mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
278f6fc55f
Actual Budget, Argo CD, FreshRSS, Stalwart and Vault had no policy binding, so any authentik user could sign in to them. Scouts Online members are about to get accounts in this authentik for immich; bind each app to the authentik Admins group, as Longhorn already was.
50 lines
2.1 KiB
YAML
50 lines
2.1 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: authentik-blueprint-actualbudget
|
|
data:
|
|
actualbudget-proxy.yaml: |
|
|
version: 1
|
|
metadata:
|
|
name: Actual Budget OIDC
|
|
entries:
|
|
- model: authentik_providers_oauth2.oauth2provider
|
|
id: actualbudget-provider
|
|
state: present
|
|
identifiers:
|
|
name: Actual Budget
|
|
attrs:
|
|
name: Actual Budget
|
|
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
|
authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
|
|
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
|
client_type: confidential
|
|
client_id: actualbudget
|
|
client_secret: !Env [ACTUALBUDGET_OIDC_CLIENT_SECRET, ""]
|
|
redirect_uris:
|
|
- matching_mode: strict
|
|
url: https://ynab.rubenhensen.nl/openid/callback
|
|
signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
|
|
property_mappings:
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
|
|
- model: authentik_core.application
|
|
id: actualbudget-app
|
|
state: present
|
|
identifiers:
|
|
slug: actualbudget
|
|
attrs:
|
|
name: Actual Budget
|
|
provider: !KeyOf actualbudget-provider
|
|
meta_launch_url: https://ynab.rubenhensen.nl
|
|
# Only admins: Scouts Online members get accounts in this authentik
|
|
# too (for immich) and must not reach personal apps.
|
|
- model: authentik_policies.policybinding
|
|
state: present
|
|
identifiers:
|
|
order: 0
|
|
target: !KeyOf actualbudget-app
|
|
attrs:
|
|
group: !Find [authentik_core.group, [name, "authentik Admins"]]
|