From 96c13c63f7bbfce52bf8f0bac9057bcc8ec65eb4 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Sat, 24 Oct 2026 18:52:24 +0200
Subject: [PATCH] authentik: serve auth.scoutingmbg.nl

A Gateway listener with its own certificate, the authentik route on both
hostnames, and an authentik brand for auth.scoutingmbg.nl that logs in
through Scouts Online and then sends people to the photos. The
authentik.rubenhensen.nl brand stays as it is.
---
 authentik/blueprint-scouting.yaml | 13 ++++++++++++-
 authentik/httproute.yaml          |  7 +++++++
 gateway/gateway.yaml              | 14 ++++++++++++++
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/authentik/blueprint-scouting.yaml b/authentik/blueprint-scouting.yaml
index e10b40a..2c392b5 100644
--- a/authentik/blueprint-scouting.yaml
+++ b/authentik/blueprint-scouting.yaml
@@ -94,6 +94,16 @@ data:
           target: !KeyOf immich-app
         attrs:
           group: !KeyOf mbg-leden
+      # auth.scoutingmbg.nl: straight to Scouts Online, then on to the
+      # photos. Other domains keep the default brand.
+      - model: authentik_brands.brand
+        state: present
+        identifiers:
+          domain: auth.scoutingmbg.nl
+        attrs:
+          branding_title: Scouting MBG
+          flow_authentication: !Find [authentik_flows.flow, [slug, scouts-online-login]]
+          default_application: !KeyOf immich-app
       - model: authentik_policies.policybinding
         state: present
         identifiers:
@@ -220,7 +230,8 @@ data:
           policy: !KeyOf sso-only
       # SOL only lets in members of the organisations picked in its
       # connection, and only sends roles within them. The callback URL is
-      # https://authentik.rubenhensen.nl/source/oauth/callback/scouts-online/
+      # https://auth.scoutingmbg.nl/source/oauth/callback/scouts-online/ (and
+      # authentik.rubenhensen.nl, from before auth.scoutingmbg.nl existed)
       - model: authentik_sources_oauth.oauthsource
         id: source
         state: present
diff --git a/authentik/httproute.yaml b/authentik/httproute.yaml
index 4105e83..ead08c1 100644
--- a/authentik/httproute.yaml
+++ b/authentik/httproute.yaml
@@ -7,8 +7,12 @@ spec:
   - name: homelab
     namespace: envoy-gateway-system
     sectionName: https-authentik
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-auth-scoutingmbg
   hostnames:
   - authentik.rubenhensen.nl
+  - auth.scoutingmbg.nl
   rules:
   - backendRefs:
     - name: authentik-server
@@ -32,3 +36,6 @@ spec:
   - group: ""
     kind: Secret
     name: authentik-tls
+  - group: ""
+    kind: Secret
+    name: auth-scoutingmbg-tls
diff --git a/gateway/gateway.yaml b/gateway/gateway.yaml
index cd3321c..3b483be 100644
--- a/gateway/gateway.yaml
+++ b/gateway/gateway.yaml
@@ -58,6 +58,20 @@ spec:
         selector:
           matchLabels:
             kubernetes.io/metadata.name: authentik
+  - name: https-auth-scoutingmbg
+    protocol: HTTPS
+    port: 443
+    hostname: auth.scoutingmbg.nl
+    tls:
+      certificateRefs:
+      - name: auth-scoutingmbg-tls
+        namespace: authentik
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: authentik
   - name: https-vic
     protocol: HTTPS
     port: 443