From 068ac206937b057401828a02b9cd9d5a24b23db4 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Fri, 10 Apr 2026 21:23:50 +0200
Subject: [PATCH] Add oidc actualbudget

---
 actual-budget/helm-actual-budget.yaml       |  8 ++++++
 apps/templates/authentik-helm.yaml          | 12 ++++++++
 authentik/blueprint-actualbudget-proxy.yaml | 31 +++++++++++++++++++++
 authentik/blueprint-freshrss-oidc.yaml      |  2 ++
 4 files changed, 53 insertions(+)
 create mode 100644 authentik/blueprint-actualbudget-proxy.yaml

diff --git a/actual-budget/helm-actual-budget.yaml b/actual-budget/helm-actual-budget.yaml
index 53e3faa..d0f8f07 100644
--- a/actual-budget/helm-actual-budget.yaml
+++ b/actual-budget/helm-actual-budget.yaml
@@ -33,6 +33,14 @@ spec:
           annotations:
             cert-manager.io/cluster-issuer: prod-cluster-issuer
             nginx.ingress.kubernetes.io/proxy-body-size: 50m
+            nginx.ingress.kubernetes.io/auth-url: |-
+              http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/nginx
+            nginx.ingress.kubernetes.io/auth-signin: |-
+              https://authentik.rubenhensen.nl/outpost.goauthentik.io/start?rd=$scheme%3A%2F%2F$host$escaped_request_uri
+            nginx.ingress.kubernetes.io/auth-response-headers: |-
+              Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-entitlements,X-authentik-email,X-authentik-name,X-authentik-uid
+            nginx.ingress.kubernetes.io/auth-snippet: |-
+              proxy_set_header X-Forwarded-Host $http_host;
           hosts:
             - host: ynab.rubenhensen.nl
               paths:
diff --git a/apps/templates/authentik-helm.yaml b/apps/templates/authentik-helm.yaml
index 96da680..f2e89c2 100644
--- a/apps/templates/authentik-helm.yaml
+++ b/apps/templates/authentik-helm.yaml
@@ -98,6 +98,9 @@ spec:
               - name: blueprint-freshrss
                 configMap:
                   name: authentik-blueprint-freshrss
+              - name: blueprint-actualbudget
+                configMap:
+                  name: authentik-blueprint-actualbudget
             volumeMounts:
               - name: blueprint-vault
                 mountPath: /blueprints/custom/vault-oidc.yaml
@@ -114,6 +117,9 @@ spec:
               - name: blueprint-freshrss
                 mountPath: /blueprints/custom/freshrss-oidc.yaml
                 subPath: freshrss-oidc.yaml
+              - name: blueprint-actualbudget
+                mountPath: /blueprints/custom/actualbudget-proxy.yaml
+                subPath: actualbudget-proxy.yaml
             ingress:
               enabled: true
               ingressClassName: nginx
@@ -142,6 +148,9 @@ spec:
               - name: blueprint-freshrss
                 configMap:
                   name: authentik-blueprint-freshrss
+              - name: blueprint-actualbudget
+                configMap:
+                  name: authentik-blueprint-actualbudget
             volumeMounts:
               - name: blueprint-vault
                 mountPath: /blueprints/custom/vault-oidc.yaml
@@ -158,6 +167,9 @@ spec:
               - name: blueprint-freshrss
                 mountPath: /blueprints/custom/freshrss-oidc.yaml
                 subPath: freshrss-oidc.yaml
+              - name: blueprint-actualbudget
+                mountPath: /blueprints/custom/actualbudget-proxy.yaml
+                subPath: actualbudget-proxy.yaml
           postgresql:
             enabled: false
           redis:
diff --git a/authentik/blueprint-actualbudget-proxy.yaml b/authentik/blueprint-actualbudget-proxy.yaml
new file mode 100644
index 0000000..c9cba1b
--- /dev/null
+++ b/authentik/blueprint-actualbudget-proxy.yaml
@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentik-blueprint-actualbudget
+data:
+  actualbudget-proxy.yaml: |
+    version: 1
+    metadata:
+      name: Actual Budget Proxy
+    entries:
+      - model: authentik_providers_proxy.proxyprovider
+        id: actualbudget-provider
+        state: present
+        identifiers:
+          name: Actual Budget
+        attrs:
+          name: Actual Budget
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: forward_single
+          external_host: https://ynab.rubenhensen.nl
+      - model: authentik_core.application
+        id: actualbudget-app
+        state: present
+        identifiers:
+          slug: actualbudget
+        attrs:
+          name: Actual Budget
+          provider: !KeyOf actualbudget-provider
+          meta_launch_url: https://ynab.rubenhensen.nl
diff --git a/authentik/blueprint-freshrss-oidc.yaml b/authentik/blueprint-freshrss-oidc.yaml
index 86cd1b1..9c47ea3 100644
--- a/authentik/blueprint-freshrss-oidc.yaml
+++ b/authentik/blueprint-freshrss-oidc.yaml
@@ -22,6 +22,8 @@ data:
           client_id: freshrss
           client_secret: !Env [FRESHRSS_OIDC_CLIENT_SECRET, ""]
           redirect_uris:
+            - matching_mode: strict
+              url: https://rss.rubenhensen.nl/i/oidc/
             - matching_mode: strict
               url: https://rss.rubenhensen.nl:443/i/oidc/
           signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]