mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
278f6fc55f
Actual Budget, Argo CD, FreshRSS, Stalwart and Vault had no policy binding, so any authentik user could sign in to them. Scouts Online members are about to get accounts in this authentik for immich; bind each app to the authentik Admins group, as Longhorn already was.
52 lines
2.1 KiB
YAML
52 lines
2.1 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: authentik-blueprint-freshrss
|
|
data:
|
|
freshrss-oidc.yaml: |
|
|
version: 1
|
|
metadata:
|
|
name: FreshRSS OIDC
|
|
entries:
|
|
- model: authentik_providers_oauth2.oauth2provider
|
|
id: freshrss-provider
|
|
state: present
|
|
identifiers:
|
|
name: FreshRSS
|
|
attrs:
|
|
name: FreshRSS
|
|
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
|
authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
|
|
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
|
client_type: confidential
|
|
client_id: freshrss
|
|
client_secret: !Env [FRESHRSS_OIDC_CLIENT_SECRET, ""]
|
|
redirect_uris:
|
|
- matching_mode: strict
|
|
url: https://rss.rubenhensen.nl/i/oidc/
|
|
- matching_mode: strict
|
|
url: https://rss.rubenhensen.nl:443/i/oidc/
|
|
signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
|
|
property_mappings:
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
|
|
- model: authentik_core.application
|
|
id: freshrss-app
|
|
state: present
|
|
identifiers:
|
|
slug: freshrss
|
|
attrs:
|
|
name: FreshRSS
|
|
provider: !KeyOf freshrss-provider
|
|
meta_launch_url: https://rss.rubenhensen.nl
|
|
# Only admins: Scouts Online members get accounts in this authentik
|
|
# too (for immich) and must not reach personal apps.
|
|
- model: authentik_policies.policybinding
|
|
state: present
|
|
identifiers:
|
|
order: 0
|
|
target: !KeyOf freshrss-app
|
|
attrs:
|
|
group: !Find [authentik_core.group, [name, "authentik Admins"]]
|