Homelabv4/scripts/sync-nextcloud-oauth.sh

#!/bin/bash
# scripts/sync-nextcloud-oauth.sh
# Sync Nextcloud OAuth credentials from Authentik to Vault and configure user_oidc provider

set -euo pipefail

AUTHENTIK_NAMESPACE="authentik"
VAULT_NAMESPACE="vault"
NEXTCLOUD_NAMESPACE="nextcloud"
VAULT_SECRET_PATH="secret/nextcloud-oauth"
AUTHENTIK_URL="https://auth.kube.huskypup.net"
NEXTCLOUD_URL="https://nextcloud.kube.huskypup.net"

echo "=== Syncing Nextcloud OAuth Credentials from Authentik to Vault ==="

# Wait for Authentik to be fully ready
echo "Waiting for Authentik to be ready..."
kubectl -n "${AUTHENTIK_NAMESPACE}" wait --for=condition=Ready pod -l app.kubernetes.io/name=authentik,app.kubernetes.io/component=server --timeout=60s || {
  echo "WARNING: Authentik may not be fully ready yet. Continuing anyway..."
}

# Get Authentik pod name
AUTHENTIK_POD=$(kubectl get pods -n "${AUTHENTIK_NAMESPACE}" -l app.kubernetes.io/name=authentik,app.kubernetes.io/component=server -o jsonpath='{.items[0].metadata.name}')

if [ -z "$AUTHENTIK_POD" ]; then
  echo "ERROR: Could not find Authentik server pod"
  exit 1
fi

echo "Found Authentik pod: ${AUTHENTIK_POD}"

# Retrieve OAuth2 provider credentials from Authentik
echo "Retrieving Nextcloud OAuth credentials from Authentik..."

# Try to get credentials via ak command
CLIENT_ID=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${AUTHENTIK_POD}" -- ak list_providers --type oauth2 2>/dev/null | grep -A 20 '"name": "Nextcloud"' | grep '"client_id"' | cut -d'"' -f4 || echo "")
CLIENT_SECRET=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${AUTHENTIK_POD}" -- ak list_providers --type oauth2 2>/dev/null | grep -A 20 '"name": "Nextcloud"' | grep '"client_secret"' | cut -d'"' -f4 || echo "")

# If command fails, try using PostgreSQL directly
if [ -z "$CLIENT_ID" ] || [ -z "$CLIENT_SECRET" ]; then
  echo "Attempting to retrieve credentials from Authentik PostgreSQL database..."
  
  CNPG_POD=$(kubectl get pods -n "${AUTHENTIK_NAMESPACE}" -l cnpg.io/cluster=pg-authentik,role=primary -o jsonpath='{.items[0].metadata.name}')
  
  if [ -z "$CNPG_POD" ]; then
    echo "ERROR: Could not find Authentik PostgreSQL pod"
    exit 1
  fi
  
  # Get PostgreSQL password
  PG_PASSWORD=$(kubectl get secret -n "${AUTHENTIK_NAMESPACE}" pg-authentik-app -o jsonpath='{.data.password}' | base64 -d)
  
  # Query the database for Nextcloud provider credentials
  PROVIDER_DATA=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${CNPG_POD}" -c postgres -- env PGPASSWORD="${PG_PASSWORD}" psql -U authentik -d authentik -t -c \
    "SELECT client_id, client_secret FROM authentik_providers_oauth2_oauth2provider WHERE name='Nextcloud';" 2>/dev/null || echo "")
  
  if [ -n "$PROVIDER_DATA" ]; then
    CLIENT_ID=$(echo "$PROVIDER_DATA" | awk '{print $1}' | tr -d ' ')
    CLIENT_SECRET=$(echo "$PROVIDER_DATA" | awk '{print $3}' | tr -d ' ')
  fi
fi

# Validate credentials were retrieved
if [ -z "$CLIENT_ID" ] || [ -z "$CLIENT_SECRET" ]; then
  echo "ERROR: Failed to retrieve Nextcloud OAuth credentials from Authentik"
  echo ""
  echo "Manual steps required:"
  echo "1. Access Authentik admin panel at ${AUTHENTIK_URL}"
  echo "2. Navigate to: Applications > Providers > Nextcloud"
  echo "3. Copy the Client ID and Client Secret"
  echo "4. Store them in Vault manually with:"
  echo "   kubectl exec -n vault <vault-pod> -- vault kv put ${VAULT_SECRET_PATH} client-id=\"<CLIENT_ID>\" client-secret=\"<CLIENT_SECRET>\""
  exit 1
fi

echo "Successfully retrieved credentials:"
echo "  Client ID: ${CLIENT_ID}"
echo "  Client Secret: ${CLIENT_SECRET:0:10}..." # Only show first 10 chars

