refactor(authentik): Seperate blueprint for applications

add-ons/authentik/blueprint-argocd.yaml

@@ -0,0 +1,52 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-argocd
+  namespace: authentik
+data:
+  argocd.yaml: |
+    version: 1
+    metadata:
+      name: ArgoCD
+    entries:
+      # Public client: the CLI can't keep a secret, so ArgoCD uses PKCE instead.
+      - model: authentik_providers_oauth2.oauth2provider
+        id: argocd-provider
+        identifiers:
+          name: argocd
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: public
+          client_id: argocd
+          grant_types:
+            - authorization_code
+            - refresh_token
+          redirect_uris:
+            - matching_mode: strict
+              url: https://argo.whyredfire.dev/auth/callback
+            - matching_mode: strict
+              url: https://argo.whyredfire.dev/pkce/verify
+            - matching_mode: strict
+              url: http://localhost:8085/auth/callback
+            - matching_mode: strict
+              url: argocd://auth/callback
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+      - model: authentik_core.application
+        id: argocd
+        identifiers:
+          slug: argocd
+        attrs:
+          name: ArgoCD
+          provider: !KeyOf argocd-provider
+          meta_launch_url: https://argo.whyredfire.dev
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf argocd
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-garage-ui.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-garage-ui
+  namespace: authentik
+data:
+  garage-ui.yaml: |
+    version: 1
+    metadata:
+      name: Garage UI
+    entries:
+      - model: authentik_providers_proxy.proxyprovider
+        id: garage-ui-provider
+        identifiers:
+          name: garage-ui
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: forward_single
+          external_host: https://garage.whyredfire.dev
+      - model: authentik_core.application
+        id: garage-ui
+        identifiers:
+          slug: garage-ui
+        attrs:
+          name: Garage UI
+          provider: !KeyOf garage-ui-provider
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf garage-ui
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-google-login.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-google-login
+  namespace: authentik
+data:
+  google-login.yaml: |
+    version: 1
+    metadata:
+      name: Google login
+    entries:
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: default/flow-default-source-authentication.yaml
+          required: true
+      - model: authentik_core.group
+        id: admins
+        identifiers:
+          name: admins
+        attrs:
+          is_superuser: true
+      - model: authentik_core.user
+        identifiers:
+          username: whyredfire
+        attrs:
+          email: [email protected]
+          groups:
+            - !KeyOf admins
+          name: Karan Parashar
+      - model: authentik_sources_oauth.oauthsource
+        id: google
+        identifiers:
+          slug: google
+        attrs:
+          authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
+          consumer_key: !Env GOOGLE_CLIENT_ID
+          consumer_secret: !Env GOOGLE_CLIENT_SECRET
+          name: Google
+          promoted: true
+          provider_type: google
+          user_matching_mode: email_link
+      - model: authentik_stages_identification.identificationstage
+        id: google-identification
+        identifiers:
+          name: google-identification
+        attrs:
+          sources:
+            - !KeyOf google
+          user_fields: []
+      - model: authentik_flows.flow
+        id: google-flow
+        identifiers:
+          slug: google-login
+        attrs:
+          authentication: require_unauthenticated
+          designation: authentication
+          name: Google login
+          title: Welcome!
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          order: 10
+          stage: !KeyOf google-identification
+          target: !KeyOf google-flow
+      - model: authentik_brands.brand
+        identifiers:
+          domain: authentik-default
+        attrs:
+          flow_authentication: !KeyOf google-flow

add-ons/authentik/blueprint-grafana.yaml

@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-grafana
+  namespace: authentik
+data:
+  grafana.yaml: |
+    version: 1
+    metadata:
+      name: Grafana
+    entries:
+      - model: authentik_providers_oauth2.oauth2provider
+        id: grafana-provider
+        identifiers:
+          name: grafana
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_id: grafana
+          client_secret: !Env GRAFANA_CLIENT_SECRET
+          grant_types:
+            - authorization_code
+            - refresh_token
+          redirect_uris:
+            - matching_mode: strict
+              url: https://grafana.whyredfire.dev/login/generic_oauth
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+      - model: authentik_core.application
+        identifiers:
+          slug: grafana
+        attrs:
+          name: Grafana
+          provider: !KeyOf grafana-provider
+          meta_launch_url: https://grafana.whyredfire.dev

