Add oidc actualbudget

actual-budget/helm-actual-budget.yaml

@@ -33,6 +33,14 @@ spec:
           annotations:
             cert-manager.io/cluster-issuer: prod-cluster-issuer
             nginx.ingress.kubernetes.io/proxy-body-size: 50m
+            nginx.ingress.kubernetes.io/auth-url: |-
+              http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/nginx
+            nginx.ingress.kubernetes.io/auth-signin: |-
+              https://authentik.rubenhensen.nl/outpost.goauthentik.io/start?rd=$scheme%3A%2F%2F$host$escaped_request_uri
+            nginx.ingress.kubernetes.io/auth-response-headers: |-
+              Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-entitlements,X-authentik-email,X-authentik-name,X-authentik-uid
+            nginx.ingress.kubernetes.io/auth-snippet: |-
+              proxy_set_header X-Forwarded-Host $http_host;
           hosts:
             - host: ynab.rubenhensen.nl
               paths:

apps/templates/authentik-helm.yaml

@@ -98,6 +98,9 @@ spec:
               - name: blueprint-freshrss
                 configMap:
                   name: authentik-blueprint-freshrss
+              - name: blueprint-actualbudget
+                configMap:
+                  name: authentik-blueprint-actualbudget
             volumeMounts:
               - name: blueprint-vault
                 mountPath: /blueprints/custom/vault-oidc.yaml
@@ -114,6 +117,9 @@ spec:
               - name: blueprint-freshrss
                 mountPath: /blueprints/custom/freshrss-oidc.yaml
                 subPath: freshrss-oidc.yaml
+              - name: blueprint-actualbudget
+                mountPath: /blueprints/custom/actualbudget-proxy.yaml
+                subPath: actualbudget-proxy.yaml
             ingress:
               enabled: true
               ingressClassName: nginx
@@ -142,6 +148,9 @@ spec:
               - name: blueprint-freshrss
                 configMap:
                   name: authentik-blueprint-freshrss
+              - name: blueprint-actualbudget
+                configMap:
+                  name: authentik-blueprint-actualbudget
             volumeMounts:
               - name: blueprint-vault
                 mountPath: /blueprints/custom/vault-oidc.yaml
@@ -158,6 +167,9 @@ spec:
               - name: blueprint-freshrss
                 mountPath: /blueprints/custom/freshrss-oidc.yaml
                 subPath: freshrss-oidc.yaml
+              - name: blueprint-actualbudget
+                mountPath: /blueprints/custom/actualbudget-proxy.yaml
+                subPath: actualbudget-proxy.yaml
           postgresql:
             enabled: false
           redis:

authentik/blueprint-actualbudget-proxy.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentik-blueprint-actualbudget
+data:
+  actualbudget-proxy.yaml: |
+    version: 1
+    metadata:
+      name: Actual Budget Proxy
+    entries:
+      - model: authentik_providers_proxy.proxyprovider
+        id: actualbudget-provider
+        state: present
+        identifiers:
+          name: Actual Budget
+        attrs:
+          name: Actual Budget
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: forward_single
+          external_host: https://ynab.rubenhensen.nl
+      - model: authentik_core.application
+        id: actualbudget-app
+        state: present
+        identifiers:
+          slug: actualbudget
+        attrs:
+          name: Actual Budget
+          provider: !KeyOf actualbudget-provider
+          meta_launch_url: https://ynab.rubenhensen.nl

authentik/blueprint-freshrss-oidc.yaml

@@ -22,6 +22,8 @@ data:
           client_id: freshrss
           client_secret: !Env [FRESHRSS_OIDC_CLIENT_SECRET, ""]
           redirect_uris:
+            - matching_mode: strict
+              url: https://rss.rubenhensen.nl/i/oidc/
             - matching_mode: strict
               url: https://rss.rubenhensen.nl:443/i/oidc/
           signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]