Skip to content

Commit 5d02b07

Browse files
zackpollardzackpollard
authored
feat(zitadel): gitlab oauth and role mapping (#1383)
1 parent 9edcc93 commit 5d02b07

26 files changed

Lines changed: 718 additions & 44 deletions

‎.github/workflows/build-outline-role-sync.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Build and Push outline-role-sync Image
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches: [main]
7+
pull_request:
8+
branches: [main]
9+
release:
10+
types: [published]
11+
12+
concurrency:
13+
group: ${{ github.workflow }}-${{ github.ref }}
14+
cancel-in-progress: true
15+
16+
permissions: {}
17+
18+
jobs:
19+
pre-job:
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: read
23+
outputs:
24+
should_run: ${{ steps.check.outputs.should_run }}
25+
steps:
26+
- name: Check what should run
27+
id: check
28+
uses: immich-app/devtools/actions/pre-job@eed0f8b8165ffcb951f2ba854b2dd031935e1d73 # pre-job-action-v2.0.2
29+
with:
30+
github-token: ${{ github.token }}
31+
force-events: 'workflow_dispatch,release'
32+
filters: |
33+
outline-role-sync:
34+
- 'services/outline-role-sync/**'
35+
- '.github/workflows/build-outline-role-sync.yml'
36+
37+
build_and_push:
38+
needs: [pre-job]
39+
permissions:
40+
packages: write
41+
if: ${{ fromJSON(needs.pre-job.outputs.should_run).outline-role-sync == true }}
42+
runs-on: ubuntu-latest
43+
44+
steps:
45+
- name: Checkout
46+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
47+
with:
48+
persist-credentials: false
49+
50+
- name: Login to GitHub Container Registry
51+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
52+
if: ${{ !github.event.pull_request.head.repo.fork }}
53+
with:
54+
registry: ghcr.io
55+
username: ${{ github.repository_owner }}
56+
password: ${{ secrets.GITHUB_TOKEN }}
57+
58+
- name: Generate docker image tags
59+
id: metadata
60+
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
61+
with:
62+
flavor: |
63+
# Disable latest tag
64+
latest=false
65+
images: |
66+
name=ghcr.io/${{ github.repository_owner }}/outline-role-sync
67+
tags: |
68+
type=ref,event=branch
69+
type=ref,event=pr
70+
type=semver,pattern=v{{version}}
71+
type=semver,pattern=v{{major}}
72+
type=raw,value=release,enable=${{ github.event_name == 'release' }}
73+
74+
- name: Build and push image
75+
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
76+
with:
77+
context: ./services/outline-role-sync
78+
platforms: linux/amd64
79+
push: ${{ !github.event.pull_request.head.repo.fork && steps.metadata.outputs.tags != '' }}
80+
tags: ${{ steps.metadata.outputs.tags }}
81+
labels: ${{ steps.metadata.outputs.labels }}

‎.release-please-manifest.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
"actions/image-build": "0.1.7",
33
"actions/success-check": "0.0.5",
44
"actions/use-mise": "1.1.3",
5+
"services/outline-role-sync": "0.0.0",
56
".github/workflows": "2.3.0",
67
"actions/pre-job": "2.0.3",
78
"actions/create-workflow-token": "1.0.2"

‎kubernetes/apps/tools/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,4 @@ resources:
77
- ./discord-bot/ks.yaml
88
- ./containerssh/ks.yaml
99
- ./outline/ks.yaml
10+
- ./outline-role-sync/ks.yaml

‎kubernetes/apps/tools/outline-role-sync/app/helmrelease.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
apiVersion: helm.toolkit.fluxcd.io/v2
3+
kind: HelmRelease
4+
metadata:
5+
name: outline-role-sync
6+
namespace: tools
7+
spec:
8+
interval: 30m
9+
chart:
10+
spec:
11+
chart: app-template
12+
version: 4.6.2
13+
sourceRef:
14+
kind: HelmRepository
15+
name: bjw-s
16+
namespace: flux-system
17+
maxHistory: 2
18+
install:
19+
remediation:
20+
retries: 3
21+
upgrade:
22+
cleanupOnFail: true
23+
remediation:
24+
strategy: rollback
25+
retries: 3
26+
values:
27+
defaultPodOptions:
28+
labels:
29+
podbump.bo0tzz.me/enabled: 'true'
30+
controllers:
31+
outline-role-sync:
32+
containers:
33+
app:
34+
image:
35+
repository: ghcr.io/immich-app/outline-role-sync
36+
tag: release
37+
env:
38+
OUTLINE_BASE_URL: "https://outline.immich.cloud"
39+
ZITADEL_BASE_URL: "https://zitadel.internal.immich.cloud"
40+
PORT: "8080"
41+
envFrom:
42+
- secretRef:
43+
name: outline-role-sync
44+
probes:
45+
liveness:
46+
enabled: true
47+
custom: true
48+
spec:
49+
httpGet:
50+
path: /health
51+
port: 8080
52+
periodSeconds: 30
53+
readiness:
54+
enabled: true
55+
custom: true
56+
spec:
57+
httpGet:
58+
path: /health
59+
port: 8080
60+
periodSeconds: 10
61+
service:
62+
app:
63+
controller: outline-role-sync
64+
ports:
65+
http:
66+
port: 8080

