From f69771506584ac904e7fc0e8b8dd4c4ac5b85ae4 Mon Sep 17 00:00:00 2001 From: il Date: Wed, 6 May 2026 17:34:13 +0900 Subject: [PATCH] feat(sure): release sure (we-promise/sure) deployment notes: - let's try three of budget apps, actual budget, ezbookkeeping, and sure --- ansible/inventory/group_vars/all.yaml | 13 ++- ansible/playbooks/app/site.yaml | 8 ++ ansible/roles/app/handlers/main.yaml | 14 +++ .../roles/app/tasks/services/set_sure.yaml | 110 ++++++++++++++++++ .../infra/tasks/services/set_postgresql.yaml | 1 + config/secrets/secrets.yaml | 14 ++- .../containers/app/sure/sure-web.container.j2 | 67 +++++++++++ .../app/sure/sure-worker.container.j2 | 67 +++++++++++ .../auth/authelia/config/authelia.yaml.j2 | 22 ++++ .../common/caddy/etc/app/Caddyfile.j2 | 6 + .../common/caddy/etc/auth/Caddyfile.j2 | 9 ++ docs/services/app/sure.md | 67 +++++++++++ docs/specifications/environments.md | 9 +- 13 files changed, 401 insertions(+), 6 deletions(-) create mode 100644 ansible/roles/app/tasks/services/set_sure.yaml create mode 100644 config/services/containers/app/sure/sure-web.container.j2 create mode 100644 config/services/containers/app/sure/sure-worker.container.j2 create mode 100644 docs/services/app/sure.md diff --git a/ansible/inventory/group_vars/all.yaml b/ansible/inventory/group_vars/all.yaml index cf79b51..957c990 100644 --- a/ansible/inventory/group_vars/all.yaml +++ b/ansible/inventory/group_vars/all.yaml @@ -66,7 +66,7 @@ services: grafana: domain: "grafana" ports: - http: "3000" + http: "3000" # Infra server: Internal ports subuid: "100471" caddy: ports: @@ -97,7 +97,7 @@ services: public: "gitea" internal: "gitea.app" ports: - http: "3000" + http: "3000" # App server: Public ports subuid: "100999" immich: domain: @@ -170,6 +170,14 @@ services: ports: http: "8003" subuid: "100999" + sure: + domain: + public: "sure" + internal: "sure.app" + ports: + http: "3001" + redis: "6383" + subuid: "100999" version: packages: @@ -209,3 +217,4 @@ version: nextcloud: "33.0.3" collabora: "25.04.9.4.1" ezbookkeeping: "1.4.0" + sure: "0.7.0-hotfix.2" diff --git a/ansible/playbooks/app/site.yaml b/ansible/playbooks/app/site.yaml index a0251bb..7155a2a 100644 --- a/ansible/playbooks/app/site.yaml +++ b/ansible/playbooks/app/site.yaml @@ -249,6 +249,14 @@ tags: ["site", "ezbookkeeping"] tags: ["site", "ezbookkeeping"] + - name: Set sure + ansible.builtin.include_role: + name: "app" + tasks_from: "services/set_sure" + apply: + tags: ["site", "sure"] + tags: ["site", "sure"] + - name: Flush handlers right now ansible.builtin.meta: "flush_handlers" diff --git a/ansible/roles/app/handlers/main.yaml b/ansible/roles/app/handlers/main.yaml index ef2573c..e23eb90 100644 --- a/ansible/roles/app/handlers/main.yaml +++ b/ansible/roles/app/handlers/main.yaml @@ -133,3 +133,17 @@ changed_when: false listen: "notification_restart_ezbookkeeping" ignore_errors: true # noqa: ignore-errors + +- name: Restart sure + ansible.builtin.systemd: + name: "{{ item }}" + state: "restarted" + enabled: true + scope: "user" + daemon_reload: true + loop: + - "sure-web.service" + - "sure-worker.service" + changed_when: