Add oidc actualbudget 2

authentik/blueprint-actualbudget-proxy.yaml

@@ -6,9 +6,9 @@ data:
   actualbudget-proxy.yaml: |
     version: 1
     metadata:
-      name: Actual Budget Proxy
+      name: Actual Budget OIDC
     entries:
-      - model: authentik_providers_proxy.proxyprovider
+      - model: authentik_providers_oauth2.oauth2provider
         id: actualbudget-provider
         state: present
         identifiers:
@@ -18,8 +18,17 @@ data:
           authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
           authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
           invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          mode: forward_single
-          external_host: https://ynab.rubenhensen.nl
+          client_type: confidential
+          client_id: actualbudget
+          client_secret: !Env [ACTUALBUDGET_OIDC_CLIENT_SECRET, ""]
+          redirect_uris:
+            - matching_mode: strict
+              url: https://ynab.rubenhensen.nl/openid/callback
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
       - model: authentik_core.application
         id: actualbudget-app
         state: present

authentik/external-secret.yaml

@@ -117,3 +117,21 @@ spec:
       remoteRef:
         key: kv/freshrss-oidc
         property: client_secret
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: actualbudget-oidc-client-secret
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: actualbudget-oidc-client-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: client_secret
+      remoteRef:
+        key: kv/actualbudget-oidc
+        property: client_secret