2026-AUG-21.1

2026-08-21 14:54:09 +09:00
parent fe2357ddb2
commit ada7e751d8
8 changed files with 233 additions and 4 deletions
@@ -1,12 +1,17 @@
+{% set icon_map = {
+  'tandoor': 'tandoor-recipes',
+  'ldap': 'lldap'
+} %}
+
 - Services:
 {% for item in (homepage_public_services | reject('in', ['homepage', 'collabora'])) %}
    - {{ item }}:
-        icon: {{ item }}.svg
+        icon: {{ icon_map.get(item, item) }}.svg
        href: https://{{ services[item]['domain']['public'] }}.{{ domain['public'] }}
 {% endfor %}
 - Admin:
 {% for item in homepage_internal_services %}
    - {{ item }}:
-        icon: {{ 'lldap' if item == 'ldap' else item }}.svg
+        icon: {{ icon_map.get(item, item) }}.svg
        href: https://{{ services[item]['domain']['internal'] }}.{{ domain['internal'] }}
 {% endfor %}
@@ -0,0 +1,58 @@
+[Quadlet]
+DefaultDependencies=false
+
+[Unit]
+Description=Tandoor Recipes
+
+[Container]
+Image=docker.io/vabene1111/recipes:{{ version['containers']['tandoor'] }}
+
+ContainerName=tandoor
+HostName=tandoor
+
+PublishPort={{ services['tandoor']['ports']['http'] }}:80/tcp
+
+# Volumes
+Volume=%h/data/containers/tandoor/mediafiles:/opt/recipes/mediafiles:rw
+Volume=%h/containers/tandoor/ssl:/etc/ssl/tandoor:ro
+
+# General
+Environment="TZ={{ timezone }}"
+Environment="ALLOWED_HOSTS={{ services['tandoor']['domain']['public'] }}.{{ domain['public'] }}"
+Environment="CSRF_TRUSTED_ORIGINS=https://{{ services['tandoor']['domain']['public'] }}.{{ domain['public'] }}"
+# auth Caddy -> app Caddy -> Tandoor built-in nginx
+Environment="ALLAUTH_TRUSTED_PROXY_COUNT=3"
+
+# Secrets
+Secret=TANDOOR_SECRET_KEY,type=env,target=SECRET_KEY
+
+# Database (PostgreSQL)
+Environment="DB_ENGINE=django.db.backends.postgresql"
+Environment="POSTGRES_HOST={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}"
+Environment="POSTGRES_PORT={{ services['postgresql']['ports']['tcp'] }}"
+Environment="POSTGRES_USER=tandoor"
+Environment="POSTGRES_DB=tandoor_db"
+Environment="PGSSLMODE=verify-full"
+Environment="PGSSLROOTCERT=/etc/ssl/tandoor/{{ root_cert_filename }}"
+Secret=TANDOOR_POSTGRES_PASSWORD,type=env,target=POSTGRES_PASSWORD
+
+# Login
+Environment="HIDE_LOGIN_FORM=1"
+Environment="ENABLE_SIGNUP=0"
+
+# OIDC
+Environment="SOCIAL_PROVIDERS=allauth.socialaccount.providers.openid_connect"
+Environment="SOCIALACCOUNT_AUTO_SIGNUP=1"
+Environment="SOCIALACCOUNT_LOGIN_ON_GET=1"
+Environment="SOCIAL_DEFAULT_ACCESS=1"
+Environment="SOCIAL_DEFAULT_GROUP=user"
+Secret=TANDOOR_SOCIALACCOUNT_PROVIDERS,type=env,target=SOCIALACCOUNT_PROVIDERS
+
+[Service]
+ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
+Restart=always
+RestartSec=10s
+TimeoutStopSec=120
+
+[Install]
+WantedBy=default.target
@@ -407,3 +407,25 @@ identity_providers:
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'
+      # https://www.authelia.com/integration/openid-connect/clients/tandoor/
+      - client_id: 'tandoor'
+        client_name: 'tandoor'
+        consent_mode: 'implicit'
+        client_secret: '$pbkdf2-sha512$310000$IOvwfqSgUvMZ5nxZ.dEDTw$FX3x1XaH3.S9gNFHiv0DdcCSCEomFMdoxd.yA3PEmVksRyd7D8LuSdooN.DA3B.jyVDVLFSJ9isIChEbJSmEvw'
+        public: false
+        authorization_policy: 'one_factor'
+        require_pkce: false
+        pkce_challenge_method: ''
+        redirect_uris:
+          - 'https://{{ services['tandoor']['domain']['public'] }}.{{ domain['public'] }}/accounts/oidc/authelia/login/callback/'
+        scopes:
+          - 'openid'
+          - 'profile'
+          - 'email'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_basic'