From 597e62774005fa194c00fb0de5432dcbacdc13a1 Mon Sep 17 00:00:00 2001
From: Khue Doan <mail@khuedoan.com>
Date: Wed, 23 Jul 2025 00:23:35 +0700
Subject: [PATCH] feat(forgejo): setup SSO

---
 .../oracle/secrets/.terraform.lock.hcl          |  3 +++
 infra/production/oracle/secrets/terragrunt.hcl  | 17 +++++++++++++++++
 platform/production/dex.yaml                    |  5 +++++
 platform/production/forgejo.yaml                | 11 +++++++++++
 4 files changed, 36 insertions(+)

diff --git a/infra/production/oracle/secrets/.terraform.lock.hcl b/infra/production/oracle/secrets/.terraform.lock.hcl
index 899045c..8ad0316 100644
--- a/infra/production/oracle/secrets/.terraform.lock.hcl
+++ b/infra/production/oracle/secrets/.terraform.lock.hcl
@@ -6,6 +6,7 @@ provider "registry.opentofu.org/hashicorp/kubernetes" {
   constraints = "~> 2.37.1"
   hashes = [
     "h1:UWJPvQZxW9Q6mxtUvIdnapPE8s8o4a2HUo53OInq9p4=",
+    "h1:uQ6QiHEMu5dm39sbMNE3ANFUeqTjrqb2P/lxHtfkctE=",
     "zh:22031e9995b3dc7ae497305dc6c5b7bf1a585c378d46446e724601f992cd9e11",
     "zh:3614bc188ae5040d892671009c66f56cfcb3859e11f42ed7ffc1cee384b1275b",
     "zh:5d925944ac961bbe5fb4917a3e7e6d9bc0bef2f3198f26e8d4cd1793d5eadde3",
@@ -21,6 +22,7 @@ provider "registry.opentofu.org/hashicorp/kubernetes" {
 provider "registry.opentofu.org/hashicorp/oci" {
   version = "7.10.0"
   hashes = [
+    "h1:XMhePV+ntXrfaI0Yq7mTCgziQ2YJzvt4x1SzcjDh754=",
     "h1:fte2iarPJxuqm8S5AJTgY/eEQnH6LS/qVRxmDkBie4s=",
     "zh:03ad7ab20c4aa4a496cedb29cc439cb6e6c6eadcce964a44c227d605a30aec0f",
     "zh:08184bf3df20ab6f2bc764f28cefc356090d34bdf02c41ab91939d91f7462c3c",
@@ -44,6 +46,7 @@ provider "registry.opentofu.org/hashicorp/random" {
   version = "3.7.2"
   hashes = [
     "h1:cFGCdxTlsrteTiaOV/iOQdql7eJkD3F/vtJxenkj9IE=",
+    "h1:yHMBbZOIHlXUuBQ8Mhioe0hwmhermuboq2eNNoCJaf8=",
     "zh:2ffeb1058bd7b21a9e15a5301abb863053a2d42dffa3f6cf654a1667e10f4727",
     "zh:519319ed8f4312ed76519652ad6cd9f98bc75cf4ec7990a5684c072cf5dd0a5d",
     "zh:7371c2cc28c94deb9dba62fbac2685f7dde47f93019273a758dd5a2794f72919",
diff --git a/infra/production/oracle/secrets/terragrunt.hcl b/infra/production/oracle/secrets/terragrunt.hcl
index 872a55a..f500272 100644
--- a/infra/production/oracle/secrets/terragrunt.hcl
+++ b/infra/production/oracle/secrets/terragrunt.hcl
@@ -25,6 +25,10 @@ inputs = {
     dex_grafana_client_secret  = { random = true }
     dex_kiali_client_secret    = { random = true }
     dex_temporal_client_secret = { random = true }
+    dex_forgejo_client_key     = { value = "forgejo" }
+    dex_forgejo_client_secret  = { random = true }
+    forgejo_admin_username     = { value = "forgejo_admin" }
+    forgejo_admin_password     = { random = true }
     silverbullet_user          = { value = include.root.locals.secrets.silverbullet_user }
     wireguard_config           = { value = include.root.locals.secrets.wireguard_config }
   }
@@ -36,6 +40,7 @@ inputs = {
         "GRAFANA_CLIENT_SECRET"  = "dex_grafana_client_secret"
         "KIALI_CLIENT_SECRET"    = "dex_kiali_client_secret"
         "TEMPORAL_CLIENT_SECRET" = "dex_temporal_client_secret"
+        "FORGEJO_CLIENT_SECRET"  = "dex_forgejo_client_secret"
         "ADMIN_PASSWORD_HASH"    = "dex_admin_password_hash"
       }
     }
@@ -69,5 +74,17 @@ inputs = {
         "wg0.conf" = "wireguard_config"
       }
     }
+    "forgejo/forgejo-admin" = {
+      data = {
+        "username" = "forgejo_admin_username"
+        "password" = "forgejo_admin_password"
+      }
+    }
+    "forgejo/forgejo-oauth" = {
+      data = {
+        "key"    = "dex_forgejo_client_key"
+        "secret" = "dex_forgejo_client_secret"
+      }
+    }
   }
 }
diff --git a/platform/production/dex.yaml b/platform/production/dex.yaml
index a297100..4d20b20 100644
--- a/platform/production/dex.yaml
+++ b/platform/production/dex.yaml
@@ -59,6 +59,11 @@ spec:
               redirectURIs:
                 - 'https://temporal.cloudlab.khuedoan.com/auth/sso/callback'
               secretEnv: TEMPORAL_CLIENT_SECRET
+            - id: forgejo
+              name: Forgejo
+              redirectURIs:
+                - 'https://code.khuedoan.com/user/oauth2/SSO/callback'
+              secretEnv: FORGEJO_CLIENT_SECRET
         envFrom:
           - secretRef:
               name: dex-secrets
diff --git a/platform/production/forgejo.yaml b/platform/production/forgejo.yaml
index 2381e7f..ccb5d2f 100644
--- a/platform/production/forgejo.yaml
+++ b/platform/production/forgejo.yaml
@@ -47,6 +47,9 @@ spec:
               ENABLE_AUTO_REGISTRATION: true
               OPENID_CONNECT_SCOPES: "email profile"
               USERNAME: username
+            service:
+              ENABLE_INTERNAL_SIGNIN: false
+              ALLOW_ONLY_EXTERNAL_REGISTRATION: true
             "service.explore":
               DISABLE_USERS_PAGE: true
             actions:
@@ -57,6 +60,14 @@ spec:
               SHOW_FOOTER_VERSION: false
               SHOW_FOOTER_TEMPLATE_LOAD_TIME: false
               SHOW_FOOTER_POWERED_BY: false
+          oauth:
+            - name: SSO
+              provider: 'openidConnect'
+              autoDiscoverUrl: https://dex.cloudlab.khuedoan.com/.well-known/openid-configuration
+              existingSecret: forgejo-oauth
+          admin:
+            email: admin@cloudlab.khuedoan.com
+            existingSecret: forgejo-admin
           podAnnotations:
             "istio.io/dataplane-mode": "ambient"
         ingress:
-- 
2.51.2