feat(apps): Log in to wg-easy with authentik OIDC

apps/wireguard/deployment.yaml

@@ -23,6 +23,10 @@ spec:
               for b in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do
                 ln -sf xtables-nft-multi "/usr/sbin/$b"
               done
+              # Only used to skip the first-run setup; password login is
+              # disabled in favour of authentik.
+              INIT_PASSWORD="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+              export INIT_PASSWORD
               exec /usr/bin/dumb-init node server/index.mjs
           command:
             - /bin/sh
@@ -30,16 +34,41 @@ spec:
           env:
             - name: DISABLE_IPV6
               value: "true"
-            - name: INIT_ENABLED
+            - name: DISABLE_PASSWORD_AUTH
               value: "true"
             - name: INIT_ALLOWED_IPS
               value: 192.168.2.0/24
             - name: INIT_DNS
               value: 192.168.2.1
+            - name: INIT_ENABLED
+              value: "true"
+            - name: INIT_HOST
+              value: wg.whyredfire.dev
+            - name: INIT_PORT
+              value: "27299"
+            - name: INIT_USERNAME
+              value: admin
+            - name: OAUTH_AUTO_LAUNCH
+              value: oidc
+            - name: OAUTH_AUTO_REGISTER
+              value: "true"
+            - name: OAUTH_OIDC_CLIENT_ID
+              value: wireguard-admin
+            - name: OAUTH_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  key: oidc-client-secret
+                  name: wireguard
+            - name: OAUTH_OIDC_NAME
+              value: authentik
+            - name: OAUTH_OIDC_SERVER
+              value: https://auth.whyredfire.dev/application/o/wireguard-admin/
+            - name: OAUTH_PROVIDERS
+              value: oidc
           image: ghcr.io/wg-easy/wg-easy:15.4.0
           name: wg-easy
           ports:
-            - containerPort: 51820
+            - containerPort: 27299
               name: wireguard
               protocol: UDP
             - containerPort: 51821

apps/wireguard/httproute.yaml

@@ -14,23 +14,9 @@ spec:
       namespace: traefik
       sectionName: websecure
   rules:
-    - backendRefs:
-        - name: authentik-server
-          namespace: authentik
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /outpost.goauthentik.io
     - backendRefs:
         - name: wireguard-admin
           port: 51821
-      filters:
-        - extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: authentik
-          type: ExtensionRef
       matches:
         - path:
             type: PathPrefix

apps/wireguard/kustomization.yaml

@@ -1,9 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - sealed-secret.yaml
   - pvc.yaml
   - deployment.yaml
   - service.yaml
   - service-admin.yaml
-  - middleware.yaml
   - httproute.yaml

apps/wireguard/middleware.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: authentik
-  namespace: wireguard
-spec:
-  forwardAuth:
-    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-    trustForwardHeader: true

apps/wireguard/sealed-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: wireguard
+  namespace: wireguard
+spec:
+  encryptedData:
+    oidc-client-secret: AgB6atYW4UwwRNY+w7qjuDGY3HzgdvuS4yir22mjjAHzxOoKzy2bnsUZ4JAjco3/BWk42KGeoVmtgU7NDfGkcj5IJLSpDM/Xkq6jReVjMyfvuzuhhJH/goHVxlTg3bHmUJdgUjMyJlZ3pT6K6AQXSdLG8pbveTQQT7YKwiwtlm3R4fibpYSbKMmg3NK9COndlVR+j8nQmxyzyISA1ZapIpj7t1DobpdjKYnk9q8e64f4p6x4sd68Astz/hELNAfgAI/M/Ga0StmOG8Hj63XtIL8Z/IJUGcrHny1hESERIgLB0OiIa4HoWBHl2ioGUEdf9NMcldE3iyfZ0WRH+GrIUFLJdwJneg7VZvHsreaV4tV4Io4kBvKaAGWPJBx8AhAcSqoSeSSbakacyFhlk7tl4m7iFGvmYRlvyfGxERpqNZX/ebf8aR7sHFyPSzQ11EyJ+Nbk0sjns+7otPBkJC3hA66nKN8OtwbruvP124tgkMT1qD/xjpO6sA6BHM5mxBSFtYvfxN6nZvt/5BVPUgidS9vhM1vXovpENFIPs2AiWajHX1DDEMXM2QTgFyt2H9z2tnsZE1sTtuMw2s1iAK6D8YlReZ2IQXjQV4Gga9SbzBNykF5jidHLz+wUKvHhTQgPLF7Hl9v5T6qos2RrG3XmbmKEVLF3G2CLXv0cVwrutknoyCScXEFUn18RYL6aEN+JYt3CnO1L8DxVaoWK/YE2mHBV6v8iJg3JFOKQ/WxxKUKhrm5uJdvyX1p6fv1bxH8uOK676XXCcO2joWvGVWV1xbuY
+  template:
+    metadata:
+      name: wireguard
+      namespace: wireguard