refactor(authentik): Seperate blueprint for applications
This commit is contained in:
@@ -0,0 +1,52 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: blueprint-argocd
|
||||
namespace: authentik
|
||||
data:
|
||||
argocd.yaml: |
|
||||
version: 1
|
||||
metadata:
|
||||
name: ArgoCD
|
||||
entries:
|
||||
# Public client: the CLI can't keep a secret, so ArgoCD uses PKCE instead.
|
||||
- model: authentik_providers_oauth2.oauth2provider
|
||||
id: argocd-provider
|
||||
identifiers:
|
||||
name: argocd
|
||||
attrs:
|
||||
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
||||
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
||||
client_type: public
|
||||
client_id: argocd
|
||||
grant_types:
|
||||
- authorization_code
|
||||
- refresh_token
|
||||
redirect_uris:
|
||||
- matching_mode: strict
|
||||
url: https://argo.whyredfire.dev/auth/callback
|
||||
- matching_mode: strict
|
||||
url: https://argo.whyredfire.dev/pkce/verify
|
||||
- matching_mode: strict
|
||||
url: http://localhost:8085/auth/callback
|
||||
- matching_mode: strict
|
||||
url: argocd://auth/callback
|
||||
signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
|
||||
property_mappings:
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
|
||||
- model: authentik_core.application
|
||||
id: argocd
|
||||
identifiers:
|
||||
slug: argocd
|
||||
attrs:
|
||||
name: ArgoCD
|
||||
provider: !KeyOf argocd-provider
|
||||
meta_launch_url: https://argo.whyredfire.dev
|
||||
- model: authentik_policies.policybinding
|
||||
identifiers:
|
||||
order: 0
|
||||
target: !KeyOf argocd
|
||||
attrs:
|
||||
group: !Find [authentik_core.group, [name, admins]]
|
||||
@@ -0,0 +1,33 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: blueprint-garage-ui
|
||||
namespace: authentik
|
||||
data:
|
||||
garage-ui.yaml: |
|
||||
version: 1
|
||||
metadata:
|
||||
name: Garage UI
|
||||
entries:
|
||||
- model: authentik_providers_proxy.proxyprovider
|
||||
id: garage-ui-provider
|
||||
identifiers:
|
||||
name: garage-ui
|
||||
attrs:
|
||||
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
||||
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
||||
mode: forward_single
|
||||
external_host: https://garage.whyredfire.dev
|
||||
- model: authentik_core.application
|
||||
id: garage-ui
|
||||
identifiers:
|
||||
slug: garage-ui
|
||||
attrs:
|
||||
name: Garage UI
|
||||
provider: !KeyOf garage-ui-provider
|
||||
- model: authentik_policies.policybinding
|
||||
identifiers:
|
||||
order: 0
|
||||
target: !KeyOf garage-ui
|
||||
attrs:
|
||||
group: !Find [authentik_core.group, [name, admins]]
|
||||
@@ -0,0 +1,69 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: blueprint-google-login
|
||||
namespace: authentik
|
||||
data:
|
||||
google-login.yaml: |
|
||||
version: 1
|
||||
metadata:
|
||||
name: Google login
|
||||
entries:
|
||||
- model: authentik_blueprints.metaapplyblueprint
|
||||
attrs:
|
||||
identifiers:
|
||||
path: default/flow-default-source-authentication.yaml
|
||||
required: true
|
||||
- model: authentik_core.group
|
||||
id: admins
|
||||
identifiers:
|
||||
name: admins
|
||||
attrs:
|
||||
is_superuser: true
|
||||
- model: authentik_core.user
|
||||
identifiers:
|
||||
username: whyredfire
|
||||
attrs:
|
||||
email: [email protected]
|
||||
groups:
|
||||
- !KeyOf admins
|
||||
name: Karan Parashar
|
||||
- model: authentik_sources_oauth.oauthsource
|
||||
id: google
|
||||
identifiers:
|
||||
slug: google
|
||||
attrs:
|
||||
authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
|
||||
consumer_key: !Env GOOGLE_CLIENT_ID
|
||||
consumer_secret: !Env GOOGLE_CLIENT_SECRET
|
||||
name: Google
|
||||
promoted: true
|
||||
provider_type: google
|
||||
user_matching_mode: email_link
|
||||
- model: authentik_stages_identification.identificationstage
|
||||
id: google-identification
|
||||
identifiers:
|
||||
name: google-identification
|
||||
attrs:
|
||||
sources:
|
||||
- !KeyOf google
|
||||
user_fields: []
|
||||
- model: authentik_flows.flow
|
||||
id: google-flow
|
||||
identifiers:
|
||||
slug: google-login
|
||||
attrs:
|
||||
authentication: require_unauthenticated
|
||||
designation: authentication
|
||||
name: Google login
|
||||
title: Welcome!
