Oskar Kapala
f7e1391f30
Wraps the existing manually-run Vikunja instance on PIHA in the standard service layout. No deploy — definition only, for review. - services/vikunja/: docker-compose.yml (vikunja + postgres:16-alpine), service.yaml, README, healthcheck, config.yml (OIDC, secret-free), .env.example. Real .env stays gitignored. - Pins EXISTING named volumes (vikunja_vikunja_db, vikunja_vikunja_files) so DB + uploaded files survive cutover. - extra_hosts forgejo.okit.pl=192.168.31.5 (npm on PIHA) so OIDC discovery resolves over LAN instead of flaky public DNS. - OIDC client secret injected via env (VIKUNJA_AUTH_OPENID_PROVIDERS_ FORGEJO_CLIENTSECRET); config.yml keeps trailing-slash authurl/redirecturl. - Registers vikunja in hosts/piha/services.yaml + inventory/topology.yaml, plus hosts/piha/runtime/vikunja override (advisory mem_limits). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
24 lines
934 B
YAML
24 lines
934 B
YAML
# Vikunja runtime config — committed to git (secret-free).
|
|
#
|
|
# Database, public URL, JWT secret and the OIDC client SECRET are supplied via
|
|
# environment variables (see docker-compose.yml + .env). Only non-secret OIDC
|
|
# provider metadata lives here.
|
|
#
|
|
# Env vars override matching keys, so anything secret stays out of this file.
|
|
|
|
auth:
|
|
openid:
|
|
enabled: true
|
|
# MUST end with a trailing slash — matches Vikunja's redirect handling.
|
|
redirecturl: "https://vikunja.okit.pl/auth/openid/"
|
|
providers:
|
|
forgejo:
|
|
name: "Forgejo"
|
|
# authurl MUST have a trailing slash — it must match the OIDC issuer
|
|
# exactly or discovery fails.
|
|
authurl: "https://forgejo.okit.pl/"
|
|
clientid: "15ad6f99-b8ca-48dc-92b9-97907ddc4367"
|
|
# clientsecret is injected via
|
|
# VIKUNJA_AUTH_OPENID_PROVIDERS_FORGEJO_CLIENTSECRET (.env) — never here.
|
|
scope: "openid profile email"
|