diff --git a/Caddyfile b/Caddyfile index 56fe1c2..c72a48a 100644 --- a/Caddyfile +++ b/Caddyfile @@ -17,6 +17,20 @@ respond @blocked "Access denied" 403 } +# TB-006 — Authentik forward auth (embedded outpost on authentik-server:9000). +# Wrap protected sites in `route { ... }` so bypass handles run before forward_auth. +(authentik_outpost) { + reverse_proxy /outpost.goauthentik.io/* authentik-server:9000 +} + +(authentik_forward_auth) { + forward_auth authentik-server:9000 { + uri /outpost.goauthentik.io/auth/caddy + copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version + trusted_proxies private_ranges + } +} + # ============================================================= # FOUNDRY VTT — public # ============================================================= @@ -196,8 +210,13 @@ storage.j-costa.com, https://storage.j-costa.com { # MINIO CONSOLE — internal only # ============================================================= minio.ginnoir.com { - import internal_only - reverse_proxy resume-minio:9001 + route { + import authentik_outpost + handle { + import authentik_forward_auth + reverse_proxy resume-minio:9001 + } + } } # ============================================================= @@ -219,34 +238,50 @@ dev.ginnoir.com { # MANAGEMENT — internal only # ============================================================= portainer.ginnoir.com { - @webhook { - method POST - path /api/stacks/webhooks/* - } - - handle @webhook { - reverse_proxy portainer:9000 - } - - handle { - import internal_only - reverse_proxy portainer:9000 + route { + import authentik_outpost + @webhook { + method POST + path /api/stacks/webhooks/* + } + handle @webhook { + reverse_proxy portainer:9000 + } + handle { + import authentik_forward_auth + reverse_proxy portainer:9000 + } } } uptime.ginnoir.com { - import internal_only - reverse_proxy uptime-kuma:3001 + route { + import authentik_outpost + handle { + import authentik_forward_auth + reverse_proxy uptime-kuma:3001 + } + } } homarr.ginnoir.com { - import internal_only - reverse_proxy homarr:7575 + route { + import authentik_outpost + handle { + import authentik_forward_auth + reverse_proxy homarr:7575 + } + } } backup.ginnoir.com { - import internal_only - reverse_proxy kopia:51515 + route { + import authentik_outpost + handle { + import authentik_forward_auth + reverse_proxy kopia:51515 + } + } } router.ginnoir.com { @@ -258,13 +293,31 @@ router.ginnoir.com { # DEV STACK — internal only # ============================================================= gitea.ginnoir.com { - import internal_only - reverse_proxy gitea:3000 + route { + import authentik_outpost + @api path /api/* + @git path_regexp (?i)\.git(/|$) + handle @api { + reverse_proxy gitea:3000 + } + handle @git { + reverse_proxy gitea:3000 + } + handle { + import authentik_forward_auth + reverse_proxy gitea:3000 + } + } } code.ginnoir.com { - import internal_only - reverse_proxy code_server:8443 + route { + import authentik_outpost + handle { + import authentik_forward_auth + reverse_proxy code_server:8443 + } + } } registry.ginnoir.com { @@ -273,35 +326,62 @@ registry.ginnoir.com { } registry-ui.ginnoir.com { - import internal_only - reverse_proxy registry_ui:80 + route { + import authentik_outpost + handle { + import authentik_forward_auth + reverse_proxy registry_ui:80 + } + } } dbx.ginnoir.com { - import internal_only - reverse_proxy dbx:4224 + route { + import authentik_outpost + handle { + import authentik_forward_auth + reverse_proxy dbx:4224 + } + } } vault.ginnoir.com { - import internal_only - reverse_proxy vault:8200 + route { + import authentik_outpost + @vaultapi path /v1/* + handle @vaultapi { + reverse_proxy vault:8200 + } + handle { + import authentik_forward_auth + reverse_proxy vault:8200 + } + } } docs.ginnoir.com { - import internal_only - reverse_proxy bookstack:80 + route { + import authentik_outpost + handle { + import authentik_forward_auth + reverse_proxy bookstack:80 + } + } } plane.ginnoir.com { - import internal_only - handle /api/* { - reverse_proxy plane_api:8000 - } - handle /auth/* { - reverse_proxy plane_api:8000 - } - handle { - reverse_proxy plane_web:3000 + route { + import authentik_outpost + handle /api/* { + reverse_proxy plane_api:8000 + } + handle /auth/* { + reverse_proxy plane_api:8000 + } + handle { + import authentik_forward_auth + reverse_proxy plane_web:3000 + } } } diff --git a/plans/homelab-improvements/tasks/TB-006-authentik-forward-auth.md b/plans/homelab-improvements/tasks/TB-006-authentik-forward-auth.md index dd57e08..1bede1a 100644 --- a/plans/homelab-improvements/tasks/TB-006-authentik-forward-auth.md +++ b/plans/homelab-improvements/tasks/TB-006-authentik-forward-auth.md @@ -1,7 +1,7 @@ -# TB-006 — Authentik on admin UIs +# TB-006 — Authentik SSO at the edge -**Status:** not started -**Your call:** _(unset — talk first)_ +**Status:** batch 1 deployed (2026-06-10) — admin sites live; batches 2–3 pending +**Your call:** **Tweak → Do it** (2026-06-10) --- @@ -10,15 +10,34 @@ > **Stop.