From 80b7950200898ceb9c6f6efb012e7b5469fcfb0e Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2009@qq.com>
Date: Fri, 28 Apr 2023 01:28:53 +0800
Subject: [PATCH] roles/gitlab: add keycloak sso oidc config

---
 playbook/jobs/init_gitlab                     |  3 ++
 playbook/roles/gitlab/files/setup.sh          | 34 +++++++++----------
 playbook/roles/gitlab/tasks/main.yml          |  7 +++-
 playbook/roles/gitlab/templates/provider.yaml | 18 ++++++++++
 4 files changed, 44 insertions(+), 18 deletions(-)
 create mode 100644 playbook/roles/gitlab/templates/provider.yaml

diff --git a/playbook/jobs/init_gitlab b/playbook/jobs/init_gitlab
index f28a4305..1a7794f1 100644
--- a/playbook/jobs/init_gitlab
+++ b/playbook/jobs/init_gitlab
@@ -11,6 +11,9 @@
         namespace: gitlab
         domain: onwalk.net
         auto_issuance: true
+        generic:
+            - name: gitlab-sso-secret
+              value: "provider=/tmp/provider.yaml"
         tls:
           - secret_name: gitlab-tls
             keyfile: /etc/ssl/onwalk.net.key
diff --git a/playbook/roles/gitlab/files/setup.sh b/playbook/roles/gitlab/files/setup.sh
index ee5ad4ba..01004fec 100644
--- a/playbook/roles/gitlab/files/setup.sh
+++ b/playbook/roles/gitlab/files/setup.sh
@@ -9,53 +9,53 @@ cat > gitlab-values.yaml <<EOF
 global:
   edition: ce
   hosts:
-    https: true
     domain: $domain
     gitlab:
       name: gitlab.$domain
+    https: true
   ingress:
     class: nginx
-    enabled: true
     configureCertmanager: false
+    enabled: true
     tls:
       enabled: true
-      secretName: ${gitlab_secret}
+      secretName: $gitlab_secret
   minio:
     enabled: true
   appConfig:
     omniauth:
       enabled: true
-      syncProfileAttributes: [email]
-      allowSingleSignOn: ['openid_connect']
       autoLinkLdapUser: false
       autoLinkSamlUser: false
+      blockAutoCreatedUsers: false
+      autoSignInWithProvider: null
+      autoLinkUser:
+        - 'openid_connect'
+      allowSingleSignOn:
+        - 'openid_connect'
       providers:
-	- secret: $gitlab_sso_secret
-          key: provider
-registry:
-  enabled: true
-  ingress:
-    enabled: false
-gitlab-exporter:
-  enabled: false
+      - secret: $gitlab_sso_secret
+        key: provider
 kas:
   enabled: false
 nginx-ingress:
   enabled: false
+postgresql:
+  metrics:
+    enabled: false
 prometheus:
   install: false
 redis:
   metrics:
     enabled: false
-postgresql:
-  metrics:
-    enabled: false
+upgradeCheck:
+  enabled: false
 certmanager:
   install: false
   installCRDs: false
   startupapicheck:
     enabled: false
-upgradeCheck:
+gitlab-exporter:
   enabled: false
 EOF
 
diff --git a/playbook/roles/gitlab/tasks/main.yml b/playbook/roles/gitlab/tasks/main.yml
index 9b4ee1e4..6e5972e9 100755
--- a/playbook/roles/gitlab/tasks/main.yml
+++ b/playbook/roles/gitlab/tasks/main.yml
@@ -10,6 +10,11 @@
 
 #- name: Show Debug Info
 #  debug: var=db_password_raw verbosity=0
+#
+- name: Sync provider.yaml
+  template: src=templates/{{ item }}  dest=/tmp/{{ item }} owner=root group=root mode=0644 force=yes unsafe_writes=yes
+  with_items:
+    - provider.yaml
 
 - name: Setup Gitlab Server
   script: files/setup.sh {{ domain }} {{ namespace }} {{ gitlab_secret }} {{ gitlab_sso_secret }}
@@ -27,7 +32,7 @@
 #          {{ smtp_address }}       \
 #          {{ smtp_username }}      \
 #          {{ smtp_emailfrom }}     \
-#          {{ smtp_display_name }}  \
+#          {{ smtp_display_name }}  
 #          {{ oidc_issuer_url }}    \
 #          {{ oidc_client_id }}     \
 #          {{ oidc_client_token }}
diff --git a/playbook/roles/gitlab/templates/provider.yaml b/playbook/roles/gitlab/templates/provider.yaml
new file mode 100644
index 00000000..6d7b73a6
--- /dev/null
+++ b/playbook/roles/gitlab/templates/provider.yaml
@@ -0,0 +1,18 @@
+name: 'openid_connect'
+label: 'keycloak-sso'
+args:
+  name: 'openid_connect'
+  scope:
+    - 'openid'
+    - 'profile'
+    - 'email'
+  pkce: true
+  discovery: true
+  response_type: 'code'
+  client_auth_method: 'query'
+  send_scope_to_token_endpoint: true
+  issuer: 'https://keycloak.onwalk.net/realms/cloud-sso'
+  client_options:
+    identifier: 'gitlab-oidc'
+    secret: 'xxxxxxxxxxxxxxx'
+    redirect_uri: 'https://gitlab.onwalk.net/users/auth/openid_connect/callback'