feat(ssh_locker): implement ssh locker helper scripts and configuration for Duo API integration

terraform/k8sapps/apps.tf

@@ -128,3 +128,14 @@ module "trivy" {
   from_email    = "trivy@${local.primary_domain}"
   to_email      = "c.alexandre.pires@${local.primary_domain}"
 }
+
+module "ssh_locker_web" {
+  source = "../modules/apps/ssh_locker_web"
+
+  duo_client_id     = var.server_api_duo_client_id
+  duo_client_secret = var.server_api_duo_client_secret
+  access_token      = var.server_api_access_token
+  duo_api_host      = "api-7cda1654.duosecurity.com"
+  redirect_uri      = "https://alexpires.me/api/ssh_locker/duo-callback"
+  socket_path       = "/var/run/ssh_locker/provision.sock"
+}

terraform/k8sapps/resources/alexpires.me.conf

@@ -9,3 +9,14 @@ location ^~ /config/dav {
     proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-Port $server_port;
 }
+
+location ^~ /api/ssh_locker/ {
+    rewrite ^/api/ssh_locker/(.*)$ /$1 break;
+    proxy_pass https://backend.ssh-locker-web.svc.cluster.local;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Port $server_port;
+}

terraform/k8sapps/secrets.tf

@@ -106,3 +106,19 @@ variable "gitea_jwt_secret" {
   type        = string
   sensitive   = true
 }
+
+variable "server_api_duo_client_id" {
+  description = "Duo client ID"
+  type        = string
+  sensitive   = true
+}
+variable "server_api_duo_client_secret" {
+  description = "Duo client secret"
+  type        = string
+  sensitive   = true
+}
+variable "server_api_access_token" {
+  description = "Access token for ssh_locker API"
+  type        = string
+  sensitive   = true
+}

terraform/k8sapps/sectool.env

@@ -28,3 +28,6 @@ TF_VAR_gitea_lfs_jwt_secret=$GITEA_LFS_JWT_SECRET
 TF_VAR_gitea_secret_key=$GITEA_SECRET_KEY
 TF_VAR_gitea_internal_token=$GITEA_INTERNAL_TOKEN
 TF_VAR_gitea_jwt_secret=$GITEA_JWT_SECRET
+TF_VAR_server_api_duo_client_id=$SERVER_API_DUO_CLIENT_ID
+TF_VAR_server_api_duo_client_secret=$SERVER_API_DUO_CLIENT_SECRET
+TF_VAR_server_api_access_token=$SERVER_API_ACCESS_TOKEN