‎kubernetes/apps/tools/outline-role-sync/app/kustomization.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1beta1
3+
kind: Kustomization
4+
resources:
5+
- ./helmrelease.yaml

‎kubernetes/apps/tools/outline-role-sync/ks.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
apiVersion: kustomize.toolkit.fluxcd.io/v1
3+
kind: Kustomization
4+
metadata:
5+
name: &app outline-role-sync-secrets
6+
namespace: flux-system
7+
spec:
8+
commonMetadata:
9+
labels:
10+
app.kubernetes.io/name: *app
11+
dependsOn:
12+
- name: external-secrets-stores
13+
path: ./kubernetes/apps/tools/outline-role-sync/secrets
14+
prune: true
15+
sourceRef:
16+
kind: GitRepository
17+
name: immich-kubernetes
18+
wait: true
19+
interval: 30m
20+
retryInterval: 1m
21+
timeout: 5m
22+
---
23+
apiVersion: kustomize.toolkit.fluxcd.io/v1
24+
kind: Kustomization
25+
metadata:
26+
name: &app outline-role-sync
27+
namespace: flux-system
28+
spec:
29+
targetNamespace: tools
30+
commonMetadata:
31+
labels:
32+
app.kubernetes.io/name: *app
33+
dependsOn:
34+
- name: outline-role-sync-secrets
35+
- name: outline
36+
path: ./kubernetes/apps/tools/outline-role-sync/app
37+
prune: true
38+
sourceRef:
39+
kind: GitRepository
40+
name: immich-kubernetes
41+
wait: true
42+
interval: 30m
43+
retryInterval: 1m
44+
timeout: 5m

‎kubernetes/apps/tools/outline-role-sync/secrets/kustomization.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1beta1
3+
kind: Kustomization
4+
resources:
5+
- ./secret.yaml

‎kubernetes/apps/tools/outline-role-sync/secrets/secret.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: external-secrets.io/v1
2+
kind: ExternalSecret
3+
metadata:
4+
name: outline-role-sync
5+
namespace: tools
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: 1p-tf
10+
refreshInterval: "20s"
11+
data:
12+
- secretKey: OUTLINE_API_TOKEN
13+
remoteRef:
14+
key: OUTLINE_ROLE_SYNC_OUTLINE_API_TOKEN
15+
- secretKey: OUTLINE_WEBHOOK_SECRET
16+
remoteRef:
17+
key: OUTLINE_ROLE_SYNC_WEBHOOK_SECRET
18+
- secretKey: ZITADEL_SERVICE_ACCOUNT_TOKEN
19+
remoteRef:
20+
key: OUTLINE_ROLE_SYNC_ZITADEL_TOKEN
21+
- secretKey: ZITADEL_OUTLINE_PROJECT_ID
22+
remoteRef:
23+
key: OUTLINE_ROLE_SYNC_ZITADEL_PROJECT_ID

‎release-please-config.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@
1919
"actions/create-workflow-token": {
2020
"component": "create-workflow-token-action"
2121
},
22+
"services/outline-role-sync": {
23+
"component": "outline-role-sync"
24+
},
2225
".github/workflows": {
2326
"component": "multi-runner-build-workflow",
2427
"exclude-paths": [

‎services/outline-role-sync/Dockerfile‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
FROM denoland/deno:2.1.4
2+
3+
WORKDIR /app
4+
5+
COPY deno.json .
6+
COPY src/ src/
7+
8+
RUN deno cache src/main.ts
9+
10+
USER deno
11+
12+
EXPOSE 8080
13+
14+
CMD ["deno", "run", "--allow-net", "--allow-env", "src/main.ts"]

0 commit comments

Comments
 (0)