feat(apps): Log in to wg-easy with authentik OIDC

2026-10-10 01:46:35 +05:30
parent 40df38dd8d
commit 01ddf5937b
8 changed files with 75 additions and 51 deletions
@@ -104,15 +104,41 @@ data:
    metadata:
      name: WireGuard admin
    entries:
-      - model: authentik_providers_proxy.proxyprovider
+      # wg-easy rejects logins unless email_verified is true; the default email
+      # mapping always sends false.
+      - model: authentik_providers_oauth2.scopemapping
+        id: verified-email
+        identifiers:
+          name: wireguard-admin email
+        attrs:
+          scope_name: email
+          expression: |
+            return {
+                "email": request.user.email,
+                "email_verified": True,
+            }
+      - model: authentik_providers_oauth2.oauth2provider
        id: wireguard-admin-provider
        identifiers:
          name: wireguard-admin
        attrs:
          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          external_host: https://wg-admin.whyredfire.dev
-          mode: forward_single
+          client_id: wireguard-admin
+          client_secret: !Env WIREGUARD_CLIENT_SECRET
+          grant_types:
+            - authorization_code
+            - refresh_token
+          redirect_uris:
+            - matching_mode: strict
+              url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback
+            - matching_mode: strict
+              url: https://wg-admin.whyredfire.dev/api/auth/oidc/link
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !KeyOf verified-email
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
      - model: authentik_core.application
        id: wireguard-admin
        identifiers:
@@ -121,20 +147,10 @@ data:
          name: WireGuard Admin
          provider: !KeyOf wireguard-admin-provider
          meta_launch_url: https://wg-admin.whyredfire.dev
-      # Issuing VPN clients is admin-only.
+      # wg-easy makes every user it registers an admin, so only admins may log in.
      - model: authentik_policies.policybinding
        identifiers:
          order: 0
          target: !KeyOf wireguard-admin
        attrs:
          group: !Find [authentik_core.group, [name, admins]]
-      # This replaces the embedded outpost's provider list, so it also names the
-      # providers created in the UI.
-      - model: authentik_outposts.outpost
-        identifiers:
-          managed: goauthentik.io/outposts/embedded
-        attrs:
-          providers:
-            - !Find [authentik_providers_proxy.proxyprovider, [name, garage-ui]]
-            - !Find [authentik_providers_proxy.proxyprovider, [name, qbittorrent]]
-            - !KeyOf wireguard-admin-provider
@@ -11,9 +11,6 @@ spec:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: qbit
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: wireguard
  to:
    - group: ""
      kind: Service
@@ -12,6 +12,7 @@ spec:
