feat: R1 重构对称迁移 + 升级依赖 + 配置文件分离
- 命名重构：tenant → customer（对齐后端 R1 重构） - Tenant → Customer / tenant_id → customerId - tenantStore → customerStore / getTenant/setTenant → getCustomer/setCustomer - cookie key tenant → customer, HTTP header tenantId → customerId - 后端契约更新：AuthResponse 加 sub 字段 - 接口 URL 修复：/auth/oidc/callback → /api/v1/auth/oidc/callback - 依赖升级：vue 3.5 / element-plus 2.8 / vite 5 / typescript 5.6 / sass 1.79 - 删 node-sass / scss / sass-loader / moment / mock/index.ts - 配置文件拆分：.env.development / .env.production / .env.example - 删除冗余 view/auth/auth/callback.vue 副本 - .gitignore 增加 dist / .opencode / tmp - 新增 AGENT.md 与后端风格对齐
This commit is contained in:
simple321vip
@@ -0,0 +1,14 @@
|
||||
# ========== Secret（密码管理）============
|
||||
# ⚠️ 生产环境请使用真正随机的密码
|
||||
# 生成随机密码: python3 -c "import secrets; print(secrets.token_urlsafe(32))"
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: authentik-secrets
|
||||
namespace: global
|
||||
type: Opaque
|
||||
stringData:
|
||||
# PostgreSQL 数据库密码
|
||||
postgres-password: "你的postgres密码"
|
||||
# Secret Key（用于加密 session、token 等）
|
||||
authentik-secret-key: "你的随机密钥（至少32字符）"
|
||||
@@ -0,0 +1,48 @@
|
||||
# ========== 5. Ingress 配置 ==========
|
||||
# 使用 cert-manager 自动管理 Let's Encrypt 证书
|
||||
# 如未安装 cert-manager: kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.0/cert-manager.yaml
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: authentik
|
||||
namespace: auth
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "nginx"
|
||||
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "50m"
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
|
||||
nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- auth.violin-work.online
|
||||
secretName: authentik-tls
|
||||
rules:
|
||||
- host: auth.violin-work.online
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: authentik-server
|
||||
port:
|
||||
number: 80
|
||||
|
||||
---
|
||||
# 如果没有 cert-manager，用这个 ClusterIssuer（先安装 cert-manager）
|
||||
# apiVersion: cert-manager.io/v1
|
||||
# kind: ClusterIssuer
|
||||
# metadata:
|
||||
# name: letsencrypt-prod
|
||||
# spec:
|
||||
# acme:
|
||||
# server: https://acme-v02.api.letsencrypt.org/directory
|
||||
# email: YOUR_EMAIL@domain.com # ⚠️ 改成你的邮箱
|
||||
# privateKeySecretRef:
|
||||
# name: letsencrypt-prod
|
||||
# solvers:
|
||||
# - http01:
|
||||
# ingress:
|
||||
# class: nginx
|
||||
@@ -0,0 +1,27 @@
|
||||
# Ingress - 只暴露 server 服务，worker 不需要对外访问
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: authentik
|
||||
namespace: global
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "nginx"
|
||||
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "50m"
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- auth.violin-work.online
|
||||
secretName: authentik-tls
|
||||
rules:
|
||||
- host: auth.violin-work.online
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: authentik-server
|
||||
port:
|
||||
number: 80
|
||||
@@ -0,0 +1,116 @@
|
||||
# Authentik 部署指南
|
||||
|
||||
## 目录结构
|
||||
|
||||
```
|
||||
authentik-deploy/
|
||||
├── 00-ns.yaml # Namespace
|
||||
├── 01-postgres.yaml # PostgreSQL 数据库
|
||||
├── 02-secret.yaml # 密钥（密码）
|
||||
├── auth-helm-values.yaml # Authentik Helm 配置
|
||||
├── 03-ingress.yaml # Ingress + TLS 证书
|
||||
├── install.sh # 一键安装脚本
|
||||
└── README.md # 本文件
|
||||
```
|
||||
|
||||
## 部署步骤
|
||||
|
||||
### 1. 准备
|
||||
|
||||
确保集群已安装：
|
||||
- **Helm 3**
|
||||
- **cert-manager**（自动管理 HTTPS 证书）
|
||||
```bash
|
||||
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.0/cert-manager.yaml
|
||||
```
|
||||
|
||||
### 2. 修改配置
|
||||
|
||||
编辑 `02-secret.yaml`，替换为真实随机密码：
|
||||
```bash
|
||||
# 生成随机密码
|
||||
python3 -c "import secrets; print(secrets.token_urlsafe(32))"
|
||||
```
|
||||
将输出填入 `authentik-secret-key` 和 `postgres-password`。
|
||||
|
||||
编辑 `03-ingress.yaml`，将 `YOUR_EMAIL@domain.com` 替换为你的邮箱。
|
||||
|
||||
### 3. 执行部署
|
||||
|
||||
```bash
|
||||
cd authentik-deploy
|
||||
chmod +x install.sh
|
||||
./install.sh
|
||||
```
|
||||
|
||||
或手动按顺序执行：
|
||||
```bash
|
||||
kubectl create ns auth
|
||||
kubectl apply -f 00-ns.yaml
|
||||
kubectl apply -f 01-postgres.yaml
|
||||
kubectl apply -f 02-secret.yaml
|
||||
helm repo add authentik https://charts.goauthentik.io && helm repo update
|
||||
helm install authentik authentik/authentik -n auth -f auth-helm-values.yaml
|
||||
kubectl apply -f 03-ingress.yaml
|
||||
```
|
||||
|
||||
### 4. 初始化
|
||||
|
||||
部署完成后访问：
|
||||
- **首次设置**: https://auth.violin-work.online/if/flow/initial/
|
||||
- 设置管理员账号和密码
|
||||
|
||||
### 5. 验证
|
||||
|
||||
```bash
|
||||
kubectl get pods -n auth
|
||||
kubectl logs -n auth -l app.kubernetes.io/component=server --tail=20
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 后续：配置其他服务接入 Authentik（OIDC）
|
||||
|
||||
### 在 Authentik 中创建 Application
|
||||
|
||||
1. 登录 Authentik Admin → **Applications**
|
||||
2. 点击 **Create**：
|
||||
- **Name**: OpenViking（或任意名称）
|
||||
- **Slug**: openviking
|
||||
- **Provider**: 创建 OIDC Provider（见下方）
|
||||
3. 创建 Provider：
|
||||
- **Name**: OpenViking Provider
|
||||
- **Client ID**: openviking
|
||||
- **Client Secret**: 生成一个随机值
|
||||
- **Redirect URIs**: `https://viking.violin-work.online/-/oauth-callback/openviking/`（根据实际调整）
|
||||
|
||||
### OpenViking 配置 OIDC
|
||||
|
||||
在 OpenViking 的配置文件中加入：
|
||||
```json
|
||||
{
|
||||
"oidc": {
|
||||
"issuer": "https://auth.violin-work.online",
|
||||
"client_id": "openviking",
|
||||
"client_secret": "你的client_secret"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### KubeSphere 配置 OIDC
|
||||
|
||||
在 KubeSphere Web 控制台：
|
||||
- **平台管理 → 访问控制 → 企业设置 → 第三方登录**
|
||||
- 填入 Authentik 的 OIDC 信息
|
||||
|
||||
---
|
||||
|
||||
## 维护
|
||||
|
||||
```bash
|
||||
# 更新 Authentik
|
||||
helm repo update && helm upgrade authentik authentik/authentik -n auth -f auth-helm-values.yaml
|
||||
|
||||
# 卸载
|
||||
helm uninstall authentik -n auth && kubectl delete ns auth
|
||||
```
|
||||
@@ -0,0 +1,33 @@
|
||||
# Authentik Helm - 2026.5.3 腾讯云镜像配置
|
||||
|
||||
global:
|
||||
image:
|
||||
repository: ccr.ccs.tencentyun.com/tei_agent/authentik-server
|
||||
tag: "2026.5.3"
|
||||
|
||||
authentik:
|
||||
secret_key: "Mb83201048"
|
||||
postgresql:
|
||||
host: "192.168.3.49"
|
||||
port: 5432
|
||||
name: "authentik"
|
||||
user: "authentik"
|
||||
password: "authentik"
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
size: 5Gi
|
||||
|
||||
postgresql:
|
||||
enabled: false
|
||||
|
||||
server:
|
||||
replicas: 1
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
worker:
|
||||
replicas: 1
|
||||
|
||||
geoip:
|
||||
enabled: false
|
||||
@@ -0,0 +1,39 @@
|
||||
# ========== 一键安装脚本（Linux/macOS）============
|
||||
# 保存为 install.sh，执行: chmod +x install.sh && ./install.sh
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
EMAIL="admin@violin-work.online" # ⚠️ 改成你的邮箱（Let's Encrypt 通知用）
|
||||
DOMAIN="auth.violin-work.online" # ⚠️ 改成你的域名
|
||||
|
||||
echo "=== 1. 创建 namespace ==="
|
||||
kubectl create ns auth --dry-run=client -o yaml | kubectl apply -f -
|
||||
|
||||
echo "=== 2. 创建 Secret ==="
|
||||
kubectl apply -f 02-secret.yaml
|
||||
|
||||
echo "=== 3. 部署 PostgreSQL ==="
|
||||
kubectl apply -f 01-postgres.yaml
|
||||
|
||||
echo "=== 4. 等待 PostgreSQL 就绪 ==="
|
||||
kubectl wait --for=condition=ready pod -l app=authentik-postgres -n auth --timeout=120s
|
||||
|
||||
echo "=== 5. 添加 Helm 源并安装 Authentik ==="
|
||||
helm repo add authentik https://charts.goauthentik.io --force-update
|
||||
helm repo update
|
||||
helm install authentik authentik/authentik -n auth -f auth-helm-values.yaml
|
||||
|
||||
echo "=== 6. 部署 Ingress + 证书 ==="
|
||||
kubectl apply -f 03-ingress.yaml
|
||||
|
||||
echo "=== 7. 等待 Authentik Server 就绪 ==="
|
||||
kubectl wait --for=condition=ready pod -l app.kubernetes.io/component=server -n auth --timeout=180s
|
||||
|
||||
echo ""
|
||||
echo "=== 部署完成! ==="
|
||||
echo "访问: https://$DOMAIN"
|
||||
echo "初始设置: https://$DOMAIN/if/flow/initial/"
|
||||
echo ""
|
||||
echo "查看状态:"
|
||||
echo " kubectl get pods -n auth"
|
||||
echo " kubectl logs -n auth -l app.kubernetes.io/component=server --tail=50"
|
||||
Reference in New Issue
Block a user