feat(apps): Log in to wg-easy with authentik OIDC

add-ons/authentik/blueprints.yaml

@@ -104,15 +104,41 @@ data:
     metadata:
       name: WireGuard admin
     entries:
-      - model: authentik_providers_proxy.proxyprovider
+      # wg-easy rejects logins unless email_verified is true; the default email
+      # mapping always sends false.
+      - model: authentik_providers_oauth2.scopemapping
+        id: verified-email
+        identifiers:
+          name: wireguard-admin email
+        attrs:
+          scope_name: email
+          expression: |
+            return {
+                "email": request.user.email,
+                "email_verified": True,
+            }
+      - model: authentik_providers_oauth2.oauth2provider
         id: wireguard-admin-provider
         identifiers:
           name: wireguard-admin
         attrs:
           authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
           invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          external_host: https://wg-admin.whyredfire.dev
+          client_id: wireguard-admin
-          mode: forward_single
+          client_secret: !Env WIREGUARD_CLIENT_SECRET
+          grant_types:
+            - authorization_code
+            - refresh_token
+          redirect_uris:
+            - matching_mode: strict
+              url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback
+            - matching_mode: strict
+              url: https://wg-admin.whyredfire.dev/api/auth/oidc/link
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !KeyOf verified-email
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
       - model: authentik_core.application
         id: wireguard-admin
         identifiers:
@@ -121,20 +147,10 @@ data:
           name: WireGuard Admin
           provider: !KeyOf wireguard-admin-provider
           meta_launch_url: https://wg-admin.whyredfire.dev
-      # Issuing VPN clients is admin-only.
+      # wg-easy makes every user it registers an admin, so only admins may log in.
       - model: authentik_policies.policybinding
         identifiers:
           order: 0
           target: !KeyOf wireguard-admin
         attrs:
           group: !Find [authentik_core.group, [name, admins]]
-      # This replaces the embedded outpost's provider list, so it also names the
-      # providers created in the UI.
-      - model: authentik_outposts.outpost
-        identifiers:
-          managed: goauthentik.io/outposts/embedded
-        attrs:
-          providers:
-            - !Find [authentik_providers_proxy.proxyprovider, [name, garage-ui]]
-            - !Find [authentik_providers_proxy.proxyprovider, [name, qbittorrent]]
-            - !KeyOf wireguard-admin-provider

add-ons/authentik/referencegrant.yaml

@@ -11,9 +11,6 @@ spec:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
       namespace: qbit
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: wireguard
   to:
     - group: ""
       kind: Service