|
||||
- model: authentik_flows.flowstagebinding
|
||||
identifiers:
|
||||
order: 10
|
||||
stage: !KeyOf google-identification
|
||||
target: !KeyOf google-flow
|
||||
- model: authentik_brands.brand
|
||||
identifiers:
|
||||
domain: authentik-default
|
||||
attrs:
|
||||
flow_authentication: !KeyOf google-flow
|
||||
@@ -0,0 +1,38 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: blueprint-grafana
|
||||
namespace: authentik
|
||||
data:
|
||||
grafana.yaml: |
|
||||
version: 1
|
||||
metadata:
|
||||
name: Grafana
|
||||
entries:
|
||||
- model: authentik_providers_oauth2.oauth2provider
|
||||
id: grafana-provider
|
||||
identifiers:
|
||||
name: grafana
|
||||
attrs:
|
||||
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
||||
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
||||
client_id: grafana
|
||||
client_secret: !Env GRAFANA_CLIENT_SECRET
|
||||
grant_types:
|
||||
- authorization_code
|
||||
- refresh_token
|
||||
redirect_uris:
|
||||
- matching_mode: strict
|
||||
url: https://grafana.whyredfire.dev/login/generic_oauth
|
||||
signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
|
||||
property_mappings:
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
|
||||
- model: authentik_core.application
|
||||
identifiers:
|
||||
slug: grafana
|
||||
attrs:
|
||||
name: Grafana
|
||||
provider: !KeyOf grafana-provider
|
||||
meta_launch_url: https://grafana.whyredfire.dev
|
||||
@@ -0,0 +1,29 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: blueprint-outpost
|
||||
namespace: authentik
|
||||
data:
|
||||
outpost.yaml: |
|
||||
version: 1
|
||||
metadata:
|
||||
name: Embedded outpost
|
||||
entries:
|
||||
- model: authentik_blueprints.metaapplyblueprint
|
||||
attrs:
|
||||
identifiers:
|
||||
path: mounted/cm-blueprint-garage-ui/garage-ui.yaml
|
||||
required: true
|
||||
- model: authentik_blueprints.metaapplyblueprint
|
||||
attrs:
|
||||
identifiers:
|
||||
path: mounted/cm-blueprint-qbittorrent/qbittorrent.yaml
|
||||
required: true
|
||||
# Serves forward auth for the apps behind the authentik middleware.
|
||||
- model: authentik_outposts.outpost
|
||||
identifiers:
|
||||
managed: goauthentik.io/outposts/embedded
|
||||
attrs:
|
||||
providers:
|
||||
- !Find [authentik_providers_proxy.proxyprovider, [name, garage-ui]]
|
||||
- !Find [authentik_providers_proxy.proxyprovider, [name, qbittorrent]]
|
||||
@@ -0,0 +1,33 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: blueprint-qbittorrent
|
||||
namespace: authentik
|
||||
data:
|
||||
qbittorrent.yaml: |
|
||||
version: 1
|
||||
metadata:
|
||||
name: qBittorrent
|
||||
entries:
|
||||
- model: authentik_providers_proxy.proxyprovider
|
||||
id: qbittorrent-provider
|
||||
identifiers:
|
||||
name: qbittorrent
|
||||
attrs:
|
||||
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
||||
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
||||
mode: forward_single
|
||||
external_host: https://qbit.whyredfire.dev
|
||||
- model: authentik_core.application
|
||||
id: qbittorrent
|
||||
identifiers:
|
||||
slug: qbittorrent
|
||||
attrs:
|
||||
name: qBittorrent
|
||||
provider: !KeyOf qbittorrent-provider
|
||||
- model: authentik_policies.policybinding
|
||||
identifiers:
|
||||
order: 0
|
||||
target: !KeyOf qbittorrent
|
||||
attrs:
|
||||
group: !Find [authentik_core.group, [name, admins]]
|
||||
@@ -0,0 +1,61 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: blueprint-wireguard-admin
|
||||
namespace: authentik
|
||||
data:
|
||||
wireguard-admin.yaml: |
|
||||
version: 1
|
||||
metadata:
|
||||
name: WireGuard admin
|
||||
entries:
