Ansible role to install and configure AuthGateway.

AuthGateways requiers three things to work:

• An HTTPS proxy (nginx by default).
• An Auth Proxy (oauth2_proxy by default).
• NodeJS

AuthGateway supports non-default proxes through its flexible configuration (more details on this in the AuthGateway repo/docs).

To support such a felxible system this role will not attepmt to install most prerequisites but will check that they are installed by the user prior to executing the current role.

For examples see below.

These options allow to optionally download oauth2_proxy. By default oauth2_proxy is not installed and must be provided by the user.

As this is a common requirement that is simple to satisfy in a cross-distribution way (unlike nginx or nodejs) the role can take care of the installation.

These are the paths to the three dependencies of AuthGateway:

• AuthProxy (oauth2_proxy by default)
• HttpProxy (nginx by default)
• NPM and NodeJs (to install and run AuthGateway)

The following options are all REQUIRED:

This role comes without any explict dependency so it can be cross-platform and more flexible to the needs and opinions of users.

That said, AuthGateway has some requirements that must be fulfilled before this role is invoked:

• A compatible HTTP proxy must be installed.
• A compatible Auth proxy must be installed (the role can optionally install ouath2_proxy for you).
• NodeJS runtime (tested with node 8.4+).

It is possible to configure AuthGateway to run without ever being root. For this to work the following conditions must be met:

• The HTTP proxy is allowed to bind to privileged ports (see Linux capabilities).
• AcmeTool certificates are copied where accessible.
• SystemD service specifies the user.

To address these:

• stefano-pogliani.upstream-nginx support setting capabilities as needed.
• The AcmeTool hook script provided can copy the certs to the install directory if needed.
• The authgateway_user and authgateway_group variables configure the systemd service.

The example playbook below uses:

• My nginx from official repos (dedicated role) for the HTTP proxy.
• The builtin oauth2_proxy install tasks.
• A quick and dirty play (tests/nodejs.yml) to install NodeJS (NOT recommended).

# Configure required dependencies.
- hosts: servers
  roles:
    - role: stefano-pogliani.upstream-nginx
      upstream_nginx_service_enabled: False
      upstream_nginx_service_state: 'stopped'
    #- role: some.nodejs.role
    #  some_nodejs_option: ...
  tasks:
    - import_tasks: 'tests/nodejs.yml'

# Install and configure AuthGateway itself.
- hosts: servers
  roles:
    - role: stefano-pogliani.authgateway
      authgateway_configure_oauth2_proxy: true
      authgateway_conf_domain: 'gate.example.com'
      authgateway_conf_client_id: 'some id'
      authgateway_conf_client_secret: 'some secret'
      authgateway_conf_provider: 'github'
      authgateway_conf_session_secret: 'some secret generated by user'
      authgateway_extra_emails:
        - '[email protected]'
        - '[email protected]'
      authgateway_conf_apps:
        - name: Google
          url: 'https://www.google.co.uk/'
        - name: Test
          upstream:
            host: 'localhost:1234'
            protocol: 'http'

MIT

This role uses test-kitchen and kitchen-ansible.

bundle install --path=.vendor --binstubs
./bin/kitchen test