configure tailscale openID client

1 files changed, 25 insertions, 0 deletions

diff --git a/terraform/admin/keycloak.nix b/terraform/admin/keycloak.nix
index 4c1af8b..23b0824 100644
--- a/terraform/admin/keycloak.nix
+++ b/terraform/admin/keycloak.nix
@@ -158,5 +158,30 @@ in
         "https://code.fcuny.net"
       ];
     };
+    tailscale = {
+      realm_id = lib.tf.ref "keycloak_realm.fcuny.id";
+      client_id = "tailscale";
+      name = "Tailscale [fcuny.net]";
+      enabled = true;
+      access_type = "CONFIDENTIAL";
+      standard_flow_enabled = true;
+      direct_access_grants_enabled = true;
+
+      valid_redirect_uris = [
+        "*"
+      ];
+    };
+  };
+
+  resource.keycloak_openid_client_default_scopes = {
+    tailscale = {
+      realm_id = lib.tf.ref "keycloak_realm.fcuny.id";
+      client_id = lib.tf.ref "keycloak_openid_client.tailscale.id";
+      default_scopes = [
+        "profile"
+        "email"
+        "groups"
+      ];
+    };
   };
 }