mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
278f6fc55f
Actual Budget, Argo CD, FreshRSS, Stalwart and Vault had no policy binding, so any authentik user could sign in to them. Scouts Online members are about to get accounts in this authentik for immich; bind each app to the authentik Admins group, as Longhorn already was.
50 lines
2.0 KiB
YAML
50 lines
2.0 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: authentik-blueprint-mail
|
|
data:
|
|
mail-oidc.yaml: |
|
|
version: 1
|
|
metadata:
|
|
name: Mail OIDC
|
|
entries:
|
|
- model: authentik_providers_oauth2.oauth2provider
|
|
id: stalwart-provider
|
|
state: present
|
|
identifiers:
|
|
name: Stalwart
|
|
attrs:
|
|
name: Stalwart
|
|
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
|
authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
|
|
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
|
client_type: confidential
|
|
client_id: stalwart
|
|
client_secret: !Env [STALWART_OIDC_CLIENT_SECRET, ""]
|
|
redirect_uris:
|
|
- matching_mode: strict
|
|
url: https://mail.rubenhensen.nl/login/callback
|
|
signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
|
|
property_mappings:
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
|
|
- model: authentik_core.application
|
|
id: stalwart-app
|
|
state: present
|
|
identifiers:
|
|
slug: stalwart
|
|
attrs:
|
|
name: Stalwart Mail
|
|
provider: !KeyOf stalwart-provider
|
|
meta_launch_url: https://mail.rubenhensen.nl
|
|
# Only admins: Scouts Online members get accounts in this authentik
|
|
# too (for immich) and must not reach personal apps.
|
|
- model: authentik_policies.policybinding
|
|
state: present
|
|
identifiers:
|
|
order: 0
|
|
target: !KeyOf stalwart-app
|
|
attrs:
|
|
group: !Find [authentik_core.group, [name, "authentik Admins"]]
|