** Don't read Reference until we've talked. > In chat, say **"let's do TB-006"** or **"authentik on admin uis"**. -**In one sentence:** Require Authentik login before Portainer, code-server, registry, etc. +**In one sentence:** Every site that already shows its own login screen should authenticate through Authentik instead — without breaking webhooks, API keys, or Overseerr/Plex for friends. **Why it came up:** LAN-only IP checks aren't the same as identity — Authentik is already running for famapp. -### Questions +### Scope (decided 2026-06-10) -1. Which admin sites do you actually use? (No point gating ones you never open) -2. Portainer git webhooks must keep working — okay to test carefully? -3. Do this for everything internal, or just the scary ones (Portainer, code, vault)? +**In:** All Caddy-proxied sites with an app login UI → Caddy `forward_auth` to Authentik (or keep native OIDC where already wired, e.g. famapp). + +**Out / untouched:** + +- **Overseerr** (`requests.ginnoir.com`) — friends use Plex accounts; leave as-is. +- **Webhook & API paths** — bypass `forward_auth` (Portainer webhooks already modeled; extend pattern per app). +- **Static / no login** — 5etools, pf2e, ffttsystems, romhacks wiki files, etc. + +**Explicitly out (confirmed):** + +- **Obsidian/CouchDB** — tailnet-only (TB-005); LiveSync stays on CouchDB basic auth. +- **Foundry / Foundry2** — players use Foundry accounts; no Authentik. +- **Overseerr** — Plex login for friends. + +**Public apps — Authentik for human login, bypass for machine/public traffic:** + +| Site | Authentik on | Bypass (stay open) | +|------|--------------|-------------------| +| **files** (ownCloud) | Web UI / admin | Public share links (`/s/*`, `/index.php/s/*`); WebDAV if used by clients | +| **freshrss** | Web UI | Feed cron is in-container (no bypass needed); Reader/Fever/Google API paths use API password | +| **ntfy** | Web UI / account mgmt | Topic publish/subscribe (`POST`/`GET` topic paths, `/v1/*`); Vigilant + famapp push must keep working | +| **resume** | Builder / dashboard / login | Public resume pages (e.g. `/ginnoir/resume`); MinIO object GETs on `storage.j-costa.com` if public | ### Your options @@ -33,9 +52,9 @@ | | | |---|---| -| **Decision** | | -| **Notes** | | -| **Date** | | +| **Decision** | Do it — batch 1 admin deployed; batches 2–3 pending | +| **Notes** | Out: obsidian, foundry×2, overseerr. Batch 1: 12 admin sites + Caddy forward_auth + Authentik proxy providers. Push repo to persist authentik compose/blueprint changes. | +| **Date** | 2026-06-10 (batch 1 deployed) | --- @@ -48,13 +67,31 @@ Caddyfile + Authentik UI ### If we do it — rough steps -1. Authentik proxy provider + outpost -2. Caddy forward_auth snippet -3. Tier 1: portainer, code, registry-ui, vault, minio console +1. Authentik embedded outpost + proxy provider(s) on `edge` +2. Caddy `(authentik_auth)` snippet — `forward_auth authentik-server:9000` with trusted headers +3. Roll out site-by-site; per-site `handle` bypasses for webhooks/API (`/api/*` where key-auth, Portainer `/api/stacks/webhooks/*`, Gitea hooks, ntfy publish, etc.) +4. Disable or bypass redundant in-app login where the app supports it (optional second pass) + +**Rollout batches** + +| Batch | Sites | +|-------|-------| +| 1 — Admin | portainer, code, registry-ui, vault, minio, homarr, uptime, backup/kopia, gitea, dbx, bookstack, plane | +| 2 — Media | sonarr, radarr, bazarr, prowlarr, tautulli, qbit, deluge, nzbget, whisparr, stash | +| 3 — Public + login | files, freshrss, ntfy, resume (with bypass tables above) | +| 4 — Other internal | romm, router UI | +| Skip | famapp (OIDC done), auth.ginnoir.com, overseerr, obsidian, foundry×2, static sites | ### Done when -- [ ] Tier 1 sites require login -- [ ] Portainer webhooks still work +- [x] Batch 1 admin sites require Authentik before app UI loads +- [x] Portainer git webhooks still work (bypass path) +- [x] Gitea `/api/*` + `.git` and Vault `/v1/*` bypass forward_auth +- [ ] Batch 2 media sites +- [ ] Batch 3 public apps (ownCloud shares, FreshRSS, ntfy, resume) +- [ ] ownCloud share links work without Authentik session +- [ ] FreshRSS still refreshes feeds; Vigilant/famapp still publish to ntfy +- [ ] Public resume pages still viewable without Authentik +- [ ] Overseerr unchanged for Plex friends diff --git a/stacks/authentik/blueprints/homelab-forward-auth-admin.yaml b/stacks/authentik/blueprints/homelab-forward-auth-admin.yaml new file mode 100644 index 0000000..7bfaa75 --- /dev/null +++ b/stacks/authentik/blueprints/homelab-forward-auth-admin.yaml @@ -0,0 +1,353 @@ +# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json +# TB-006 batch 1 — forward-auth proxy providers for admin *.ginnoir.com sites. +version: 1 +metadata: + name: Homelab forward auth — admin batch 1 + labels: + blueprints.goauthentik.io/instantiate: "true" + +entries: + - model: authentik_providers_proxy.proxyprovider + state: