authentik: limit personal apps to authentik Admins

Actual Budget, Argo CD, FreshRSS, Stalwart and Vault had no policy
binding, so any authentik user could sign in to them. Scouts Online
members are about to get accounts in this authentik for immich; bind
each app to the authentik Admins group, as Longhorn already was.

authentik/blueprint-actualbudget-proxy.yaml

@@ -38,3 +38,12 @@ data:
           name: Actual Budget
           provider: !KeyOf actualbudget-provider
           meta_launch_url: https://ynab.rubenhensen.nl
+      # Only admins: Scouts Online members get accounts in this authentik
+      # too (for immich) and must not reach personal apps.
+      - model: authentik_policies.policybinding
+        state: present
+        identifiers:
+          order: 0
+          target: !KeyOf actualbudget-app
+        attrs:
+          group: !Find [authentik_core.group, [name, "authentik Admins"]]

authentik/blueprint-argocd-oidc.yaml

@@ -38,3 +38,12 @@ data:
           name: ArgoCD
           provider: !KeyOf argocd-provider
           meta_launch_url: https://argocd.rubenhensen.nl
+      # Only admins: Scouts Online members get accounts in this authentik
+      # too (for immich) and must not reach personal apps.
+      - model: authentik_policies.policybinding
+        state: present
+        identifiers:
+          order: 0
+          target: !KeyOf argocd-app
+        attrs:
+          group: !Find [authentik_core.group, [name, "authentik Admins"]]

authentik/blueprint-freshrss-oidc.yaml

@@ -40,3 +40,12 @@ data:
           name: FreshRSS
           provider: !KeyOf freshrss-provider
           meta_launch_url: https://rss.rubenhensen.nl
+      # Only admins: Scouts Online members get accounts in this authentik
+      # too (for immich) and must not reach personal apps.
+      - model: authentik_policies.policybinding
+        state: present
+        identifiers:
+          order: 0
+          target: !KeyOf freshrss-app
+        attrs:
+          group: !Find [authentik_core.group, [name, "authentik Admins"]]

authentik/blueprint-mail-oidc.yaml

@@ -38,3 +38,12 @@ data:
           name: Stalwart Mail
           provider: !KeyOf stalwart-provider
           meta_launch_url: https://mail.rubenhensen.nl
+      # Only admins: Scouts Online members get accounts in this authentik
+      # too (for immich) and must not reach personal apps.
+      - model: authentik_policies.policybinding
+        state: present
+        identifiers:
+          order: 0
+          target: !KeyOf stalwart-app
+        attrs:
+          group: !Find [authentik_core.group, [name, "authentik Admins"]]

authentik/blueprint-vault-oidc.yaml

@@ -40,3 +40,12 @@ data:
           name: Vault
           provider: !KeyOf vault-provider
           meta_launch_url: https://vault.rubenhensen.nl
+      # Only admins: Scouts Online members get accounts in this authentik
+      # too (for immich) and must not reach personal apps.
+      - model: authentik_policies.policybinding
+        state: present
+        identifiers:
+          order: 0
+          target: !KeyOf vault-app
+        attrs:
+          group: !Find [authentik_core.group, [name, "authentik Admins"]]