7e22d4f55f
Change-Id: I3b881fec1ee0d67cbfac636e99460b3491e2c653 Reviewed-on: https://cl.snix.dev/c/snix/+/30252 Tested-by: besadii Autosubmit: Florian Klink <flokli@flokli.de> Reviewed-by: Ilan Joselevich <personal@ilanjoselevich.com>
95 lines
2.1 KiB
HCL
95 lines
2.1 KiB
HCL
# This sets the permissions for various groups and users.
|
|
|
|
# TODO: Realm-level composite roles
|
|
# resource "keycloak_role" "is_local_admin" {
|
|
# composite_roles = [
|
|
# keycloak_role.blablabla.id
|
|
# ]
|
|
# }
|
|
#
|
|
# resource "keycloak_role" "can_manage_trusted_contributors" {
|
|
# }
|
|
#
|
|
# # WARNING: This give PII access to the user.
|
|
# resource "keycloak_role" "can_manage_snix" {
|
|
# }
|
|
|
|
# Realm-level groups to bestow to users.
|
|
resource "keycloak_group" "snix_core_team" {
|
|
realm_id = keycloak_realm.snix.id
|
|
name = "snix core team"
|
|
}
|
|
|
|
resource "keycloak_group_roles" "snix_core_team_roles" {
|
|
realm_id = keycloak_realm.snix.id
|
|
group_id = keycloak_group.snix_core_team.id
|
|
|
|
role_ids = [
|
|
# keycloak_role.is_local_admin,
|
|
# keycloak_role.can_manage_snix,
|
|
keycloak_role.grafana_admin.id,
|
|
# keycloak_role.forgejo_admin.id,
|
|
# keycloak_role.gerrit_admin.id
|
|
]
|
|
}
|
|
|
|
resource "keycloak_group_memberships" "snix_core_team_members" {
|
|
realm_id = keycloak_realm.snix.id
|
|
group_id = keycloak_group.snix_core_team.id
|
|
|
|
members = [
|
|
"edef",
|
|
"flokli",
|
|
"raitobezarius"
|
|
]
|
|
}
|
|
|
|
resource "keycloak_group" "trusted_contributors" {
|
|
name = "trusted contributors"
|
|
realm_id = keycloak_realm.snix.id
|
|
|
|
}
|
|
|
|
resource "keycloak_group_roles" "trusted_contributors_roles" {
|
|
realm_id = keycloak_realm.snix.id
|
|
group_id = keycloak_group.trusted_contributors.id
|
|
|
|
role_ids = [
|
|
keycloak_role.grafana_editor.id
|
|
]
|
|
}
|
|
|
|
# Application-level roles.
|
|
|
|
# Grafana
|
|
|
|
resource "keycloak_role" "grafana_editor" {
|
|
realm_id = keycloak_realm.snix.id
|
|
client_id = keycloak_openid_client.grafana.id
|
|
name = "Editor"
|
|
description = "Can edit things in Grafana"
|
|
}
|
|
|
|
resource "keycloak_role" "grafana_admin" {
|
|
realm_id = keycloak_realm.snix.id
|
|
client_id = keycloak_openid_client.grafana.id
|
|
name = "Admin"
|
|
description = "Can admin things in Grafana"
|
|
}
|
|
|
|
# TODO:
|
|
# Forgejo
|
|
|
|
# resource "keycloak_role" "forgejo_admin" {
|
|
# }
|
|
#
|
|
# resource "keycloak_role" "forgejo_trusted_contributor" {
|
|
# }
|
|
#
|
|
# # Gerrit
|
|
#
|
|
# resource "keycloak_role" "gerrit_admin" {
|
|
# }
|
|
#
|
|
# resource "keycloak_role" "gerrit_trusted_contributor" {
|
|
# }
|