samply/secret-sync-local repository overview

services:
  local:
    image: samply/secret-sync-local:latest
    environment:
      # See below for the format specification
      - SECRET_DEFINITIONS=${ARGS}
      # The beam app id of the secret sync central component that answers OIDC requests (optional)
      - OIDC_PROVIDER=${OIDC_PROVIDER_APP_ID}
      # The beam app id of the secret sync central component that answers GitLab project access token requests (optional)
      - GITLAB_PROJECT_ACCESS_TOKEN_PROVIDER=app2.proxy2.broker
      # Required args for the beam proxy for more options look at the beam Readme
      - PROXY_ID=proxy1.broker
      - BROKER_URL=${BROKER_URL}
    volumes:
      # Path can be configuard via CACHE_PATH this container path is the default
      - ${CACHE_PATH}:/usr/local/cache
    # Used for the embedded beam proxy
    secrets:
      - privkey.pem
      - root.crt.pem

services:
  central:
    image: samply/secret-sync-central:latest
    environment:
      # Url of the local beam proxy
      - BEAM_URL=http://proxy:8082
      # App id of this beam app
      - BEAM_ID=secret-sync.central.broker
      - BEAM_SECRET=${BEAM_SECRET_FOR_THIS_APP}

      # Optional keycloak parameters
      - KEYCLOAK_URL=http://keycloak:8080
      # Client id of the keycloak client which has to have permissions to create clients
      - KEYCLOAK_ID=my_keycloak_admin
      # The client secret for the client
      - KEYCLOAK_SECRET=my_secret
      # Extra service account roles for the private client
      - KEYCLOAK_SERVICE_ACCOUNT_ROLES=query-users,query-groups
      # generated groups
      - KEYCLOAK_GROUPS_PER_BH="DKTK_CCP_#,Test_#"

      # Optional authentik parameters
      - AUTHENTIK_URL=http://authentik:9000
      # API Access Token 
      - AUTHENTIK_SERVICE_API_KEY=secret_token
      # Proppertymapping names
      - AUTHENTIK_PROPERTY_NAMES="allgroups,defauld groups"
      # Federation source names
      - AUTHENTIK_FEDERATION_NAMES="Local Account,Example Accounts"
      # generated groups
      - AUTHENTIK_GROUPS_PER_BH="DKTK_CCP_#,Test_#"
      # (Optional) authorization flow default:
      - AUTHENTIK_FLOW_AUTH="Authorize Application"
      # (Optional) signing key default:
      - AUTHENTIK_CRYPTO_SIGNING_KEY="authentik Self-signed Certificate"
      # (Optional) invalidation flow default:
      - AUTHENTIK_FLOW_INVALIDATION="Logged out of application"


      # Optional GitLab parameters. More than one GitLab server can be configured by using different prefixes like "verbis" in this example.
      # The base URL for API calls, e.g. "https://gitlab.com/".
      - verbis_GITLAB_URL=
      # Format of the repository name on GitLab. Must contain a "#" which is replaced with the site name. Example: "bridgehead-configurations/bridgehead-config-#"
      - verbis_GITLAB_REPO_FORMAT=
      # A long-living personal (or impersonation) access token that is used to create short-living project access tokens. Requires at least the "api" scope. Note that group access tokens and project access tokens cannot be used to create project access tokens.
      - verbis_GITLAB_API_ACCESS_TOKEN=