|
||||
# wg-easy rejects logins unless email_verified is true; the default email
|
||||
# mapping always sends false.
|
||||
- model: authentik_providers_oauth2.scopemapping
|
||||
id: verified-email
|
||||
identifiers:
|
||||
name: wireguard-admin email
|
||||
attrs:
|
||||
scope_name: email
|
||||
expression: |
|
||||
return {
|
||||
"email": request.user.email,
|
||||
"email_verified": True,
|
||||
}
|
||||
- model: authentik_providers_oauth2.oauth2provider
|
||||
id: wireguard-admin-provider
|
||||
identifiers:
|
||||
name: wireguard-admin
|
||||
attrs:
|
||||
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
||||
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
||||
client_id: wireguard-admin
|
||||
client_secret: !Env WIREGUARD_CLIENT_SECRET
|
||||
grant_types:
|
||||
- authorization_code
|
||||
- refresh_token
|
||||
redirect_uris:
|
||||
- matching_mode: strict
|
||||
url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback
|
||||
- matching_mode: strict
|
||||
url: https://wg-admin.whyredfire.dev/api/auth/oidc/link
|
||||
signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
|
||||
property_mappings:
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
|
||||
- !KeyOf verified-email
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
|
||||
- model: authentik_core.application
|
||||
id: wireguard-admin
|
||||
identifiers:
|
||||
slug: wireguard-admin
|
||||
attrs:
|
||||
name: WireGuard Admin
|
||||
provider: !KeyOf wireguard-admin-provider
|
||||
meta_launch_url: https://wg-admin.whyredfire.dev
|
||||
# wg-easy makes every user it registers an admin, so only admins may log in.
|
||||
- model: authentik_policies.policybinding
|
||||
identifiers:
|
||||
order: 0
|
||||
target: !KeyOf wireguard-admin
|
||||
attrs:
|
||||
group: !Find [authentik_core.group, [name, admins]]
|
||||
@@ -1,156 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: authentik-blueprints
|
||||
namespace: authentik
|
||||
data:
|
||||
google-login.yaml: |
|
||||
version: 1
|
||||
metadata:
|
||||
name: Google login
|
||||
entries:
|
||||
- model: authentik_blueprints.metaapplyblueprint
|
||||
attrs:
|
||||
identifiers:
|
||||
path: default/flow-default-source-authentication.yaml
|
||||
required: true
|
||||
- model: authentik_core.group
|
||||
id: admins
|
||||
identifiers:
|
||||
name: admins
|
||||
attrs:
|
||||
is_superuser: true
|
||||
- model: authentik_core.user
|
||||
identifiers:
|
||||
username: whyredfire
|
||||
attrs:
|
||||
email: [email protected]
|
||||
groups:
|
||||
- !KeyOf admins
|
||||
name: Karan Parashar
|
||||
- model: authentik_sources_oauth.oauthsource
|
||||
id: google
|
||||
identifiers:
|
||||
slug: google
|
||||
attrs:
|
||||
authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
|
||||
consumer_key: !Env GOOGLE_CLIENT_ID
|
||||
consumer_secret: !Env GOOGLE_CLIENT_SECRET
|
||||
name: Google
|
||||
promoted: true
|
||||
provider_type: google
|
||||
user_matching_mode: email_link
|
||||
- model: authentik_stages_identification.identificationstage
|
||||
id: google-identification
|
||||
identifiers:
|
||||
name: google-identification
|
||||
attrs:
|
||||
sources:
|
||||
- !KeyOf google
|
||||
user_fields: []
|
||||
- model: authentik_flows.flow
|
||||
id: google-flow
|
||||
identifiers:
|
||||
slug: google-login
|
||||
attrs:
|
||||
authentication: require_unauthenticated
|
||||
designation: authentication
|
||||
name: Google login
|
||||
title: Welcome!