# Check if Vault is unsealed and ready
echo "Checking Vault status..."
VAULT_POD=$(kubectl get pods -n "${VAULT_NAMESPACE}" -l app.kubernetes.io/name=vault -o jsonpath='{.items[0].metadata.name}')

if [ -z "$VAULT_POD" ]; then
  echo "ERROR: Vault pod not found"
  exit 1
fi

VAULT_STATUS=$(kubectl exec -n "${VAULT_NAMESPACE}" "${VAULT_POD}" -- vault status -format=json 2>/dev/null || echo "{}")
SEALED=$(echo "$VAULT_STATUS" | grep -o '"sealed":[^,}]*' | cut -d':' -f2 | tr -d ' ')

if [ "$SEALED" = "true" ]; then
  echo "ERROR: Vault is sealed. Please unseal Vault first."
  exit 1
fi

# Store credentials in Vault
echo "Storing Nextcloud OAuth credentials in Vault at ${VAULT_SECRET_PATH}..."
kubectl exec -n "${VAULT_NAMESPACE}" "${VAULT_POD}" -- vault kv put "${VAULT_SECRET_PATH}" \
  client-id="${CLIENT_ID}" \
  client-secret="${CLIENT_SECRET}"

if [ $? -eq 0 ]; then
  echo "✓ Successfully stored Nextcloud OAuth credentials in Vault"
else
  echo "ERROR: Failed to store credentials in Vault"
  exit 1
fi

# Wait for External Secret to sync
echo ""
echo "Waiting for External Secret to sync credentials to Nextcloud namespace..."
sleep 5

# Verify External Secret synced
kubectl wait --for=condition=Ready externalsecret/nextcloud-oauth -n "${NEXTCLOUD_NAMESPACE}" --timeout=30s || {
  echo "WARNING: External Secret may not be ready yet. Continuing anyway..."
}

# Wait for Nextcloud to be ready
echo "Waiting for Nextcloud to be ready..."
kubectl -n "${NEXTCLOUD_NAMESPACE}" wait --for=condition=Ready pod -l app.kubernetes.io/name=nextcloud --timeout=60s || {
  echo "WARNING: Nextcloud may not be fully ready yet. Continuing anyway..."
}

# Configure Nextcloud user_oidc provider
echo ""
echo "=== Configuring Nextcloud OIDC Provider ==="

# Get Nextcloud pod
NEXTCLOUD_POD=$(kubectl get pods -n "${NEXTCLOUD_NAMESPACE}" -l app.kubernetes.io/name=nextcloud -o jsonpath='{.items[0].metadata.name}')

if [ -z "$NEXTCLOUD_POD" ]; then
  echo "ERROR: Could not find Nextcloud pod"
  exit 1
fi

echo "Found Nextcloud pod: ${NEXTCLOUD_POD}"

# Check if provider already exists
EXISTING_PROVIDER=$(kubectl exec -n "${NEXTCLOUD_NAMESPACE}" "${NEXTCLOUD_POD}" -- php occ user_oidc:provider 2>/dev/null | grep -c "Authentik" || true)

if [ "$EXISTING_PROVIDER" -gt 0 ]; then
  echo "Updating existing Authentik OIDC provider..."
  kubectl exec -n "${NEXTCLOUD_NAMESPACE}" "${NEXTCLOUD_POD}" -- php occ user_oidc:provider Authentik \
    --clientid="${CLIENT_ID}" \
    --clientsecret="${CLIENT_SECRET}" \
    --discoveryuri="${AUTHENTIK_URL}/application/o/nextcloud/.well-known/openid-configuration" \
    --scope="openid email profile" \
    --mapping-uid="preferred_username" \
    --mapping-display-name="name" \
    --mapping-email="email" \
    --unique-uid=0
else
  echo "Creating new Authentik OIDC provider..."
  kubectl exec -n "${NEXTCLOUD_NAMESPACE}" "${NEXTCLOUD_POD}" -- php occ user_oidc:provider Authentik \
    --clientid="${CLIENT_ID}" \
    --clientsecret="${CLIENT_SECRET}" \
    --discoveryuri="${AUTHENTIK_URL}/application/o/nextcloud/.well-known/openid-configuration" \
    --scope="openid email profile" \
    --mapping-uid="preferred_username" \
    --mapping-display-name="name" \
    --mapping-email="email" \
    --unique-uid=0
fi

if [ $? -eq 0 ]; then
  echo "✓ Successfully configured Nextcloud OIDC provider"
else
  echo "ERROR: Failed to configure Nextcloud OIDC provider"
  exit 1
fi

# Verify configuration
echo ""
echo "Verifying OIDC provider configuration..."
kubectl exec -n "${NEXTCLOUD_NAMESPACE}" "${NEXTCLOUD_POD}" -- php occ user_oidc:provider Authentik

echo ""
echo "=== Nextcloud OAuth Configuration Complete ==="
echo ""
echo "You can now:"
echo "1. Visit ${NEXTCLOUD_URL}"
echo "2. Click 'Log in with Authentik' button on the login page"
echo "3. Authenticate using your Authentik credentials"
echo ""
echo "To verify the configuration:"
echo "  kubectl get externalsecret -n ${NEXTCLOUD_NAMESPACE} nextcloud-oauth"
echo "  kubectl get secret -n ${NEXTCLOUD_NAMESPACE} nextcloud-oauth-secret"
echo "  kubectl exec -n ${NEXTCLOUD_NAMESPACE} ${NEXTCLOUD_POD} -- php occ user_oidc:provider"