diff --git a/add-ons/authentik/blueprint-argocd.yaml b/add-ons/authentik/blueprint-argocd.yaml new file mode 100644 index 0000000..ffe7ed1 --- /dev/null +++ b/add-ons/authentik/blueprint-argocd.yaml @@ -0,0 +1,52 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: blueprint-argocd + namespace: authentik +data: + argocd.yaml: | + version: 1 + metadata: + name: ArgoCD + entries: + # Public client: the CLI can't keep a secret, so ArgoCD uses PKCE instead. + - model: authentik_providers_oauth2.oauth2provider + id: argocd-provider + identifiers: + name: argocd + attrs: + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + client_type: public + client_id: argocd + grant_types: + - authorization_code + - refresh_token + redirect_uris: + - matching_mode: strict + url: https://argo.whyredfire.dev/auth/callback + - matching_mode: strict + url: https://argo.whyredfire.dev/pkce/verify + - matching_mode: strict + url: http://localhost:8085/auth/callback + - matching_mode: strict + url: argocd://auth/callback + signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]] + property_mappings: + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]] + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]] + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]] + - model: authentik_core.application + id: argocd + identifiers: + slug: argocd + attrs: + name: ArgoCD + provider: !KeyOf argocd-provider + meta_launch_url: https://argo.whyredfire.dev + - model: authentik_policies.policybinding + identifiers: + order: 0 + target: !KeyOf argocd + attrs: + group: !Find [authentik_core.group, [name, admins]] diff --git a/add-ons/authentik/blueprint-garage-ui.yaml b/add-ons/authentik/blueprint-garage-ui.yaml new file mode 100644 index 0000000..299e57b --- /dev/null +++ b/add-ons/authentik/blueprint-garage-ui.yaml @@ -0,0 +1,33 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: blueprint-garage-ui + namespace: authentik +data: + garage-ui.yaml: | + version: 1 + metadata: + name: Garage UI + entries: + - model: authentik_providers_proxy.proxyprovider + id: garage-ui-provider + identifiers: + name: garage-ui + attrs: + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + mode: forward_single + external_host: https://garage.whyredfire.dev + - model: authentik_core.application + id: garage-ui + identifiers: + slug: garage-ui + attrs: + name: Garage UI + provider: !KeyOf garage-ui-provider + - model: authentik_policies.policybinding + identifiers: + order: 0 + target: !KeyOf garage-ui + attrs: + group: !Find [authentik_core.group, [name, admins]] diff --git a/add-ons/authentik/blueprint-google-login.yaml b/add-ons/authentik/blueprint-google-login.yaml new file mode 100644 index 0000000..4029643 --- /dev/null +++ b/add-ons/authentik/blueprint-google-login.yaml @@ -0,0 +1,69 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: blueprint-google-login + namespace: authentik +data: + google-login.yaml: | + version: 1 + metadata: + name: Google login + entries: + - model: authentik_blueprints.metaapplyblueprint + attrs: + identifiers: + path: default/flow-default-source-authentication.yaml + required: true + - model: authentik_core.group + id: admins + identifiers: + name: admins + attrs: + is_superuser: true + - model: authentik_core.user + identifiers: + username: whyredfire + attrs: + email: whyredfire@gmail.com + groups: + - !KeyOf admins + name: Karan Parashar + - model: authentik_sources_oauth.oauthsource + id: google + identifiers: + slug: google + attrs: + authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]] + consumer_key: !Env GOOGLE_CLIENT_ID + consumer_secret: !Env GOOGLE_CLIENT_SECRET + name: Google + promoted: true + provider_type: google + user_matching_mode: email_link + - model: authentik_stages_identification.identificationstage + id: google-identification + identifiers: + name: google-identification + attrs: + sources: + - !KeyOf google + user_fields: [] + - model: authentik_flows.flow + id: google-flow + identifiers: + slug: google-login + attrs: + authentication: require_unauthenticated + designation: authentication + name: Google login + title: Welcome! + - model: authentik_flows.flowstagebinding + identifiers: + order: 10 + stage: !KeyOf google-identification + target: !KeyOf google-flow + - model: authentik_brands.brand + identifiers: + domain: authentik-default + attrs: + flow_authentication: !KeyOf google-flow diff --git a/add-ons/authentik/blueprint-grafana.yaml b/add-ons/authentik/blueprint-grafana.yaml new file mode 100644 index 0000000..ea14675 --- /dev/null +++ b/add-ons/authentik/blueprint-grafana.yaml @@ -0,0 +1,38 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: blueprint-grafana + namespace: authentik +data: + grafana.yaml: | + version: 1 + metadata: + name: Grafana + entries: + - model: authentik_providers_oauth2.oauth2provider + id: grafana-provider + identifiers: + name: grafana + attrs: + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + client_id: grafana + client_secret: !Env GRAFANA_CLIENT_SECRET + grant_types: + - authorization_code + - refresh_token + redirect_uris: + - matching_mode: strict + url: https://grafana.whyredfire.dev/login/generic_oauth + signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]] + property_mappings: + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]] + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]] + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]] + - model: authentik_core.application + identifiers: + slug: grafana + attrs: + name: Grafana + provider: !KeyOf grafana-provider + meta_launch_url: https://grafana.whyredfire.dev diff --git a/add-ons/authentik/blueprint-outpost.yaml b/add-ons/authentik/blueprint-outpost.yaml new file mode 100644 index 0000000..2b4fe8e --- /dev/null +++ b/add-ons/authentik/blueprint-outpost.yaml @@ -0,0 +1,29 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: blueprint-outpost + namespace: authentik +data: + outpost.yaml: | + version: 1 + metadata: + name: Embedded outpost + entries: + - model: authentik_blueprints.metaapplyblueprint + attrs: + identifiers: + path: mounted/cm-blueprint-garage-ui/garage-ui.yaml + required: true + - model: authentik_blueprints.metaapplyblueprint + attrs: + identifiers: + path: mounted/cm-blueprint-qbittorrent/qbittorrent.yaml + required: true + # Serves forward auth for the apps behind the authentik middleware. + - model: authentik_outposts.outpost + identifiers: + managed: goauthentik.io/outposts/embedded + attrs: + providers: + - !Find [authentik_providers_proxy.proxyprovider, [name, garage-ui]] + - !Find [authentik_providers_proxy.proxyprovider, [name, qbittorrent]] diff --git a/add-ons/authentik/blueprint-qbittorrent.yaml b/add-ons/authentik/blueprint-qbittorrent.yaml new file mode 100644 index 0000000..abdf814 --- /dev/null +++ b/add-ons/authentik/blueprint-qbittorrent.yaml @@ -0,0 +1,33 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: blueprint-qbittorrent + namespace: authentik +data: + qbittorrent.yaml: | + version: 1 + metadata: + name: qBittorrent + entries: + - model: authentik_providers_proxy.proxyprovider + id: qbittorrent-provider + identifiers: + name: qbittorrent + attrs: + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + mode: forward_single + external_host: https://qbit.whyredfire.dev + - model: authentik_core.application + id: qbittorrent + identifiers: + slug: qbittorrent + attrs: + name: qBittorrent + provider: !KeyOf qbittorrent-provider + - model: authentik_policies.policybinding + identifiers: + order: 0 + target: !KeyOf qbittorrent + attrs: + group: !Find [authentik_core.group, [name, admins]] diff --git a/add-ons/authentik/blueprint-wireguard-admin.yaml b/add-ons/authentik/blueprint-wireguard-admin.yaml new file mode 100644 index 0000000..acbab2b --- /dev/null +++ b/add-ons/authentik/blueprint-wireguard-admin.yaml @@ -0,0 +1,61 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: blueprint-wireguard-admin + namespace: authentik +data: + wireguard-admin.yaml: | + version: 1 + metadata: + name: WireGuard admin + entries: + # wg-easy rejects logins unless email_verified is true; the default email + # mapping always sends false. + - model: authentik_providers_oauth2.scopemapping + id: verified-email + identifiers: + name: wireguard-admin email + attrs: + scope_name: email + expression: | + return { + "email": request.user.email, + "email_verified": True, + } + - model: authentik_providers_oauth2.oauth2provider + id: wireguard-admin-provider + identifiers: + name: wireguard-admin + attrs: + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + client_id: wireguard-admin + client_secret: !Env WIREGUARD_CLIENT_SECRET + grant_types: + - authorization_code + - refresh_token + redirect_uris: + - matching_mode: strict + url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback + - matching_mode: strict + url: https://wg-admin.whyredfire.dev/api/auth/oidc/link + signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]] + property_mappings: + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]] + - !KeyOf verified-email + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]] + - model: authentik_core.application + id: wireguard-admin + identifiers: + slug: wireguard-admin + attrs: + name: WireGuard Admin + provider: !KeyOf wireguard-admin-provider + meta_launch_url: https://wg-admin.whyredfire.dev + # wg-easy makes every user it registers an admin, so only admins may log in. + - model: authentik_policies.policybinding + identifiers: + order: 0 + target: !KeyOf wireguard-admin + attrs: + group: !Find [authentik_core.group, [name, admins]] diff --git a/add-ons/authentik/blueprints.yaml b/add-ons/authentik/blueprints.yaml deleted file mode 100644 index c6261b5..0000000 --- a/add-ons/authentik/blueprints.yaml +++ /dev/null @@ -1,156 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: authentik-blueprints - namespace: authentik -data: - google-login.yaml: | - version: 1 - metadata: - name: Google login - entries: - - model: authentik_blueprints.metaapplyblueprint - attrs: - identifiers: - path: default/flow-default-source-authentication.yaml - required: true - - model: authentik_core.group - id: admins - identifiers: - name: admins - attrs: - is_superuser: true - - model: authentik_core.user - identifiers: - username: whyredfire - attrs: - email: whyredfire@gmail.com - groups: - - !KeyOf admins - name: Karan Parashar - - model: authentik_sources_oauth.oauthsource - id: google - identifiers: - slug: google - attrs: - authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]] - consumer_key: !Env GOOGLE_CLIENT_ID - consumer_secret: !Env GOOGLE_CLIENT_SECRET - name: Google - promoted: true - provider_type: google - user_matching_mode: email_link - - model: authentik_stages_identification.identificationstage - id: google-identification - identifiers: - name: google-identification - attrs: - sources: - - !KeyOf google - user_fields: [] - - model: authentik_flows.flow - id: google-flow - identifiers: - slug: google-login - attrs: - authentication: require_unauthenticated - designation: authentication - name: Google login - title: Welcome! - - model: authentik_flows.flowstagebinding - identifiers: - order: 10 - stage: !KeyOf google-identification - target: !KeyOf google-flow - - model: authentik_brands.brand - identifiers: - domain: authentik-default - attrs: - flow_authentication: !KeyOf google-flow - grafana.yaml: | - version: 1 - metadata: - name: Grafana - entries: - - model: authentik_providers_oauth2.oauth2provider - id: grafana-provider - identifiers: - name: grafana - attrs: - authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] - invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] - client_id: grafana - client_secret: !Env GRAFANA_CLIENT_SECRET - grant_types: - - authorization_code - - refresh_token - redirect_uris: - - matching_mode: strict - url: https://grafana.whyredfire.dev/login/generic_oauth - signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]] - property_mappings: - - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]] - - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]] - - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]] - - model: authentik_core.application - identifiers: - slug: grafana - attrs: - name: Grafana - provider: !KeyOf grafana-provider - meta_launch_url: https://grafana.whyredfire.dev - wireguard-admin.yaml: | - version: 1 - metadata: - name: WireGuard admin - entries: - # wg-easy rejects logins unless email_verified is true; the default email - # mapping always sends false. - - model: authentik_providers_oauth2.scopemapping - id: verified-email - identifiers: - name: wireguard-admin email - attrs: - scope_name: email - expression: | - return { - "email": request.user.email, - "email_verified": True, - } - - model: authentik_providers_oauth2.oauth2provider - id: wireguard-admin-provider - identifiers: - name: wireguard-admin - attrs: - authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] - invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] - client_id: wireguard-admin - client_secret: !Env WIREGUARD_CLIENT_SECRET - grant_types: - - authorization_code - - refresh_token - redirect_uris: - - matching_mode: strict - url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback - - matching_mode: strict - url: https://wg-admin.whyredfire.dev/api/auth/oidc/link - signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]] - property_mappings: - - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]] - - !KeyOf verified-email - - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]] - - model: authentik_core.application - id: wireguard-admin - identifiers: - slug: wireguard-admin - attrs: - name: WireGuard Admin - provider: !KeyOf wireguard-admin-provider - meta_launch_url: https://wg-admin.whyredfire.dev - # wg-easy makes every user it registers an admin, so only admins may log in. - - model: authentik_policies.policybinding - identifiers: - order: 0 - target: !KeyOf wireguard-admin - attrs: - group: !Find [authentik_core.group, [name, admins]] diff --git a/add-ons/authentik/kustomization.yaml b/add-ons/authentik/kustomization.yaml index 4aa473b..815a35d 100644 --- a/add-ons/authentik/kustomization.yaml +++ b/add-ons/authentik/kustomization.yaml @@ -2,6 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - sealed-secret.yaml - - blueprints.yaml + - blueprint-argocd.yaml + - blueprint-garage-ui.yaml + - blueprint-google-login.yaml + - blueprint-grafana.yaml + - blueprint-outpost.yaml + - blueprint-qbittorrent.yaml + - blueprint-wireguard-admin.yaml - httproute.yaml - referencegrant.yaml diff --git a/argocd-apps/add-ons/authentik.yaml b/argocd-apps/add-ons/authentik.yaml index 1d9b0fc..e3da936 100644 --- a/argocd-apps/add-ons/authentik.yaml +++ b/argocd-apps/add-ons/authentik.yaml @@ -27,7 +27,13 @@ spec: name: authentik-secrets blueprints: configMaps: - - authentik-blueprints + - blueprint-argocd + - blueprint-garage-ui + - blueprint-google-login + - blueprint-grafana + - blueprint-outpost + - blueprint-qbittorrent + - blueprint-wireguard-admin server: resources: limits: