keycloak.tf

terraform {
  backend "pg" {
    schema_name = "terraform_remote_state_stage2"
  }
}

data "external" "vault_keycloak" {
  program = ["${path.module}/../misc/get_key.py", "${path.module}/../group_vars/all/vault_keycloak.yml",
    "vault_keycloak_admin_user",
    "vault_keycloak_admin_password",
    "vault_keycloak_smtp_user",
    "vault_keycloak_smtp_password",
    "vault_keycloak_gluebuddy_openid_client_secret",
  "--format", "json"]
}

data "external" "vault_hcaptcha" {
  program = ["${path.module}/../misc/get_key.py", "${path.module}/../misc/vaults/vault_hcaptcha.yml",
    "vault_hcaptcha_accounts_archlinux_org_sitekey",
    "vault_hcaptcha_secret_key",
  "--format", "json"]
}

data "external" "vault_github" {
  program = ["${path.module}/../misc/get_key.py", "${path.module}/../group_vars/all/vault_github.yml",
    "vault_github_oauth_app_client_id",
    "vault_github_oauth_app_client_secret",
  "--format", "json"]
}

data "external" "vault_monitoring" {
  program = ["${path.module}/../misc/get_key.py", "${path.module}/../group_vars/all/vault_monitoring.yml",
    "vault_monitoring_grafana_client_secret",
  "--format", "json"]
}

data "external" "vault_hedgedoc" {
  program = ["${path.module}/../misc/get_key.py", "${path.module}/../group_vars/all/vault_hedgedoc.yml",
    "vault_hedgedoc_client_secret",
  "--format", "json"]
}

data "external" "vault_matrix" {
  program = ["${path.module}/../misc/get_key.py", "${path.module}/../group_vars/all/vault_matrix.yml",
    "vault_matrix_openid_client_secret",
  "--format", "json"]
}

data "external" "vault_security_tracker" {
  program = ["${path.module}/../misc/get_key.py", "${path.module}/../group_vars/all/vault_security_tracker.yml",
    "vault_security_tracker_openid_client_secret",
  "--format", "json"]
}

provider "keycloak" {
  client_id = "admin-cli"
  username  = data.external.vault_keycloak.result.vault_keycloak_admin_user
  password  = data.external.vault_keycloak.result.vault_keycloak_admin_password
  url       = "https://accounts.archlinux.org"
}

variable "gitlab_instance" {
  default = {
    root_url          = "https://gitlab.archlinux.org"
    saml_redirect_url = "https://gitlab.archlinux.org/users/auth/saml/callback"
  }
}

resource "keycloak_realm" "archlinux" {
  realm             = "archlinux"
  enabled           = true
  remember_me       = true
  display_name      = "Arch Linux"
  display_name_html = "<div class=\"kc-logo-text\"><span>Arch Linux</span></div>"

  registration_allowed     = false
  reset_password_allowed   = true
  verify_email             = true
  login_with_email_allowed = true
  password_policy          = "length(8) and notUsername"

  web_authn_policy {
    relying_party_entity_name = "Arch Linux SSO"
    relying_party_id          = "accounts.archlinux.org"
    signature_algorithms      = ["ES256", "RS256", "ES512", "RS512"]
  }

  login_theme   = "archlinux"
  account_theme = "archlinux"
  admin_theme   = "archlinux"
  email_theme   = "archlinux"

  browser_flow           = "Arch Browser"
  registration_flow      = "Arch Registration"
  reset_credentials_flow = "Arch Reset Credentials"

  smtp_server {
    host              = "mail.archlinux.org"
    from              = "accounts@archlinux.org"
    port              = "465"
    from_display_name = "Arch Linux Accounts"
    ssl               = true
    starttls          = false

    auth {
      username = data.external.vault_keycloak.result.vault_keycloak_smtp_user
      password = data.external.vault_keycloak.result.vault_keycloak_smtp_password
    }
  }

  security_defenses {
    headers {
      x_frame_options                     = "ALLOW-FROM https://www.google.com https://newassets.hcaptcha.com"
      content_security_policy             = "frame-src 'self' https://www.google.com https://newassets.hcaptcha.com; frame-ancestors 'self'; object-src 'none';"
      content_security_policy_report_only = ""
      x_content_type_options              = "nosniff"
      x_robots_tag                        = "none"
      x_xss_protection                    = "1; mode=block"
      strict_transport_security           = "max-age=31536000; includeSubDomains"
    }
    brute_force_detection {
      permanent_lockout                = false
      max_login_failures               = 30
      wait_increment_seconds           = 60
      quick_login_check_milli_seconds  = 1000
      minimum_quick_login_wait_seconds = 60
      max_failure_wait_seconds         = 900
      failure_reset_time_seconds       = 43200
    }
  }

  attributes = {
    userProfileEnabled = true
  }
}

resource "keycloak_realm_user_profile" "archlinux" {
  realm_id = keycloak_realm.archlinux.id

  attribute {
    name         = "username"
    display_name = "$${username}"

    permissions {
      view = ["admin", "user"]
      edit = ["admin", "user"]
    }

    validator {
      name = "length"
      config = {
        min = 3
        max = 255
      }
    }

    validator {
      name = "username-prohibited-characters"
    }

    validator {
      name = "up-username-not-idn-homograph"
    }
  }

  attribute {
    name         = "email"
    display_name = "$${email}"

    required_for_roles = ["user"]

    permissions {
      view = ["admin", "user"]
      edit = ["admin", "user"]
    }

    validator {
      name = "email"
    }

    validator {
      name = "length"
      config = {
        max = 255
      }
    }
  }

  attribute {
    name         = "firstName"
    display_name = "$${firstName}"

    required_for_roles = ["user"]

    permissions {
      view = ["admin", "user"]
      edit = ["admin", "user"]
    }

    validator {