add-ons/authentik/sealed-secret.yaml

@@ -12,6 +12,7 @@ spec:
     GOOGLE_CLIENT_ID: AgCV2Rwe/bHbkQ3nkkIs4EFTbsEqQWRaWlXa/fHzkDyNKpd0CTOgqVb6Rd2KYyvoT9iDR0xt/8reLPd9e7B3G3V1oVFV7G1XiErBmzvxr6591+tXzo8JLVpIy0363R87idi2xIKGVii+G5aJvxxhua8IRsNfi4SRtoqpDzjgNbFtm5UDhhlCzcRKkm0zHgLw83d4Uwszu9X9II2A4FuMPD6KvsTFrgHevR1v3OerKl5kvTlUx0O3XEg5mnNUVk46J+D9wfg58bIlgUhMV8NtfKa8I5zmRKhCJySks1zlCgIudCLX7wPYupFgt0nrZjJGx7a546ntPdMVE4IJ+VhlQ94gjdWsVFm07espaQLph9T4CZDKxb6TwyNswhfFxH1Z9auyFf3Cfk2wx5GChNOL0mZ8Zrzcw008c8IUShF8je8JZ60teBffbBNao7XN6JM6a4ac5aKnNwFch9IJUU1qkvcJaZk5hAkeGO9uHrICb6lkr5Rj7t4h9l4mvgfIKXP5YCCKZ+yqrSI8Jpkch/cB0Sphgp7m7QXgGwmWRgdKEk1rP7ioIfoF66mLsfgvOkc+1ySvPgW/rCLbHwzMqJn1Fkk/afbRoWp/guFj1cOY9MrEQIn8ftugeV/0xWiL+y5RyJm7QZc1z5fSj/NTrVCZV0LhBHttPZzoGGWEqjLYQnyJ8p38lK7EU6Pmk4WrEMj7mmdYHEijyPhab+b7guOc+ULbPT7k7sBHXbKrTTUJa09jIqSS4jl2PNrzPCPDIvRpG/cMgNklhNPfvpDQcLdVRA7bsf7navZvDsQ=
     GOOGLE_CLIENT_SECRET: AgDNFpqV5LGekTMvOBtPE9c6ZVPtT6wN+nCFRhZnvBKIz4I7U9jzisEN7yhc4ud22XJXpS5oR8hN4H+V6Js/bCZMDJefYcdstmHku14kUvoLRUtwPV9tdjiihmb57VLTnT1s1OzbnOqZPwXoCAmGAPLDgZrghBi0id21GgjU41jCHDJCcH1j9RHhE20JwsVG2uz9Tcp6MVYh94aq53V4//bvFXz4xQgVlN8c1jJ/W4rrNM9vmYdMwKyB5509oVWJigowsRlji0FXurR8ovz1AXpMuGj6hUGxLp0uHsqz7FV/0lsd4B2BR9cVRChAR8zDCiiKb4TH2Kmn676/Z+gtJ8vcOQg/WDT1ENzOr6dyndCLVxJvJuvl1EqinzhSqJjUy11HxqULApKKbX1iRJIAIGb6dpeKVoHDKg5xtcWGwaD6epG/tz20agkWBMCFNq5aS80npz28W5GeOQ8aF4X/rpjuEHVLrN+n0pgyS4wjwniB6UJMYRIYk45r0ICUtqyFjOiNzpU70NsPmEjDyItW1EVo+6tb0lRmOI5apm/9yayZXjFISwTAFPdBMrQL+ij4AGw4HMWMmN0aqDO+Kd1c9Jg6wUKluN2Lb6CaxehWeSJiz2wTEhEz8KBkInfezgSekNkw4wjJiBEZ4/M3G6Y/C61ekuVFarRc87cY+S3SomVZDGQcPysfQlieMVpHlfXq/CSDgHhZV3Q+S/wqpy5ZcfsyaU+v4PmvyEc12MZxQ1RGngVJow==
     GRAFANA_CLIENT_SECRET: AgBSE0QjGwtnyAjO/cy/TBKg+fuyKMSRgeQM/i7tPi9QcLpDjEHquGKmdBHUaeSaon3LRH3CPYQJ61T4d4xsp7EXzCM47MhO/rJ+6Xx+dGiIg071Ijj1qOBYszMNPXLZCst/9EfDEBRXQYmtr8X5UfcyXv8RHewvuqxcwy8qzsPsP5G/CpchGWlZRV3x+R+yCjVmTP7VuatPAltvGuAHsAv3Gh1aEXMJ1F3SsW/SP025V/bMiz1wKWe7/bkqJnXjLkNXWI/lpwzYWQl4/9v1Oiiw+1osH6fHNzXM6RA0ei1/FmlRwS9EqnUnl9hGE76GSllhwU9L6K9boJrKRnZIP6xBOJfrqimZciutTfiu6urghyimVACafQLWkeEB8m/zX1CSxVQ5M95n/dtdlBsWofMVyEtoeTip1HXZF1iee4yMv2yEg8yNSWmnb87fSYIMwpMiv5dYQTLg2WslnEe0DxcnyH+O0/MsmWHFz2f/Z4J6h+kWwMEv1pt8l+xkgbUthGGDx+HIcU9SZ/jyZjnzTt4i4BIbejAoXzMmm6q4zE0BD+9AbAQvEDOg6DW1TIu2mupoKVlqYljNE/9zVOAIBcFL0cJ4HNnW13+ufS4KoptZE3Rfv1tpU6g2MZ4y+QBCOczd+5HgXMtv3P9OweZg/l/LRdbFyH3OZviW/4suJFNbWZNgGUlqT/xyk/C5rn7uGSjSinp0lwkAqfxx7To/KP0jE7hJkVOH1vh+7COpFABJEx/cLAXAaIaVJsio38p5i4s+SMEq85Ew3uI46YKD8ljY7AQN3k66U7xQkLgjAT170Q==
+    WIREGUARD_CLIENT_SECRET: AgA4hqEjY0IfLpOpi02zj8hyNd+LCYtcmrRkumSR/8hGcccu6o3NJymoIrp32SbXG8triVM6EK16jVioT5Lgt/fCvNp5bWH78TSgzrSGsf8scK0DHTearXpEzk6XLL8OVORLloQRYIejS3QZo17eohAuZ8Mg0XZHTtfO1oJ5lHubu7y6WPKLnQEbNee+PKYpcRbMf+4b3eaRsEGtddneiZ+oowd1j308AwMxBDXN5NCJQepAZrCJp8csIgmkIEk6vSThKHikpkeO2xXmfmurKzJdEqSKoZOgBX6zSV3AycPHOocD49ZVw143J7Q5TqotznCpCxu2R4ogoA6zNPTuXBoEF6zRVDlNoTnh53cWhOWS7DApNMvnM/clWNdE4AdvXj5YpKgp8jgshQrLJMDd1IoenqBl1QdrptA5QVxRsTg/lkwXd8MQSRnB/sqGzQAB2Z/rrCvOBk21M7qJFoJUoLYXMpQY1I7qcJ9ydcGER4sRwdfWs/33C4vq9nw1gMtPFc/+VFpDagLeJ0/y82oQ4Ip1mMz7uTAZTXFFWT04byq7QV5WdwHaIAwJWNGRIi9GG/NvPLZUoJpgX0BQA7Ve0p/f38m48gaq53a/ynRwUF+a6+d2zeA8xjadqdXEIt1SY5LwMLW8mLhVxSfTbJJ/pGw8lJaJ1dtDw9NIm5Jl0ask6ndE30xOs581olJNb/7RshfB5Fczf+hdBlkKyhmQXHukRcZRI/muSDkjgVRteORGZfcr3vPEgstonEE/9SfuuKsGlVFQLw5272qKZVd4RF4f
   template:
     metadata:
       name: authentik-secrets

