUTH_PROVIDER=oidc"
|
||||
Environment="DOZZLE_AUTH_OIDC_ISSUER=https://auth.atlashorizon.net"
|
||||
Environment="DOZZLE_AUTH_OIDC_CLIENT_ID=${dozzle_oidc_client_id}"
|
||||
Environment="DOZZLE_AUTH_OIDC_CLIENT_SECRET=${dozzle_oidc_client_secret}"
|
||||
Environment="DOZZLE_AUTH_OIDC_NAME=AtlasHorizon"
|
||||
Environment="DOZZLE_AUTH_OIDC_SCOPES=dozzle_roles"
|
||||
Environment="DOZZLE_AUTH_OIDC_ROLES_CLAIM=dozzle_roles"
|
||||
# Pulled up front so a slow first pull is not mistaken for a hung unit.
|
||||
ExecStartPre=/usr/bin/docker pull amir20/dozzle:v11.1.1
|
||||
# Leading "-" so a missing container is not a failure.
|
||||
ExecStartPre=-/usr/bin/docker rm --force dozzle
|
||||
# If the hub starts before the agents are listening, the failed initial
|
||||
# handshake leaves a permanently-offline placeholder host in the UI
|
||||
# alongside the real one once it connects. Bounded and "-" prefixed, so
|
||||
# an agent that is genuinely gone delays the hub but never blocks it.
|
||||
ExecStartPre=-/usr/bin/timeout 180 /opt/dozzle/wait-for-agents.sh
|
||||
# Foreground (no -d) so systemd supervises the container process.
|
||||
ExecStart=/usr/bin/docker run --rm --name dozzle \
|
||||
-v /var/run/docker.sock:/var/run/docker.sock:ro \
|
||||
--tmpfs /data \
|
||||
-p 8080:8080 \
|
||||
-e DOZZLE_HOSTNAME \
|
||||
-e DOZZLE_ENABLE_MCP \
|
||||
-e DOZZLE_REMOTE_AGENT \
|
||||
-e DOZZLE_AUTH_PROVIDER \
|
||||
-e DOZZLE_AUTH_OIDC_ISSUER \
|
||||
-e DOZZLE_AUTH_OIDC_CLIENT_ID \
|
||||
-e DOZZLE_AUTH_OIDC_CLIENT_SECRET \
|
||||
-e DOZZLE_AUTH_OIDC_NAME \
|
||||
-e DOZZLE_AUTH_OIDC_SCOPES \
|
||||
-e DOZZLE_AUTH_OIDC_ROLES_CLAIM \
|
||||
amir20/dozzle:v11.1.1
|
||||
ExecStop=/usr/bin/docker stop dozzle
|
||||
Restart=always
|
||||
RestartSec=5s
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
storage:
|
||||
files:
|
||||
# Blocks until every agent named in DOZZLE_REMOTE_AGENT accepts a TCP
|
||||
# connection. The list is read from the environment, so adding or removing
|
||||
# an agent above needs no change here.
|
||||
- path: /opt/dozzle/wait-for-agents.sh
|
||||
mode: 0755
|
||||
contents:
|
||||
inline: |
|
||||
#!/usr/bin/bash
|
||||
# Note: /dev/tcp is unavailable -- Flatcar's bash is built without
|
||||
# net redirections -- so reachability is probed with curl. The agent
|
||||
# speaks gRPC over TLS, so any completed connection answers with a
|
||||
# protocol error; only exit 7 (refused) and 28 (timeout) mean the
|
||||
# agent is not up yet.
|
||||
if [ -z "$DOZZLE_REMOTE_AGENT" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
for entry in $(echo "$DOZZLE_REMOTE_AGENT" | tr ',' ' '); do
|
||||
# Strip the |name|group suffix; what is left is host:port.
|
||||
hostport=$(echo "$entry" | cut -d'|' -f1)
|
||||
while true; do
|
||||
curl -sk -o /dev/null --max-time 3 "https://$hostport"
|
||||
rc=$?
|
||||
case "$rc" in
|
||||
7|28)
|
||||
echo "waiting for dozzle agent $hostport"
|
||||
sleep 2
|
||||
;;
|
||||
*)
|
||||
break
|
||||
;;
|
||||
esac
|
||||
done
|
||||
done
|
||||
Reference in new issue
Block a user