k8scd/authentik/blueprint-actualbudget-proxy.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: authentik-blueprint-actualbudget
data:
  actualbudget-proxy.yaml: |
    version: 1
    metadata:
      name: Actual Budget OIDC
    entries:
      - model: authentik_providers_oauth2.oauth2provider
        id: actualbudget-provider
        state: present
        identifiers:
          name: Actual Budget
        attrs:
          name: Actual Budget
          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
          authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
          client_type: confidential
          client_id: actualbudget
          client_secret: !Env [ACTUALBUDGET_OIDC_CLIENT_SECRET, ""]
          redirect_uris:
            - matching_mode: strict
              url: https://ynab.rubenhensen.nl/openid/callback
          signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
          property_mappings:
            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
      - model: authentik_core.application
        id: actualbudget-app
        state: present
        identifiers:
          slug: actualbudget
        attrs:
          name: Actual Budget
          provider: !KeyOf actualbudget-provider
          meta_launch_url: https://ynab.rubenhensen.nl