add-ons/authentik/blueprint-outpost.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-outpost
+  namespace: authentik
+data:
+  outpost.yaml: |
+    version: 1
+    metadata:
+      name: Embedded outpost
+    entries:
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: mounted/cm-blueprint-garage-ui/garage-ui.yaml
+          required: true
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: mounted/cm-blueprint-qbittorrent/qbittorrent.yaml
+          required: true
+      # Serves forward auth for the apps behind the authentik middleware.
+      - model: authentik_outposts.outpost
+        identifiers:
+          managed: goauthentik.io/outposts/embedded
+        attrs:
+          providers:
+            - !Find [authentik_providers_proxy.proxyprovider, [name, garage-ui]]
+            - !Find [authentik_providers_proxy.proxyprovider, [name, qbittorrent]]

add-ons/authentik/blueprint-qbittorrent.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-qbittorrent
+  namespace: authentik
+data:
+  qbittorrent.yaml: |
+    version: 1
+    metadata:
+      name: qBittorrent
+    entries:
+      - model: authentik_providers_proxy.proxyprovider
+        id: qbittorrent-provider
+        identifiers:
+          name: qbittorrent
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: forward_single
+          external_host: https://qbit.whyredfire.dev
+      - model: authentik_core.application
+        id: qbittorrent
+        identifiers:
+          slug: qbittorrent
+        attrs:
+          name: qBittorrent
+          provider: !KeyOf qbittorrent-provider
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf qbittorrent
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-wireguard-admin.yaml

@@ -0,0 +1,61 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-wireguard-admin
+  namespace: authentik
+data:
+  wireguard-admin.yaml: |
+    version: 1
+    metadata:
+      name: WireGuard admin
+    entries:
+      # wg-easy rejects logins unless email_verified is true; the default email
+      # mapping always sends false.
+      - model: authentik_providers_oauth2.scopemapping
+        id: verified-email
+        identifiers:
+          name: wireguard-admin email
+        attrs:
+          scope_name: email
+          expression: |
+            return {
+                "email": request.user.email,
+                "email_verified": True,
+            }
+      - model: authentik_providers_oauth2.oauth2provider
+        id: wireguard-admin-provider
+        identifiers:
+          name: wireguard-admin
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_id: wireguard-admin
+          client_secret: !Env WIREGUARD_CLIENT_SECRET
+          grant_types:
+            - authorization_code
+            - refresh_token
+          redirect_uris:
+            - matching_mode: strict
+              url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback
+            - matching_mode: strict
+              url: https://wg-admin.whyredfire.dev/api/auth/oidc/link
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !KeyOf verified-email
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+      - model: authentik_core.application
+        id: wireguard-admin
+        identifiers:
+          slug: wireguard-admin
+        attrs:
+          name: WireGuard Admin
+          provider: !KeyOf wireguard-admin-provider
+          meta_launch_url: https://wg-admin.whyredfire.dev
+      # wg-easy makes every user it registers an admin, so only admins may log in.
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf wireguard-admin
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprints.yaml

@@ -1,156 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: authentik-blueprints
-  namespace: authentik
-data:
-  google-login.yaml: |
-    version: 1
-    metadata:
-      name: Google login
-    entries:
-      - model: authentik_blueprints.metaapplyblueprint
-        attrs:
-          identifiers:
-            path: default/flow-default-source-authentication.yaml
-          required: true
-      - model: authentik_core.group
-        id: admins
-        identifiers:
-          name: admins
-        attrs:
-          is_superuser: true
-      - model: authentik_core.user
-        identifiers:
-          username: whyredfire
-        attrs:
-          email: [email protected]
-          groups:
-            - !KeyOf admins
-          name: Karan Parashar
-      - model: authentik_sources_oauth.oauthsource
-        id: google
-        identifiers:
-          slug: google
-        attrs:
-          authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
-          consumer_key: !Env GOOGLE_CLIENT_ID
-          consumer_secret: !Env GOOGLE_CLIENT_SECRET
-          name: Google
-          promoted: true
-          provider_type: google
-          user_matching_mode: email_link
-      - model: authentik_stages_identification.identificationstage
-        id: google-identification
-        identifiers:
-          name: google-identification
-        attrs:
-          sources:
-            - !KeyOf google
-          user_fields: []
-      - model: authentik_flows.flow
-        id: google-flow
-        identifiers:
-          slug: google-login
-        attrs:
-          authentication: require_unauthenticated
-          designation: authentication
-          name: Google login
-          title: Welcome!
-      - model: authentik_flows.flowstagebinding
-        identifiers:
-          order: 10
-          stage: !KeyOf google-identification
-          target: !KeyOf google-flow
-      - model: authentik_brands.brand
-        identifiers:
-          domain: authentik-default
-        attrs:
-          flow_authentication: !KeyOf google-flow
-  grafana.yaml: |
-    version: 1
-    metadata:
-      name: Grafana
-    entries:
-      - model: authentik_providers_oauth2.oauth2provider
-        id: grafana-provider
-        identifiers:
-          name: grafana
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          client_id: grafana
-          client_secret: !Env GRAFANA_CLIENT_SECRET
-          grant_types:
-            - authorization_code
-            - refresh_token
-          redirect_uris:
-            - matching_mode: strict
-              url: https://grafana.whyredfire.dev/login/generic_oauth
-          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
-          property_mappings:
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
-      - model: authentik_core.application
-        identifiers:
-          slug: grafana
-        attrs:
-          name: Grafana
-          provider: !KeyOf grafana-provider
-          meta_launch_url: https://grafana.whyredfire.dev
-  wireguard-admin.yaml: |
-    version: 1
-    metadata:
-      name: WireGuard admin
-    entries:
-      # wg-easy rejects logins unless email_verified is true; the default email
-      # mapping always sends false.
-      - model: authentik_providers_oauth2.scopemapping
-        id: verified-email
-        identifiers:
-          name: wireguard-admin email
-        attrs:
-          scope_name: email
-          expression: |
-            return {
-                "email": request.user.email,
-                "email_verified": True,
-            }
-      - model: authentik_providers_oauth2.oauth2provider
-        id: wireguard-admin-provider
-        identifiers:
-          name: wireguard-admin
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          client_id: wireguard-admin
-          client_secret: !Env WIREGUARD_CLIENT_SECRET
-          grant_types:
-            - authorization_code
-            - refresh_token
-          redirect_uris:
-            - matching_mode: strict
-              url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback
-            - matching_mode: strict
-              url: https://wg-admin.whyredfire.dev/api/auth/oidc/link
-          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
-          property_mappings:
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
-            - !KeyOf verified-email
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
-      - model: authentik_core.application
-        id: wireguard-admin
-        identifiers:
-          slug: wireguard-admin
-        attrs:
-          name: WireGuard Admin
-          provider: !KeyOf wireguard-admin-provider
-          meta_launch_url: https://wg-admin.whyredfire.dev
-      # wg-easy makes every user it registers an admin, so only admins may log in.
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf wireguard-admin
-        attrs:
-          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/kustomization.yaml

@@ -2,6 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
-  - blueprints.yaml
+  - blueprint-argocd.yaml
+  - blueprint-garage-ui.yaml
+  - blueprint-google-login.yaml
+  - blueprint-grafana.yaml
+  - blueprint-outpost.yaml
+  - blueprint-qbittorrent.yaml
+  - blueprint-wireguard-admin.yaml
   - httproute.yaml
   - referencegrant.yaml

argocd-apps/add-ons/authentik.yaml

@@ -27,7 +27,13 @@ spec:
                   name: authentik-secrets
           blueprints:
             configMaps:
-              - authentik-blueprints
+              - blueprint-argocd
+              - blueprint-garage-ui
+              - blueprint-google-login
+              - blueprint-grafana
+              - blueprint-outpost
+              - blueprint-qbittorrent
+              - blueprint-wireguard-admin
           server:
             resources:
               limits: