OAuth2 configuration example

limiting-factor commented

2024-08-05 16:57:33 +00:00

I would like to configure https://code.forgejo.org/f3/f3-forgejo/raw/branch/main/helm/a.yml so that it allows registration from code.forgejo.org.

https://code.forgejo.org/forgejo-helm/forgejo-helm#oauth2-settings

I think I should do something like:

gitea:
  oauth:
    - name: 'code-forgejo-org'
      provider: 'openidConnect'
      key: 'hello'
      secret: 'world'
      autoDiscoverUrl: 'https://code.forgejo.org/.well-known/openid-configuration'
      #useCustomUrls:
      #customAuthUrl:
      #customTokenUrl:
      #customProfileUrl:
      #customEmailUrl:

What I'm not sure about is where I should get key and secret? https://forgejo.org/docs/latest/admin/oauth2-provider/ does not seem to document that. https://forgejo.org/docs/latest/user/oauth2-provider/ looks more relevant and the example at https://forgejo.org/docs/latest/user/oauth2-provider/#examples is what I think is good for that.

But ... should I really do that with a user that I create myself? Isn't it better if an admin of code.forgejo.org does it instead?

I would like to configure https://code.forgejo.org/f3/f3-forgejo/raw/branch/main/helm/a.yml so that it allows registration from code.forgejo.org. https://code.forgejo.org/forgejo-helm/forgejo-helm#oauth2-settings I think I should do something like: ```yaml gitea: oauth: - name: 'code-forgejo-org' provider: 'openidConnect' key: 'hello' secret: 'world' autoDiscoverUrl: 'https://code.forgejo.org/.well-known/openid-configuration' #useCustomUrls: #customAuthUrl: #customTokenUrl: #customProfileUrl: #customEmailUrl: ``` What I'm not sure about is where I should get `key` and `secret`? https://forgejo.org/docs/latest/admin/oauth2-provider/ does not seem to document that. https://forgejo.org/docs/latest/user/oauth2-provider/ looks more relevant and the example at https://forgejo.org/docs/latest/user/oauth2-provider/#examples is what I think is good for that. But ... should I really do that with a user that I create myself? Isn't it better if an admin of code.forgejo.org does it instead?

limiting-factor commented

2024-08-05 17:02:01 +00:00

Author

Also, how can the icon be set?

Icon URL: https://design.codeberg.org/logo-kit/icon.svg

Also, how can the icon be set? > Icon URL: https://design.codeberg.org/logo-kit/icon.svg

earl-warren commented

2024-08-05 19:46:11 +00:00

Contributor

An alternative is to follow the steps manually as explained in the documentation. But it would be interesting to do that with the Helm itself for automation.

viceice commented

2024-08-05 19:59:29 +00:00

Owner

https://code.forgejo.org/forgejo-helm/forgejo-helm#oauth2-settings

you should create a kubernetes secret manually and reference it from the yaml via existingSecret

https://code.forgejo.org/forgejo-helm/forgejo-helm#oauth2-settings you should create a kubernetes secret manually and reference it from the yaml via `existingSecret`

viceice added the

Kind/Question

label

2024-08-05 19:59:57 +00:00

viceice commented

2025-04-15 13:26:07 +00:00

Owner

the oauth settings will be configured via gitea admin auth add-oauth and gitea admin auth update-oauth

https://forgejo.org/docs/latest/admin/command-line/#admin-auth-add-oauth

so you need to the proper option names freom the cli without the -- prefix.

       if [[ -z "${AUTH_ID}" ]]; then
         echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..."
         gitea admin auth add-oauth {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
         echo '...installed.'
       else
         echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..."
         gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
         echo '...sync settings done.'
       fi

 {{- define "gitea.oauth_settings" -}}
 {{- $idx := index . 0 }}
 {{- $values := index . 1 }}
 {{- if not (hasKey $values "key") -}}
 {{- $_ := set $values "key" (printf "${GITEA_OAUTH_KEY_%d}" $idx) -}}
 {{- end -}}
 {{- if not (hasKey $values "secret") -}}
 {{- $_ := set $values "secret" (printf "${GITEA_OAUTH_SECRET_%d}" $idx) -}}
 {{- end -}}
 {{- range $key, $val := $values -}}
 {{- if ne $key "existingSecret" -}}
 {{- printf "--%s %s " ($key | kebabcase) ($val | quote) -}}
 {{- end -}}
 {{- end -}}
 {{- end -}}
 {{- define "gitea.public_protocol" -}}
 {{- if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
 https
 {{- else -}}
 {{ .Values.gitea.config.server.PROTOCOL }}
 {{- end -}}
 {{- end -}}