|
||||
- model: authentik_flows.flowstagebinding
|
||||
identifiers:
|
||||
order: 10
|
||||
stage: !KeyOf google-identification
|
||||
target: !KeyOf google-flow
|
||||
- model: authentik_brands.brand
|
||||
identifiers:
|
||||
domain: authentik-default
|
||||
attrs:
|
||||
flow_authentication: !KeyOf google-flow
|
||||
grafana.yaml: |
|
||||
version: 1
|
||||
metadata:
|
||||
name: Grafana
|
||||
entries:
|
||||
- model: authentik_providers_oauth2.oauth2provider
|
||||
id: grafana-provider
|
||||
identifiers:
|
||||
name: grafana
|
||||
attrs:
|
||||
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
||||
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
||||
client_id: grafana
|
||||
client_secret: !Env GRAFANA_CLIENT_SECRET
|
||||
grant_types:
|
||||
- authorization_code
|
||||
- refresh_token
|
||||
redirect_uris:
|
||||
- matching_mode: strict
|
||||
url: https://grafana.whyredfire.dev/login/generic_oauth
|
||||
signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
|
||||
property_mappings:
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
|
||||
- model: authentik_core.application
|
||||
identifiers:
|
||||
slug: grafana
|
||||
attrs:
|
||||
name: Grafana
|
||||
provider: !KeyOf grafana-provider
|
||||
meta_launch_url: https://grafana.whyredfire.dev
|
||||
wireguard-admin.yaml: |
|
||||
version: 1
|
||||
metadata:
|
||||
name: WireGuard admin
|
||||
entries:
|
||||
# wg-easy rejects logins unless email_verified is true; the default email
|
||||
# mapping always sends false.
|
||||
- model: authentik_providers_oauth2.scopemapping
|
||||
id: verified-email
|
||||
identifiers:
|
||||
name: wireguard-admin email
|
||||
attrs:
|
||||
scope_name: email
|
||||
expression: |
|
||||
return {
|
||||
"email": request.user.email,
|
||||
"email_verified": True,
|
||||
}
|
||||
- model: authentik_providers_oauth2.oauth2provider
|
||||
id: wireguard-admin-provider
|
||||
identifiers:
|
||||
name: wireguard-admin
|
||||
attrs:
|
||||
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
||||
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
||||
client_id: wireguard-admin
|
||||
client_secret: !Env WIREGUARD_CLIENT_SECRET
|
||||
grant_types:
|
||||
- authorization_code
|
||||
- refresh_token
|
||||
redirect_uris:
|
||||
- matching_mode: strict
|
||||
url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback
|
||||
- matching_mode: strict
|
||||
url: https://wg-admin.whyredfire.dev/api/auth/oidc/link
|
||||
signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
|
||||
property_mappings:
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
|
||||
- !KeyOf verified-email
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
|
||||
- model: authentik_core.application
|
||||
id: wireguard-admin
|
||||
identifiers:
|
||||
slug: wireguard-admin
|
||||
attrs:
|
||||
name: WireGuard Admin
|
||||
provider: !KeyOf wireguard-admin-provider
|
||||
meta_launch_url: https://wg-admin.whyredfire.dev
|
||||
# wg-easy makes every user it registers an admin, so only admins may log in.
|
||||
- model: authentik_policies.policybinding
|
||||
identifiers:
|
||||
order: 0
|
||||
target: !KeyOf wireguard-admin
|
||||
attrs:
|
||||
group: !Find [authentik_core.group, [name, admins]]
|
||||
@@ -2,6 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- sealed-secret.yaml
|
||||
- blueprints.yaml
|
||||
- blueprint-argocd.yaml
|
||||
- blueprint-garage-ui.yaml
|
||||
- blueprint-google-login.yaml
|
||||
- blueprint-grafana.yaml
|
||||
- blueprint-outpost.yaml
|
||||
- blueprint-qbittorrent.yaml
|
||||
- blueprint-wireguard-admin.yaml
|
||||
- httproute.yaml
|
||||
- referencegrant.yaml
|
||||
|
||||
Reference in New Issue
Block a user