feat: Add holyarrs and use LDAP for jellyfin

2026-11-10 22:27:54 +05:30
parent e22907125d
commit 98081ed54c
16 changed files with 398 additions and 0 deletions
@@ -0,0 +1,116 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-jellyfin-ldap
+  namespace: authentik
+data:
+  jellyfin-ldap.yaml: |
+    version: 1
+    metadata:
+      name: Jellyfin LDAP
+    entries:
+      - model: authentik_stages_password.passwordstage
+        id: ldap-password
+        identifiers:
+          name: ldap-authentication-password
+        attrs:
+          backends:
+            - authentik.core.auth.InbuiltBackend
+            - authentik.core.auth.TokenBackend
+      - model: authentik_stages_identification.identificationstage
+        id: ldap-identification
+        identifiers:
+          name: ldap-authentication-identification
+        attrs:
+          user_fields:
+            - username
+          password_stage: !KeyOf ldap-password
+      - model: authentik_stages_user_login.userloginstage
+        id: ldap-login
+        identifiers:
+          name: ldap-authentication-login
+      - model: authentik_flows.flow
+        id: ldap-flow
+        identifiers:
+          slug: ldap-authentication
+        attrs:
+          designation: authentication
+          name: LDAP bind
+          title: LDAP bind
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          order: 10
+          stage: !KeyOf ldap-identification
+          target: !KeyOf ldap-flow
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          order: 30
+          stage: !KeyOf ldap-login
+          target: !KeyOf ldap-flow
+      - model: authentik_core.user
+        id: ldap-jellyfin
+        identifiers:
+          username: ldap-jellyfin
+        attrs:
+          name: Jellyfin LDAP bind
+          password: !Env JELLYFIN_LDAP_PASSWORD
+      - model: authentik_providers_ldap.ldapprovider
+        id: jellyfin-ldap-provider
+        identifiers:
+          name: jellyfin-ldap
+        attrs:
+          authorization_flow: !KeyOf ldap-flow
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
+          base_dn: dc=ldap,dc=goauthentik,dc=io
+          certificate: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          bind_mode: direct
+          search_mode: direct
+          mfa_support: false # else ";" in a password is read as a TOTP separator
+        permissions:
+          - permission: authentik_providers_ldap.search_full_directory
+            user: !KeyOf ldap-jellyfin
+      - model: authentik_core.application
+        id: jellyfin-ldap
+        identifiers:
+          slug: jellyfin-ldap
+        attrs:
+          name: Jellyfin LDAP
+          provider: !KeyOf jellyfin-ldap-provider
+          policy_engine_mode: any
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf jellyfin-ldap
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 10
+          target: !KeyOf jellyfin-ldap
+        attrs:
+          user: !KeyOf ldap-jellyfin
+      - model: authentik_outposts.outpost
+        identifiers:
+          name: ldap
+        attrs:
+          type: ldap
+          service_connection: !Find [authentik_outposts.kubernetesserviceconnection, [name, Local Kubernetes Cluster]]
+          providers:
+            - !KeyOf jellyfin-ldap-provider
+          config:
+            authentik_host: http://authentik-server.authentik.svc.cluster.local
+      - model: authentik_core.user
+        identifiers:
+          username: whyredfire
+        attrs:
+          attributes:
+            jellyfinUsername: karan
+      - model: authentik_core.token
+        identifiers:
+          identifier: jellyfin-whyredfire
+        attrs:
+          user: !Find [authentik_core.user, [username, whyredfire]]
+          intent: app_password
+          key: !Env JELLYFIN_APP_PASSWORD
+          expiring: false
+          description: Jellyfin