the oauth settings will be configured via `gitea admin auth add-oauth` and `gitea admin auth update-oauth` https://forgejo.org/docs/latest/admin/command-line/#admin-auth-add-oauth so you need to the proper option names freom the cli without the `--` prefix. https://code.forgejo.org/forgejo-helm/forgejo-helm/src/commit/949431ec59cad2488287b52794e752de429b5f1f/templates/gitea/init.yaml#L210-L218 https://code.forgejo.org/forgejo-helm/forgejo-helm/src/commit/949431ec59cad2488287b52794e752de429b5f1f/templates/_helpers.tpl#L183-L208

viceice commented

2025-04-15 13:30:45 +00:00

Owner

so something like this (you can use caml-case, it will be converted automatically)

gitea:
  oauth:
    - name: 'code-forgejo-org'
      provider: 'openidConnect'
      key: 'hello' # Client ID
      secret: 'world' # Client Secret
      autoDiscoverUrl: 'https://code.forgejo.org/.well-known/openid-configuration'
      iconUrl: https://code.forgejo.org/...
      #useCustomUrls:
      #customAuthUrl:
      #customTokenUrl:
      #customProfileUrl:
      #customEmailUrl:

so something like this (you can use caml-case, it will be converted automatically) ```yaml gitea: oauth: - name: 'code-forgejo-org' provider: 'openidConnect' key: 'hello' # Client ID secret: 'world' # Client Secret autoDiscoverUrl: 'https://code.forgejo.org/.well-known/openid-configuration' iconUrl: https://code.forgejo.org/... #useCustomUrls: #customAuthUrl: #customTokenUrl: #customProfileUrl: #customEmailUrl: ```

viceice commented

2025-04-15 14:55:40 +00:00

Owner

you need to create an oauth application

https://code.forgejo.org/user/settings/applications

@earl-warren i can also configure a new app on our forgejo org at https://codeberg.org/org/forgejo/settings/applications

you need to create an oauth application https://code.forgejo.org/user/settings/applications @earl-warren i can also configure a new app on our forgejo org at https://codeberg.org/org/forgejo/settings/applications

kernald commented

2026-01-20 06:24:18 +00:00

There's one flag that I can't quite wrap my head around how to use it: --skip-local-2fa. It doesn't take a value, so how does one provide it through the Helm chart?

There's one flag that I can't quite wrap my head around how to use it: `--skip-local-2fa`. It doesn't take a value, so how does one provide it through the Helm chart?

viceice commented

2026-01-20 07:45:53 +00:00

Owner

@kernald wrote in #705 (comment):

There's one flag that I can't quite wrap my head around how to use it: --skip-local-2fa. It doesn't take a value, so how does one provide it through the Helm chart?

skipLocal-2fa: true

or

skip-local-2fa: true

The chart is smart enough to know it's a flag option

@kernald wrote in https://code.forgejo.org/forgejo-helm/forgejo-helm/issues/705#issuecomment-74433: > There's one flag that I can't quite wrap my head around how to use it: `--skip-local-2fa`. It doesn't take a value, so how does one provide it through the Helm chart? https://code.forgejo.org/forgejo-helm/forgejo-helm/src/commit/f11bfd37546ad3e5850af95b2794c3ccd1dded28/unittests/init/oauth.yaml#L20 or https://code.forgejo.org/forgejo-helm/forgejo-helm/src/commit/f11bfd37546ad3e5850af95b2794c3ccd1dded28/unittests/init/oauth.yaml#L40 The chart is smart enough to know it's a flag option

❤️ 1

viceice commented

2026-01-20 07:46:44 +00:00

Owner

@limiting-factor are you still interested to configure oauth on f3 test instance? i can do that for you, especially configure the secret in a k8s secret

limiting-factor commented

2026-01-20 08:27:56 +00:00

Author

I'm good with that, feel free to experiment with it. Until the end of next week I'll only use a local instance for F3 development and will not be disturbed if a.forgefriends.org is down.

Rows
Columns

OAuth2 configuration example #705