many fixes

Author: terion-labs

ansible/roles/idp_zitadel/defaults/main.yml

@@ -2,13 +2,10 @@ terrarium_zitadel_enabled: "{{ terrarium_idp_mode == 'local' }}"
 terrarium_zitadel_dir: "{{ terrarium_state_dir }}/zitadel"
 terrarium_zitadel_postgres_dir: "{{ terrarium_zitadel_dir }}/postgres"
 terrarium_zitadel_bootstrap_dir: "{{ terrarium_zitadel_dir }}/bootstrap"
-terrarium_zitadel_tf_dir: "{{ terrarium_zitadel_dir }}/terraform"
 terrarium_zitadel_outputs_path: /etc/terrarium/zitadel-apps.json
 terrarium_zitadel_api_port: 8082
 terrarium_zitadel_login_port: 8083
 terrarium_zitadel_version: v4.13.0
 terrarium_zitadel_postgres_image: postgres:17.2-alpine
-terrarium_zitadel_tofu_image: ghcr.io/opentofu/opentofu:1.10.6
-terrarium_zitadel_provider_version: 2.12.3
 terrarium_zitadel_pat_expiration: "2099-01-01T00:00:00Z"
 terrarium_zitadel_project_name: Terrarium

ansible/roles/idp_zitadel/tasks/main.yml

@@ -35,7 +35,6 @@
         - "{{ terrarium_zitadel_dir }}"
         - "{{ terrarium_zitadel_postgres_dir }}"
         - "{{ terrarium_zitadel_bootstrap_dir }}"
-        - "{{ terrarium_zitadel_tf_dir }}"
 
     - name: Generate ZITADEL master key
       ansible.builtin.shell: "umask 077 && tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32 > /etc/terrarium/secrets/zitadel_masterkey"
@@ -81,19 +80,6 @@
         terrarium_zitadel_admin_password: "{{ terrarium_zitadel_admin_password_raw.stdout }}"
       notify: restart terrarium zitadel
 
-    - name: Render ZITADEL Terraform config
-      ansible.builtin.template:
-        src: terraform-main.tf.j2
-        dest: "{{ terrarium_zitadel_tf_dir }}/main.tf"
-        mode: "0600"
-      notify: restart terrarium zitadel
-
-    - name: Render ZITADEL Terraform outputs
-      ansible.builtin.template:
-        src: terraform-outputs.tf.j2
-        dest: "{{ terrarium_zitadel_tf_dir }}/outputs.tf"
-        mode: "0600"
-
     - name: Render ZITADEL systemd unit
       ansible.builtin.template:
         src: terrarium-zitadel.service.j2

ansible/roles/idp_zitadel/templates/terraform-main.tf.j2

@@ -170,18 +170,12 @@
     interface_in: lxdbr0
     interface_out: "{{ ansible_default_ipv4.interface }}"
 
-- name: Configure ACME email when custom domain is used
-  ansible.builtin.command: "/snap/bin/lxc config set acme.email {{ terrarium_acme_email }}"
-  when:
-    - terrarium_acme_email | length > 0
-    - not terrarium_lxd_domain.endswith('.traefik.me')
-  changed_when: false
-
-- name: Configure ACME domain when custom domain is used
-  ansible.builtin.command: "/snap/bin/lxc config set acme.domain {{ terrarium_lxd_domain }}"
-  when:
-    - terrarium_acme_email | length > 0
-    - not terrarium_lxd_domain.endswith('.traefik.me')
+- name: Disable LXD ACME certificate management
+  ansible.builtin.command: "/snap/bin/lxc config unset {{ item }}"
+  loop:
+    - acme.email
+    - acme.domain
+  failed_when: false
   changed_when: false
 
 - name: Configure OIDC issuer when provided

ansible/roles/idp_zitadel/templates/terraform-outputs.tf.j2

@@ -6,12 +6,12 @@ services:
     restart: unless-stopped
 {% if terrarium_idp_mode == 'local' %}
     environment:
-      SSL_CERT_FILE: /etc/ssl/certs/terrarium-bootstrap.crt
+      SSL_CERT_FILE: /etc/ssl/certs/terrarium-ca-certificates.crt
 {% endif %}
     command:
       - --config=/etc/oauth2-proxy/oauth2-proxy.cfg
     volumes:
       - "{{ terrarium_oauth2_proxy_dir }}/oauth2-proxy.cfg:/etc/oauth2-proxy/oauth2-proxy.cfg:ro"
 {% if terrarium_idp_mode == 'local' %}
-      - "{{ terrarium_traefik_config_dir }}/bootstrap-certs/terrarium-bootstrap.crt:/etc/ssl/certs/terrarium-bootstrap.crt:ro"
+      - "/etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/terrarium-ca-certificates.crt:ro"
 {% endif %}

ansible/roles/lxd/tasks/main.yml

@@ -1,6 +1,6 @@
 provider = "oidc"
 provider_display_name = "Terrarium"
-http_address = "0.0.0.0:{{ terrarium_oauth2_proxy_port }}"
+http_address = "127.0.0.1:{{ terrarium_oauth2_proxy_port }}"
 redirect_url = "https://{{ terrarium_manage_domain }}/oauth2/callback"
 oidc_issuer_url = "{{ terrarium_oauth2_proxy_oidc_issuer }}"
 oidc_groups_claim = "groups"

ansible/roles/oauth2_proxy/templates/docker-compose.yml.j2

@@ -45,51 +45,15 @@
     - "{{ terrarium_traefik_config_dir }}/bootstrap-certs"
     - /var/lib/traefik
 
-- name: Derive bootstrap certificate root domain
+- name: Determine whether bootstrap TLS is required
   ansible.builtin.set_fact:
-    terrarium_bootstrap_tls_root_domain: >-
-      {{
-        terrarium_root_domain
-        if (terrarium_root_domain | default('') | length > 0)
-        else (
-          terrarium_manage_domain.split('.', 1)[1]
-          if ('.' in terrarium_manage_domain)
-          else ''
-        )
-      }}
+    terrarium_bootstrap_tls_enabled: "{{ terrarium_idp_mode == 'local' and (terrarium_auth_domain | default('') | length > 0) }}"
 
 - name: Build bootstrap certificate SAN list
   ansible.builtin.set_fact:
     terrarium_bootstrap_tls_domains: >-
       {{
-        (
-          [
-            terrarium_manage_domain,
-            terrarium_proxy_domain
-          ]
-          + (
-            [terrarium_auth_domain]
-            if (
-              (terrarium_auth_domain | default('') | length > 0)
-              and not (
-                (terrarium_bootstrap_tls_root_domain | default('') | length > 0)
-                and (
-                  terrarium_auth_domain == terrarium_bootstrap_tls_root_domain
-                  or terrarium_auth_domain.endswith('.' ~ terrarium_bootstrap_tls_root_domain)
-                )
-              )
-            )
-            else []
-          )
-          + (
-            ['*.' ~ terrarium_bootstrap_tls_root_domain, terrarium_bootstrap_tls_root_domain]
-            if (terrarium_bootstrap_tls_root_domain | default('') | length > 0)
-            else []
-          )
-        )
-        | reject('equalto', '')
-        | unique
-        | list
+        [terrarium_auth_domain] if terrarium_bootstrap_tls_enabled else []
       }}
 
 - name: Render Traefik bootstrap certificate OpenSSL config
@@ -98,11 +62,13 @@
     dest: "{{ terrarium_traefik_config_dir }}/bootstrap-certs/openssl.cnf"
     mode: "0644"
   register: terrarium_bootstrap_tls_openssl_config
+  when: terrarium_bootstrap_tls_enabled
 
 - name: Check whether Traefik bootstrap certificate exists
   ansible.builtin.stat:
     path: "{{ terrarium_traefik_config_dir }}/bootstrap-certs/terrarium-bootstrap.crt"
   register: terrarium_bootstrap_tls_cert_stat
+  when: terrarium_bootstrap_tls_enabled
 
 - name: Generate Traefik bootstrap certificate
   ansible.builtin.command:
@@ -122,6 +88,7 @@
       - -config
       - "{{ terrarium_traefik_config_dir }}/bootstrap-certs/openssl.cnf"
   when:
+    - terrarium_bootstrap_tls_enabled
     - terrarium_bootstrap_tls_openssl_config.changed or not terrarium_bootstrap_tls_cert_stat.stat.exists
   notify: restart traefik
 
@@ -131,6 +98,14 @@
     dest: "{{ terrarium_traefik_config_dir }}/dynamic/bootstrap-cert.yml"
     mode: "0644"
   notify: restart traefik
+  when: terrarium_bootstrap_tls_enabled
+
+- name: Remove Traefik bootstrap certificate config when bootstrap TLS is not required
+  ansible.builtin.file:
+    path: "{{ terrarium_traefik_config_dir }}/dynamic/bootstrap-cert.yml"
+    state: absent
+  notify: restart traefik
+  when: not terrarium_bootstrap_tls_enabled
 
 - name: Install Traefik bootstrap certificate into system trust store
   ansible.builtin.copy:
@@ -139,15 +114,20 @@
     mode: "0644"
     remote_src: true
   register: terrarium_bootstrap_tls_system_ca
+  when: terrarium_bootstrap_tls_enabled
 
 - name: Refresh system CA certificates for bootstrap trust
   ansible.builtin.command: update-ca-certificates
-  when: terrarium_bootstrap_tls_system_ca.changed
+  when:
+    - terrarium_bootstrap_tls_enabled
+    - terrarium_bootstrap_tls_system_ca.changed
   changed_when: terrarium_bootstrap_tls_system_ca.changed
 
 - name: Restart LXD after bootstrap trust changes
   ansible.builtin.command: systemctl try-restart snap.lxd.daemon.service
-  when: terrarium_bootstrap_tls_system_ca.changed
+  when:
+    - terrarium_bootstrap_tls_enabled
+    - terrarium_bootstrap_tls_system_ca.changed
   changed_when: false
   failed_when: false
 

ansible/roles/oauth2_proxy/templates/oauth2-proxy.cfg.j2

@@ -1,6 +1,4 @@
 tls:
-  stores:
-    default:
-      defaultCertificate:
-        certFile: {{ terrarium_traefik_config_dir }}/bootstrap-certs/terrarium-bootstrap.crt
-        keyFile: {{ terrarium_traefik_config_dir }}/bootstrap-certs/terrarium-bootstrap.key
+  certificates:
+    - certFile: {{ terrarium_traefik_config_dir }}/bootstrap-certs/terrarium-bootstrap.crt
+      keyFile: {{ terrarium_traefik_config_dir }}/bootstrap-certs/terrarium-bootstrap.key

ansible/roles/traefik/tasks/main.yml

@@ -67,6 +67,13 @@ http:
       service: api@internal
       tls:
         certResolver: letsencrypt
+    lxd:
+      entryPoints:
+        - websecure
+      rule: Host(`{{ terrarium_lxd_domain }}`)
+      service: lxd
+      tls:
+        certResolver: letsencrypt
 {% if terrarium_idp_mode == 'local' %}
     zitadel-root-bootstrap:
       entryPoints:
@@ -142,6 +149,12 @@ http:
       loadBalancer:
         servers:
           - url: http://127.0.0.1:9090
+    lxd:
+      loadBalancer:
+        serversTransport: lxd-loopback
+        passHostHeader: true
+        servers:
+          - url: https://127.0.0.1:8443
 {% if terrarium_idp_mode == 'local' %}
     zitadel-login:
       loadBalancer:
@@ -152,18 +165,6 @@ http:
         servers:
           - url: h2c://127.0.0.1:8082
 {% endif %}
-
-tcp:
-  routers:
-    lxd:
-      entryPoints:
-        - websecure
-      rule: HostSNI(`{{ terrarium_lxd_domain }}`)
-      service: lxd
-      tls:
-        passthrough: true
-  services:
-    lxd:
-      loadBalancer:
-        servers:
-          - address: 127.0.0.1:8443
+  serversTransports:
+    lxd-loopback:
+      insecureSkipVerify: true