false + listen: "notification_restart_sure" + ignore_errors: true # noqa: ignore-errors diff --git a/ansible/roles/app/tasks/services/set_sure.yaml b/ansible/roles/app/tasks/services/set_sure.yaml new file mode 100644 index 0000000..9e1be86 --- /dev/null +++ b/ansible/roles/app/tasks/services/set_sure.yaml @@ -0,0 +1,110 @@ +--- +- name: Set redis service name + ansible.builtin.set_fact: + redis_service: "sure" + +- name: Create redis_sure directory + ansible.builtin.file: + path: "{{ node['home_path'] }}/{{ item }}" + state: "directory" + owner: "{{ services['redis']['subuid'] }}" + group: "svadmins" + mode: "0770" + loop: + - "containers/redis" + - "containers/redis/{{ redis_service }}" + - "containers/redis/{{ redis_service }}/data" + become: true + +- name: Deploy redis config file + ansible.builtin.template: + src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2" + dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf" + owner: "{{ ansible_user }}" + group: "svadmins" + mode: "0644" + register: "is_redis_conf" + +- name: Deploy redis container file + ansible.builtin.template: + src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2" + dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container" + owner: "{{ ansible_user }}" + group: "svadmins" + mode: "0644" + register: "is_redis_containerfile" + +- name: Enable (Restart) redis service + ansible.builtin.systemd: + name: "redis_{{ redis_service }}.service" + state: "restarted" + enabled: true + daemon_reload: true + scope: "user" + when: is_redis_conf.changed or is_redis_containerfile.changed # noqa: no-handler + +- name: Create sure directory + ansible.builtin.file: + path: "{{ node['home_path'] }}/{{ item }}" + state: "directory" + owner: "{{ services['sure']['subuid'] }}" + group: "svadmins" + mode: "0770" + loop: + - "data/containers/sure" + - "data/containers/sure/storage" + - "containers/sure" + - "containers/sure/ssl" + become: true + + +- name: Deploy root certificate + ansible.builtin.copy: + content: | + {{ hostvars['console']['ca']['root']['crt'] }} + dest: "{{ node['home_path'] }}/containers/sure/ssl/{{ root_cert_filename }}" + owner: "{{ services['paperless']['subuid'] }}" + group: "svadmins" + mode: "0440" + become: true + notify: "notification_restart_sure" + no_log: true + +- name: Register secret value to podman secret + containers.podman.podman_secret: + name: "{{ item.name }}" + data: "{{ item.value }}" + state: "present" + force: true + loop: + - name: "SURE_SECRET_KEY_BASE" + value: "{{ hostvars['console']['sure']['session_secret'] }}" + - name: "SURE_POSTGRES_PASSWORD" + value: "{{ hostvars['console']['postgresql']['password']['sure'] }}" + - name: "SURE_OIDC_CLIENT_SECRET" + value: "{{ hostvars['console']['sure']['oidc']['secret'] }}" + notify: "notification_restart_sure" + no_log: true + +- name: Deploy sure.container file + ansible.builtin.template: + src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/sure/{{ item }}.j2" + dest: "{{ node['home_path'] }}/.config/containers/systemd/{{ item }}" + owner: "{{ ansible_user }}" + group: "svadmins" + mode: "0644" + loop: + - "sure-web.container" + - "sure-worker.container" + notify: "notification_restart_sure" + +- name: Enable paperless.service + ansible.builtin.systemd: + name: "{{ item }}" + state: "started" + enabled: true + daemon_reload: true + scope: "user" + loop: + - "sure-web.service" + - "sure-worker.service" diff --git a/ansible/roles/infra/tasks/services/set_postgresql.yaml b/ansible/roles/infra/tasks/services/set_postgresql.yaml index 7b74d63..87716a7 100644 --- a/ansible/roles/infra/tasks/services/set_postgresql.yaml +++ b/ansible/roles/infra/tasks/services/set_postgresql.yaml @@ -13,6 +13,7 @@ - "affine" - "nextcloud" - "ezbookkeeping" + - "sure" - name: Create postgresql directory ansible.builtin.file: diff --git a/config/secrets/secrets.yaml b/config/secrets/secrets.yaml index bac7036..814f76c 100644 --- a/config/secrets/secrets.yaml +++ b/config/secrets/secrets.yaml @@ -121,6 +121,7 @@ postgresql: affine: ENC[AES256_GCM,data:XPXrcszsV06YqCJZ7CDqc4rCwqqNlbtLCFYfLAQ8jamLtft8L2UVrMA4WZo=,iv:vrWdBeckxB9tmEE628j4jhU+hSpE6TXYMGt0hh1Cg84=,tag:hlWwWUGht8NqWTZREMsa1Q==,type:str] nextcloud: ENC[AES256_GCM,data:ROsximNuWYMTZktmLJPx7W1Qol/uT+APgwoCtFO/6ZYYc3KxKvlk344eqEc=,iv:4d+MrfIHjJKAcwhvZ3g4go66uZcieuL7lngKErJd+fg=,tag:QbWOtxeCbiu62GyrE2atXg==,type:str] ezbookkeeping: ENC[AES256_GCM,data:CYYQ5DVr8Na46QduvUNF6d0XBVSXTml34q3/PhIYIvUNviOVgCjqXA4wN7g=,iv:qRljohJ+wI50XxSgMElKp65HyV3mKRTqDGjw9C1S0d0=,tag:PClp7PRmC0+PV0SzZpJqqQ==,type:str] + sure: ENC[AES256_GCM,data:FULJ2gjJ2gZC3s324itW+CjGRBHIP9RnOqw5TT1UaiUhb7UHAPm1na+LsZk=,iv:c0GnVZkxprJUzPPq3TCQaZvAes9QQuvDXqgVLLaiQIg=,tag:uDxy/Lkd2hNK4AWwMNMslw==,type:str] #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment] # # @@ -275,6 +276,15 @@ ezbookkeeping: #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment] # # +#ENC[AES256_GCM,data:Fsqc2JDp9dvfgiCjdQ==,iv:3DALKKEXaP8hzXRvxD4CgfFpOiPPsOa16OB94n8WKp8=,tag:K+FF3zGrc0YLXWK/R2L3Ow==,type:comment] +sure: + session_secret: ENC[AES256_GCM,data:InHsz/jld8E9TwI8MWpxk9x2I7dxlIsY9R6jtDK2pBA=,iv:HY5yXEC2Dce26e9/vXTIWELvVd9ZjhcCwFD0jhz5pPw=,tag:LLSJovZ0RH3CUK+se7R4Ag==,type:str] + oidc: + secret: ENC[AES256_GCM,data:9BSvpcU9BJctSN9bkPIAsRxg8JNHTWvOKdpJFhm//CUDm/Xc7oC/ANHf5no=,iv:JVQLl/rp65kZSK/4SpVXxtiac3Z35XNkxWm2+lEdq/c=,tag:WgfaORiNlrO+wHSdnl4CWQ==,type:str] + hash: ENC[AES256_GCM,data:EjJ+1fP7/9wG2jG0Jv2hxMLtErqxjHBstRjru79dd5ZXhqwT7S+jpLfl9WpZU9qi20ps9YP4qe7G08p6NJNXjYhQj852GQxEORRh/9StAZsPt3p8w+ePZSVbivPQH+FpPKWYxoH0VR7y3TnL66R0tKRLh1fNTc5jRy5rU5r1bfs1jZ0=,iv:0y9FxW4QdD7qHz3bPRWlwHFpvOsvlYhVrOItB6BzaE8=,tag:Wc7MZhP3QRYmvZcjpoEWtQ==,type:str] +#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment] +# +# #ENC[AES256_GCM,data:T4Wtn49AAxPd2QUFTR+q,iv:bH5goGWBDqumAat9dUv2OwfCUJUpuVqncTMqMBZUXhI=,tag:G+W6hHA+yftQ+4RJpXrxHg==,type:comment] switch: password: ENC[AES256_GCM,data:qu0f9L7A0eFq/UCpaRs=,iv:W8LLOp3MSfd/+EfNEZNf91K8GgI5eUfVPoWTRES2C0Y=,tag:Q5FlAOfwqwJwPvd7k6i+0g==,type:str] @@ -304,7 +314,7 @@ sops: UmliaFNxVTBqRkI1QWJpWGpTRWxETW8KEY/8AfU73UOzCGhny1cNnd5dCNv7bHXt k+uyWPPi+enFkVaceSwMFrA66uaWWrwAj11sXEB7yzvGFPrnAGezjQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-05-06T05:55:57Z" - mac: