viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

add Google OAuth env vars to plotting-book deployment

Browse source 
Deploy GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and GOOGLE_CALLBACK_URL
to the plotting-book container. Update CSP to allow accounts.google.com
for connect-src and form-action directives.
This commit is contained in:
Viktor Barzin 2026-03-07 20:41:08 +00:00
parent 650c2a6ed4
commit 33b20ce111
1 changed files with 22 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

24
stacks/plotting-book/main.tf
View file

@ -3,7 +3,15 @@ variable "tls_secret_name" {
sensitive = true sensitive = true
} }
variable "plotting_book_session_secret" { variable "plotting_book_session_secret" {
type = string type = string
sensitive = true
}
variable "plotting_book_google_client_id" {
type = string
sensitive = true
}
variable "plotting_book_google_client_secret" {
type = string
sensitive = true sensitive = true
} }
@ -61,6 +69,18 @@ resource "kubernetes_deployment" "plotting-book" {
name = "SESSION_SECRET" name = "SESSION_SECRET"
value = var.plotting_book_session_secret value = var.plotting_book_session_secret
} }
env {
name = "GOOGLE_CLIENT_ID"
value = var.plotting_book_google_client_id
}
env {
name = "GOOGLE_CLIENT_SECRET"
value = var.plotting_book_google_client_secret
}
env {
name = "GOOGLE_CALLBACK_URL"
value = "https://plotting-book.viktorbarzin.me/api/auth/google/callback"
}
port { port {
container_port = 3001 container_port = 3001
} }
@ -107,7 +127,7 @@ module "ingress" {
name = "plotting-book" name = "plotting-book"
tls_secret_name = var.tls_secret_name tls_secret_name = var.tls_secret_name
custom_content_security_policy = "default-src 'self' blob: data:; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; worker-src 'self' blob:; connect-src 'self' blob:; frame-ancestors 'self' *.viktorbarzin.me viktorbarzin.me" custom_content_security_policy = "default-src 'self' blob: data:; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; worker-src 'self' blob:; connect-src 'self' blob: https://accounts.google.com; form-action 'self' https://accounts.google.com; frame-ancestors 'self' *.viktorbarzin.me viktorbarzin.me"
extra_annotations = { extra_annotations = {
"gethomepage.dev/enabled" = "true" "gethomepage.dev/enabled" = "true"
"gethomepage.dev/name" = "Plotting Book" "gethomepage.dev/name" = "Plotting Book"