    GOOGLE_CLIENT_ID: AgCV2Rwe/bHbkQ3nkkIs4EFTbsEqQWRaWlXa/fHzkDyNKpd0CTOgqVb6Rd2KYyvoT9iDR0xt/8reLPd9e7B3G3V1oVFV7G1XiErBmzvxr6591+tXzo8JLVpIy0363R87idi2xIKGVii+G5aJvxxhua8IRsNfi4SRtoqpDzjgNbFtm5UDhhlCzcRKkm0zHgLw83d4Uwszu9X9II2A4FuMPD6KvsTFrgHevR1v3OerKl5kvTlUx0O3XEg5mnNUVk46J+D9wfg58bIlgUhMV8NtfKa8I5zmRKhCJySks1zlCgIudCLX7wPYupFgt0nrZjJGx7a546ntPdMVE4IJ+VhlQ94gjdWsVFm07espaQLph9T4CZDKxb6TwyNswhfFxH1Z9auyFf3Cfk2wx5GChNOL0mZ8Zrzcw008c8IUShF8je8JZ60teBffbBNao7XN6JM6a4ac5aKnNwFch9IJUU1qkvcJaZk5hAkeGO9uHrICb6lkr5Rj7t4h9l4mvgfIKXP5YCCKZ+yqrSI8Jpkch/cB0Sphgp7m7QXgGwmWRgdKEk1rP7ioIfoF66mLsfgvOkc+1ySvPgW/rCLbHwzMqJn1Fkk/afbRoWp/guFj1cOY9MrEQIn8ftugeV/0xWiL+y5RyJm7QZc1z5fSj/NTrVCZV0LhBHttPZzoGGWEqjLYQnyJ8p38lK7EU6Pmk4WrEMj7mmdYHEijyPhab+b7guOc+ULbPT7k7sBHXbKrTTUJa09jIqSS4jl2PNrzPCPDIvRpG/cMgNklhNPfvpDQcLdVRA7bsf7navZvDsQ=
    GOOGLE_CLIENT_SECRET: AgDNFpqV5LGekTMvOBtPE9c6ZVPtT6wN+nCFRhZnvBKIz4I7U9jzisEN7yhc4ud22XJXpS5oR8hN4H+V6Js/bCZMDJefYcdstmHku14kUvoLRUtwPV9tdjiihmb57VLTnT1s1OzbnOqZPwXoCAmGAPLDgZrghBi0id21GgjU41jCHDJCcH1j9RHhE20JwsVG2uz9Tcp6MVYh94aq53V4//bvFXz4xQgVlN8c1jJ/W4rrNM9vmYdMwKyB5509oVWJigowsRlji0FXurR8ovz1AXpMuGj6hUGxLp0uHsqz7FV/0lsd4B2BR9cVRChAR8zDCiiKb4TH2Kmn676/Z+gtJ8vcOQg/WDT1ENzOr6dyndCLVxJvJuvl1EqinzhSqJjUy11HxqULApKKbX1iRJIAIGb6dpeKVoHDKg5xtcWGwaD6epG/tz20agkWBMCFNq5aS80npz28W5GeOQ8aF4X/rpjuEHVLrN+n0pgyS4wjwniB6UJMYRIYk45r0ICUtqyFjOiNzpU70NsPmEjDyItW1EVo+6tb0lRmOI5apm/9yayZXjFISwTAFPdBMrQL+ij4AGw4HMWMmN0aqDO+Kd1c9Jg6wUKluN2Lb6CaxehWeSJiz2wTEhEz8KBkInfezgSekNkw4wjJiBEZ4/M3G6Y/C61ekuVFarRc87cY+S3SomVZDGQcPysfQlieMVpHlfXq/CSDgHhZV3Q+S/wqpy5ZcfsyaU+v4PmvyEc12MZxQ1RGngVJow==
    GRAFANA_CLIENT_SECRET: AgBSE0QjGwtnyAjO/cy/TBKg+fuyKMSRgeQM/i7tPi9QcLpDjEHquGKmdBHUaeSaon3LRH3CPYQJ61T4d4xsp7EXzCM47MhO/rJ+6Xx+dGiIg071Ijj1qOBYszMNPXLZCst/9EfDEBRXQYmtr8X5UfcyXv8RHewvuqxcwy8qzsPsP5G/CpchGWlZRV3x+R+yCjVmTP7VuatPAltvGuAHsAv3Gh1aEXMJ1F3SsW/SP025V/bMiz1wKWe7/bkqJnXjLkNXWI/lpwzYWQl4/9v1Oiiw+1osH6fHNzXM6RA0ei1/FmlRwS9EqnUnl9hGE76GSllhwU9L6K9boJrKRnZIP6xBOJfrqimZciutTfiu6urghyimVACafQLWkeEB8m/zX1CSxVQ5M95n/dtdlBsWofMVyEtoeTip1HXZF1iee4yMv2yEg8yNSWmnb87fSYIMwpMiv5dYQTLg2WslnEe0DxcnyH+O0/MsmWHFz2f/Z4J6h+kWwMEv1pt8l+xkgbUthGGDx+HIcU9SZ/jyZjnzTt4i4BIbejAoXzMmm6q4zE0BD+9AbAQvEDOg6DW1TIu2mupoKVlqYljNE/9zVOAIBcFL0cJ4HNnW13+ufS4KoptZE3Rfv1tpU6g2MZ4y+QBCOczd+5HgXMtv3P9OweZg/l/LRdbFyH3OZviW/4suJFNbWZNgGUlqT/xyk/C5rn7uGSjSinp0lwkAqfxx7To/KP0jE7hJkVOH1vh+7COpFABJEx/cLAXAaIaVJsio38p5i4s+SMEq85Ew3uI46YKD8ljY7AQN3k66U7xQkLgjAT170Q==
+    WIREGUARD_CLIENT_SECRET: AgA4hqEjY0IfLpOpi02zj8hyNd+LCYtcmrRkumSR/8hGcccu6o3NJymoIrp32SbXG8triVM6EK16jVioT5Lgt/fCvNp5bWH78TSgzrSGsf8scK0DHTearXpEzk6XLL8OVORLloQRYIejS3QZo17eohAuZ8Mg0XZHTtfO1oJ5lHubu7y6WPKLnQEbNee+PKYpcRbMf+4b3eaRsEGtddneiZ+oowd1j308AwMxBDXN5NCJQepAZrCJp8csIgmkIEk6vSThKHikpkeO2xXmfmurKzJdEqSKoZOgBX6zSV3AycPHOocD49ZVw143J7Q5TqotznCpCxu2R4ogoA6zNPTuXBoEF6zRVDlNoTnh53cWhOWS7DApNMvnM/clWNdE4AdvXj5YpKgp8jgshQrLJMDd1IoenqBl1QdrptA5QVxRsTg/lkwXd8MQSRnB/sqGzQAB2Z/rrCvOBk21M7qJFoJUoLYXMpQY1I7qcJ9ydcGER4sRwdfWs/33C4vq9nw1gMtPFc/+VFpDagLeJ0/y82oQ4Ip1mMz7uTAZTXFFWT04byq7QV5WdwHaIAwJWNGRIi9GG/NvPLZUoJpgX0BQA7Ve0p/f38m48gaq53a/ynRwUF+a6+d2zeA8xjadqdXEIt1SY5LwMLW8mLhVxSfTbJJ/pGw8lJaJ1dtDw9NIm5Jl0ask6ndE30xOs581olJNb/7RshfB5Fczf+hdBlkKyhmQXHukRcZRI/muSDkjgVRteORGZfcr3vPEgstonEE/9SfuuKsGlVFQLw5272qKZVd4RF4f
  template:
    metadata:
      name: authentik-secrets