ENC[AES256_GCM,data:ZIZKCze9wNuUj3C1ghHjCgVtwU9AyZPZZ0HLfEmrnPvVjyNtTlrlmj3rwR+luHSRC6kUMKWBL1NETcs3cUupcep52Ec1cxK2gHjYFK4Ri+Ep7WJB2PXzLxtxCgurrASmW1HvEihbEEpfcLA2PP4SZ7bUrjKfIPjXxcSOOKLu7kI=,iv:5evst9V+IwsB6QXNbZfKOBrUHJzI83Z4kri+P/5Xx3M=,tag:UVwMuDLQ0e/5wX8v3+L8Gg==,type:str] + lastmodified: "2026-05-06T07:38:04Z" + mac: ENC[AES256_GCM,data:5Q9oN/oun7x1q7L4HWWM52V0YDPyoADBZICdgDwLPWqgpXabz5Z49xvKt+NLXwsC+5q3VK27Y9NS2ZWOXJJGE2uQ7XWYh08r4yA9wHXpq0LcBdhPeV3R1aVG8zVtsyV760ctqJnmfThM18lVgnVahJAQDmg6VPYMd/UV5cFbtAw=,iv:99S9Qt7BdvDCKLgEdUqcWI2M2dxzpN5koxe6W9asrpg=,tag:cEOceyMhocPKS1Wyhhoe4A==,type:str] unencrypted_suffix: _unencrypted version: 3.12.1 diff --git a/config/services/containers/app/sure/sure-web.container.j2 b/config/services/containers/app/sure/sure-web.container.j2 new file mode 100644 index 0000000..62d212b --- /dev/null +++ b/config/services/containers/app/sure/sure-web.container.j2 @@ -0,0 +1,67 @@ +[Quadlet] +DefaultDependencies=false + +[Unit] +Description=Sure Web + +After=network-online.target redis_sure.service +Wants=network-online.target redis_sure.service + +[Container] +Image=ghcr.io/we-promise/sure:{{ version['containers']['sure'] }} +ContainerName=sure-web +HostName=sure-web + +PublishPort={{ services['sure']['ports']['http'] }}:3000/tcp + +Volume=%h/data/containers/sure/storage:/rails/storage:rw +Volume=%h/containers/sure/ssl:/etc/ssl/sure:ro + +# General +Environment="TZ=Asia/Seoul" +Environment="SELF_HOSTED=true" +Environment="ONBOARDING_STATE=closed" +Environment="RAILS_FORCE_SSL=false" +Environment="RAILS_ASSUME_SSL=true" +Environment="APP_DOMAIN={{ services['sure']['domain']['public'] }}.{{ domain['public'] }}" +Secret=SURE_SECRET_KEY_BASE,type=env,target=SECRET_KEY_BASE + +# PostgreSQL +Environment="POSTGRES_USER=sure" +Environment="POSTGRES_DB=sure_db" +Environment="DB_HOST={{ services['postgresql']['domain'] }}.{{ domain['internal'] }}" +Environment="DB_PORT={{ services['postgresql']['ports']['tcp'] }}" +Environment="PGSSLMODE=verify-full" +Environment="PGSSLROOTCERT=/etc/ssl/sure/{{ root_cert_filename }}" +Secret=SURE_POSTGRES_PASSWORD,type=env,target=POSTGRES_PASSWORD + +# Redis +Environment="REDIS_URL=redis://host.containers.internal:{{ services['sure']['ports']['redis'] }}/1" + +# OIDC - Authelia +Environment="OIDC_CLIENT_ID=sure" +Environment="OIDC_ISSUER=https://{{ services['authelia']['domain'] }}.{{ domain['public'] }}" +Environment="OIDC_REDIRECT_URI=https://{{ services['sure']['domain']['public'] }}.{{ domain['public'] }}/auth/openid_connect/callback" +Secret=SURE_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET +Environment="OIDC_BUTTON_LABEL=Sign in with Authelia" +Environment="AUTH_JIT_MODE=create_and_link" +# email's domain, e.g. ilnmors.internal then only user@ilnmors.internal is allowed to sign-up +Environment="ALLOWED_OIDC_DOMAINS=" + +# WebAuthn / Passkey +Environment="WEBAUTHN_RP_ID={{ domain['public'] }}" +Environment="WEBAUTHN_ALLOWED_ORIGINS=https://{{ services['sure']['domain']['public'] }}.