apps/wireguard/deployment.yaml

@@ -23,6 +23,10 @@ spec:
               for b in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do
                 ln -sf xtables-nft-multi "/usr/sbin/$b"
               done
+              # Only used to skip the first-run setup; password login is
+              # disabled in favour of authentik.
+              INIT_PASSWORD="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+              export INIT_PASSWORD
               exec /usr/bin/dumb-init node server/index.mjs
           command:
             - /bin/sh
@@ -30,16 +34,41 @@ spec:
           env:
             - name: DISABLE_IPV6
               value: "true"
-            - name: INIT_ENABLED
+            - name: DISABLE_PASSWORD_AUTH
               value: "true"
             - name: INIT_ALLOWED_IPS
               value: 192.168.2.0/24
             - name: INIT_DNS
               value: 192.168.2.1
+            - name: INIT_ENABLED
+              value: "true"
+            - name: INIT_HOST
+              value: wg.whyredfire.dev
+            - name: INIT_PORT
+              value: "27299"
+            - name: INIT_USERNAME
+              value: admin
+            - name: OAUTH_AUTO_LAUNCH
+              value: oidc
+            - name: OAUTH_AUTO_REGISTER
+              value: "true"
+            - name: OAUTH_OIDC_CLIENT_ID
+              value: wireguard-admin
+            - name: OAUTH_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  key: oidc-client-secret
+                  name: wireguard
+            - name: OAUTH_OIDC_NAME
+              value: authentik
+            - name: OAUTH_OIDC_SERVER
+              value: https://auth.whyredfire.dev/application/o/wireguard-admin/
+            - name: OAUTH_PROVIDERS
+              value: oidc
           image: ghcr.io/wg-easy/wg-easy:15.4.0
           name: wg-easy
           ports:
-            - containerPort: 51820
+            - containerPort: 27299
               name: wireguard
               protocol: UDP
             - containerPort: 51821

apps/wireguard/httproute.yaml

@@ -14,23 +14,9 @@ spec:
       namespace: traefik
       sectionName: websecure
   rules:
-    - backendRefs:
-        - name: authentik-server
-          namespace: authentik
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /outpost.goauthentik.io
     - backendRefs:
         - name: wireguard-admin
           port: 51821
-      filters:
-        - extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: authentik
-          type: ExtensionRef
       matches:
         - path:
             type: PathPrefix

apps/wireguard/kustomization.yaml

@@ -1,9 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - sealed-secret.yaml
   - pvc.yaml
   - deployment.yaml
   - service.yaml
   - service-admin.yaml
-  - middleware.yaml
   - httproute.yaml

apps/wireguard/middleware.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: authentik
-  namespace: wireguard
-spec:
-  forwardAuth:
-    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-    trustForwardHeader: true

apps/wireguard/sealed-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: wireguard
+  namespace: wireguard
+spec:
+  encryptedData:
+    oidc-client-secret: AgB6atYW4UwwRNY+w7qjuDGY3HzgdvuS4yir22mjjAHzxOoKzy2bnsUZ4JAjco3/BWk42KGeoVmtgU7NDfGkcj5IJLSpDM/Xkq6jReVjMyfvuzuhhJH/goHVxlTg3bHmUJdgUjMyJlZ3pT6K6AQXSdLG8pbveTQQT7YKwiwtlm3R4fibpYSbKMmg3NK9COndlVR+j8nQmxyzyISA1ZapIpj7t1DobpdjKYnk9q8e64f4p6x4sd68Astz/hELNAfgAI/M/Ga0StmOG8Hj63XtIL8Z/IJUGcrHny1hESERIgLB0OiIa4HoWBHl2ioGUEdf9NMcldE3iyfZ0WRH+GrIUFLJdwJneg7VZvHsreaV4tV4Io4kBvKaAGWPJBx8AhAcSqoSeSSbakacyFhlk7tl4m7iFGvmYRlvyfGxERpqNZX/ebf8aR7sHFyPSzQ11EyJ+Nbk0sjns+7otPBkJC3hA66nKN8OtwbruvP124tgkMT1qD/xjpO6sA6BHM5mxBSFtYvfxN6nZvt/5BVPUgidS9vhM1vXovpENFIPs2AiWajHX1DDEMXM2QTgFyt2H9z2tnsZE1sTtuMw2s1iAK6D8YlReZ2IQXjQV4Gga9SbzBNykF5jidHLz+wUKvHhTQgPLF7Hl9v5T6qos2RrG3XmbmKEVLF3G2CLXv0cVwrutknoyCScXEFUn18RYL6aEN+JYt3CnO1L8DxVaoWK/YE2mHBV6v8iJg3JFOKQ/WxxKUKhrm5uJdvyX1p6fv1bxH8uOK676XXCcO2joWvGVWV1xbuY
+  template:
+    metadata:
+      name: wireguard
+      namespace: wireguard