Zammad

Open source Helpdesk and Support tool. https://zammad.com

Prerequisites

By default, zammad is not connected to OIDC. This has to be done manually with the admin account.

Usage

momo-cloud.zammad = {
  enable = true;
  adminEmailAddress = "admin@example.com";
  secretKeyBaseFile = config.age.secrets."zammad-secret-base-file".path;
};

• The user with adminEmailAddress is automatically created and given full permissions.
• If the user does exist already, the user is not touched, eg. no permissions will be updated.
• If the email address matches an OIDC user, the accounts are automatically linked together.

To give an ordinary user permissions to see tickets, go to Users and add any OIDC accounts to the Users group with Full permissions.

Secrets

To generate the secret for secretKeyBaseFile, you can use openssl:

openssl rand -hex 64

Moving to a different Domain

If the TLD is changed, there are two manual changes that need to change in the zammad config. You can perform these either with the admin account or via the rails console after you’ve deployed the instance with the new domain:

To start the rails console, log in via ssh and run the following:

sudo zammad run rails c

1. Update the fqdn: see the zammad docs
2. Update the OIDC config

For the second part, you’ll have to update the kanidm issue URL.

First, get the current config from the database:

c = Setting.get('auth_openid_connect_credentials')
=> {"display_name" => "Teylen Cloud ID",
 "identifier" => "zammad",
 "issuer" => "https://account.OLD_DOMAIN/oauth2/openid/zammad",
 "uid_field" => "",
 "scope" => "",
 "pkce" => true}

Then, update the issuer string:

c[:issuer] = "https://account.NEW_DOMAIN/oauth2/openid/zammad"
=> "https://account.NEW_DOMAIN/oauth2/openid/zammad"

Last, write this out to the database:

Setting.set('auth_openid_connect_credentials', c)