{{ domain['public'] }}" + +# Provider +## Currency +Environment="EXCHANGE_RATE_PROVIDER=yahoo_finance" +Environment="SECURITIES_PROVIDER=yahoo_finance" + +[Service] +ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }} +Restart=always +RestartSec=10s +TimeoutStopSec=120 + +[Install] +WantedBy=default.target diff --git a/config/services/containers/app/sure/sure-worker.container.j2 b/config/services/containers/app/sure/sure-worker.container.j2 new file mode 100644 index 0000000..1ddd316 --- /dev/null +++ b/config/services/containers/app/sure/sure-worker.container.j2 @@ -0,0 +1,67 @@ +[Quadlet] +DefaultDependencies=false + +[Unit] +Description=Sure Worker + +After=network-online.target redis_sure.service +Wants=network-online.target redis_sure.service + +[Container] +Image=ghcr.io/we-promise/sure:{{ version['containers']['sure'] }} +ContainerName=sure-worker +HostName=sure-worker + +Volume=%h/data/containers/sure/storage:/rails/storage:rw +Volume=%h/containers/sure/ssl:/etc/ssl/sure:ro + +Exec=bundle exec sidekiq + +# General +Environment="TZ=Asia/Seoul" +Environment="SELF_HOSTED=true" +Environment="ONBOARDING_STATE=closed" +Environment="RAILS_FORCE_SSL=false" +Environment="RAILS_ASSUME_SSL=true" +Environment="APP_DOMAIN={{ services['sure']['domain']['public'] }}.{{ domain['public'] }}" +Secret=SURE_SECRET_KEY_BASE,type=env,target=SECRET_KEY_BASE + +# PostgreSQL +Environment="POSTGRES_USER=sure" +Environment="POSTGRES_DB=sure_db" +Environment="DB_HOST={{ services['postgresql']['domain'] }}.{{ domain['internal'] }}" +Environment="DB_PORT={{ services['postgresql']['ports']['tcp'] }}" +Environment="PGSSLMODE=verify-full" +Environment="PGSSLROOTCERT=/etc/ssl/sure/{{ root_cert_filename }}" +Secret=SURE_POSTGRES_PASSWORD,type=env,target=POSTGRES_PASSWORD + +# Redis +Environment="REDIS_URL=redis://host.containers.internal:{{ services['sure']['ports']['redis'] }}/1" + +# OIDC - Authelia +Environment="OIDC_CLIENT_ID=sure" +Environment="OIDC_ISSUER=https://{{ services['authelia']['domain'] }}.{{ domain['public'] }}" +Environment="OIDC_REDIRECT_URI=https://{{ services['sure']['domain']['public'] }}.{{ domain['public'] }}/auth/openid_connect/callback" +Secret=SURE_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET +Environment="OIDC_BUTTON_LABEL=Sign in with Authelia" +Environment="AUTH_JIT_MODE=create_and_link" +# email's domain, e.g. ilnmors.internal then only user@ilnmors.internal is allowed to sign-up +Environment="ALLOWED_OIDC_DOMAINS=" + +# WebAuthn / Passkey +Environment="WEBAUTHN_RP_ID={{ domain['public'] }}" +Environment="WEBAUTHN_ALLOWED_ORIGINS=https://{{ services['sure']['domain']['public'] }}.{{ domain['public'] }}" + +# Provider +## Currency +Environment="EXCHANGE_RATE_PROVIDER=yahoo_finance" +Environment="SECURITIES_PROVIDER=yahoo_finance" + +[Service] +ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }} +Restart=always +RestartSec=10s +TimeoutStopSec=120 + +[Install] +WantedBy=default.target diff --git a/config/services/containers/auth/authelia/config/authelia.yaml.j2 b/config/services/containers/auth/authelia/config/authelia.yaml.j2 index de431c3..fa67d1a 100644 --- a/config/services/containers/auth/authelia/config/authelia.yaml.j2 +++ b/config/services/containers/auth/authelia/config/authelia.yaml.j2 @@ -408,3 +408,25 @@ identity_providers: access_token_signed_response_alg: 'none' userinfo_signed_response_alg: 'none' token_endpoint_auth_method: 'client_secret_basic' + # https://www.authelia.com/integration/openid-connect/clients/sure/ + - client_id: 'sure' + client_name: 'Sure' + client_secret: '{{ hostvars['console']['sure']['oidc']['hash'] }}' + public: false + authorization_policy: 'one_factor' + require_pkce: true + pkce_challenge_method: 'S256' + redirect_uris: + - 'https://sure.ilnmors.com/auth/openid_connect/callback' + scopes: + - 'openid' + - 'email' + - 'profile' + - 'groups' + response_types: + - 'code' + grant_types: + - 'authorization_code' + access_token_signed_response_alg: 'none' + userinfo_signed_response_alg: 'none' + token_endpoint_auth_method: 'client_secret_basic' diff --git a/config/services/containers/common/caddy/etc/app/Caddyfile.j2 b/config/services/containers/common/caddy/etc/app/Caddyfile.j2 index e7d6fa8..e14e525 100644 --- a/config/services/containers/common/caddy/etc/app/Caddyfile.j2 +++ b/config/services/containers/common/caddy/etc/app/Caddyfile.j2 @@ -95,3 +95,9 @@ header_up Host {http.request.header.X-Forwarded-Host} } } +{{ services['sure']['domain']['internal'] }}.{{ domain['internal'] }} { + import private_tls + reverse_proxy host.containers.internal:{{ services['sure']['ports']['http'] }} { + header_up Host {http.request.header.X-Forwarded-Host} + } +} diff --git a/config/services/containers/common/caddy/etc/auth/Caddyfile.j2 b/config/services/containers/common/caddy/etc/auth/Caddyfile.j2 index c90357a..823919d 100644 --- a/config/services/containers/common/caddy/etc/auth/Caddyfile.j2 +++ b/config/services/containers/common/caddy/etc/auth/Caddyfile.j2 @@ -163,6 +163,15 @@ } } } +{{ services['sure']['domain']['public'] }}.{{ domain['public'] }} { + import crowdsec_log + route { + crowdsec + reverse_proxy https://{{services['sure']['domain']['internal'] }}.{{ domain['internal'] }} { + header_up Host {http.reverse_proxy.upstream.host} + } + } +} # Internal domain {{ node['name'] }}.{{ domain['internal'] }} { diff --git a/docs/services/app/sure.md b/docs/services/app/sure.md new file mode 100644 index 0000000..658846a --- /dev/null +++ b/docs/services/app/sure.md @@ -0,0 +1,67 @@ +# sure + +## Prerequisite + +### Create database + +- Create the password with `openssl rand -base64 32` + - Save this value in secrets.yaml in `postgresql.password.sure` + - Access infra server to create sure_db with `podman exec -it postgresql psql -U postgres` + +```SQL +CREATE USER sure WITH PASSWORD 'postgresql.password.sure'; +CREATE DATABASE sure_db; +ALTER DATABASE sure_db OWNER TO sure; +``` + +### Create oidc secret and hash + +- Create the secret with `openssl rand -base64 32` +- access to auth vm + - `podman exec -it authelia sh` + - `authelia crypto hash generate pbkdf2 --password 'sure.oidc.secret'` +- Save this value in secrets.yaml in `sure.oidc.secret` and `sure.oidc.hash` + +### Create session secret value + +- Create the secret with `LC_ALL=C tr -dc 'A-Za-z0-9!#%&()*+,-./:;<=>?@[\]^_{|}~'