[iheitlager]

Summary

• deploy/stackit takes the SSO settings of ADR-020: sso_issuer, sso_client_id, sso_client_secret (sensitive) and sso_organisation, all four or none.
• The client secret reaches FRANK as a mounted file (FRANK_SSO_CLIENT_SECRET_FILE), never as an environment variable; the redirect URL is built from domain.
• For the Okta setup of test-frank#2 (Labs/deployments/test-frank on GitLab), on stackit.frank.lab271.dev.

Changes

Added

• variables.tf: the four sso_* variables, default empty.
• main.tf: a precondition on the server that refuses a partial set; the values passed to cloud-init.
• cloud-init.yaml.tftpl, only when sso_issuer is set:
  • /etc/frank/sso.env with FRANK_SSO_ISSUER, _CLIENT_ID, _CLIENT_SECRET_FILE, _REDIRECT_URL (https://<domain>/v1/sso/callback) and _ORGANISATION;
  • /etc/frank/sso-client-secret, 0600, chowned to 65532, written with jsonencode so any character survives the YAML;
  • mounted read-only at /run/secrets/frank-sso-client-secret, plus --env-file /etc/frank/sso.env.
• README: the options, and that the organisation must exist before SSO is turned on.

Unset, the rendered user data is unchanged apart from one chown line guarded by [ -f … ].

Changelog

• STACKIT: SSO settings for the module (sso_issuer, sso_client_id, sso_client_secret, sso_organisation), all four or none; the client secret reaches FRANK as a mounted file (ADR-020, test-frank#2).

Testing

• tofu fmt -check, tofu validate
• Template rendered with SSO on and off (tofu console); both parse as YAML; a secret with ", : and # comes through unchanged
• Applied on STACKIT from test-frank with the Okta app (test-frank#2), after this is released

---

🤖 Generated with Claude Code