present + identifiers: + name: homelab-portainer + attrs: + name: homelab-portainer + mode: forward_single + external_host: https://portainer.ginnoir.com + access_token_validity: hours=24 + token_validity: hours=24 + refresh_token_validity: days=30 + intercept_header_auth: true + internal_host_ssl_validation: true + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + + - model: authentik_core.application + state: present + identifiers: + slug: portainer + attrs: + name: Portainer + slug: portainer + meta_launch_url: https://portainer.ginnoir.com + policy_engine_mode: any + provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-portainer]] + + - model: authentik_providers_proxy.proxyprovider + state: present + identifiers: + name: homelab-code + attrs: + name: homelab-code + mode: forward_single + external_host: https://code.ginnoir.com + access_token_validity: hours=24 + token_validity: hours=24 + refresh_token_validity: days=30 + intercept_header_auth: true + internal_host_ssl_validation: true + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + + - model: authentik_core.application + state: present + identifiers: + slug: code + attrs: + name: code-server + slug: code + meta_launch_url: https://code.ginnoir.com + policy_engine_mode: any + provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-code]] + + - model: authentik_providers_proxy.proxyprovider + state: present + identifiers: + name: homelab-registry-ui + attrs: + name: homelab-registry-ui + mode: forward_single + external_host: https://registry-ui.ginnoir.com + access_token_validity: hours=24 + token_validity: hours=24 + refresh_token_validity: days=30 + intercept_header_auth: true + internal_host_ssl_validation: true + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + + - model: authentik_core.application + state: present + identifiers: + slug: registry-ui + attrs: + name: Registry UI + slug: registry-ui + meta_launch_url: https://registry-ui.ginnoir.com + policy_engine_mode: any + provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-registry-ui]] + + - model: authentik_providers_proxy.proxyprovider + state: present + identifiers: + name: homelab-vault + attrs: + name: homelab-vault + mode: forward_single + external_host: https://vault.ginnoir.com + access_token_validity: hours=24 + token_validity: hours=24 + refresh_token_validity: days=30 + intercept_header_auth: true + internal_host_ssl_validation: true + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + + - model: authentik_core.application + state: present + identifiers: + slug: vault + attrs: + name: Vault + slug: vault + meta_launch_url: https://vault.ginnoir.com + policy_engine_mode: any + provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-vault]] + + - model: authentik_providers_proxy.proxyprovider + state: present + identifiers: + name: homelab-minio + attrs: + name: homelab-minio + mode: forward_single + external_host: https://minio.ginnoir.com + access_token_validity: hours=24 + token_validity: hours=24 + refresh_token_validity: days=30 + intercept_header_auth: true + internal_host_ssl_validation: true + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + + - model: authentik_core.application + state: present + identifiers: + slug: minio + attrs: + name: MinIO Console + slug: minio + meta_launch_url: https://minio.ginnoir.com + policy_engine_mode: any + provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-minio]] + + - model: authentik_providers_proxy.proxyprovider + state: present + identifiers: + name: homelab-homarr + attrs: + name: homelab-homarr + mode: forward_single + external_host: https://homarr.ginnoir.com + access_token_validity: hours=24 + token_validity: hours=24 + refresh_token_validity: days=30 + intercept_header_auth: true + internal_host_ssl_validation: true + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + + - model: authentik_core.application + state: present + identifiers: + slug: homarr + attrs: + name: Homarr + slug: homarr + meta_launch_url: https://homarr.ginnoir.com + policy_engine_mode: any + provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-homarr]] + + - model: authentik_providers_proxy.proxyprovider + state: present + identifiers: + name: homelab-uptime + attrs: + name: homelab-uptime + mode: forward_single + external_host: https://uptime.ginnoir.com + access_token_validity: hours=24 + token_validity: hours=24 + refresh_token_validity: days=30 + intercept_header_auth: true + internal_host_ssl_validation: true + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + + - model: authentik_core.application + state: present + identifiers: + slug: uptime + attrs: + name: Uptime Kuma + slug: uptime + meta_launch_url: https://uptime.ginnoir.com + policy_engine_mode: any + provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-uptime]] + + - model: authentik_providers_proxy.proxyprovider + state: present + identifiers: + name: homelab-backup + attrs: + name: homelab-backup + mode: forward_single + external_host: https://backup.ginnoir.com + access_token_validity: hours=24 + token_validity: hours=24 + refresh_token_validity: days=30 + intercept_header_auth: true + internal_host_ssl_validation: true + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + + - model: authentik_core.application + state: present + identifiers: + slug: backup + attrs: + name: Kopia + slug: backup + meta_launch_url: https://backup.ginnoir.com + policy_engine_mode: any + provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-backup]] + + - model: authentik_providers_proxy.proxyprovider + state: present + identifiers: + name: homelab-gitea + attrs: + name: homelab-gitea + mode: forward_single + external_host: https://gitea.ginnoir.com + access_token_validity: hours=24 + token_validity: hours=24 + refresh_token_validity: days=30 + intercept_header_auth: true + internal_host_ssl_validation: true + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + + - model: authentik_core.application + state: present + identifiers: + slug: gitea + attrs: + name: Gitea + slug: gitea + meta_launch_url: https://gitea.ginnoir.com + policy_engine_mode: any + provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-gitea]] + + - model: authentik_providers_proxy.proxyprovider + state: present + identifiers: + name: homelab-dbx + attrs: + name: homelab-dbx + mode: forward_single + external_host: https://dbx.ginnoir.com + access_token_validity: hours=24 + token_validity: hours=24 + refresh_token_validity: days=30 + intercept_header_auth: true + internal_host_ssl_validation: true + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + + - model: authentik_core.application + state: present + identifiers: + slug: dbx + attrs: + name: DBX + slug: dbx + meta_launch_url: https://dbx.ginnoir.com + policy_engine_mode: any + provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-dbx]] + + - model: authentik_providers_proxy.proxyprovider + state: present + identifiers: + name: homelab-bookstack + attrs: + name: homelab-bookstack + mode: forward_single + external_host: https://docs.ginnoir.com + access_token_validity: hours=24 + token_validity: hours=24 + refresh_token_validity: days=30 + intercept_header_auth: true + internal_host_ssl_validation: true + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + + - model: authentik_core.application + state: present + identifiers: + slug: bookstack + attrs: + name: BookStack + slug: bookstack + meta_launch_url: https://docs.ginnoir.com + policy_engine_mode: any + provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-bookstack]] + + - model: authentik_providers_proxy.proxyprovider + state: present + identifiers: + name: homelab-plane + attrs: + name: homelab-plane + mode: forward_single + external_host: https://plane.ginnoir.com + access_token_validity: hours=24 + token_validity: hours=24 + refresh_token_validity: days=30 + intercept_header_auth: true + internal_host_ssl_validation: true + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + + - model: authentik_core.application + state: present + identifiers: + slug: plane + attrs: + name: Plane + slug: plane + meta_launch_url: https://plane.ginnoir.com + policy_engine_mode: any + provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-plane]] + + - model: authentik_outposts.outpost + state: present + identifiers: + name: authentik Embedded Outpost + attrs: + name: authentik Embedded Outpost + type: proxy + providers: + - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-portainer]] + - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-code]] + - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-registry-ui]] + - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-vault]] + - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-minio]] + - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-homarr]] + - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-uptime]] + - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-backup]] + - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-gitea]] + - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-dbx]] + - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-bookstack]] + - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-plane]] diff --git a/stacks/authentik/docker-compose.yml b/stacks/authentik/docker-compose.yml index a74ed6c..bdcc9cc 100644 --- a/stacks/authentik/docker-compose.yml +++ b/stacks/authentik/docker-compose.yml @@ -15,9 +15,12 @@ services: env_file: - stack.env environment: + AUTHENTIK_HOST: https://auth.ginnoir.com AUTHENTIK_REDIS__HOST: authentik-redis AUTHENTIK_POSTGRESQL__HOST: authentik-db AUTHENTIK_ERROR_REPORTING__ENABLED: "false" + volumes: + - ./blueprints:/blueprints/custom:ro ports: - "9200:9000" depends_on: diff --git a/stacks/authentik/scripts/apply-forward-auth-admin.py b/stacks/authentik/scripts/apply-forward-auth-admin.py new file mode 100644 index 0000000..c886f82 --- /dev/null +++ b/stacks/authentik/scripts/apply-forward-auth-admin.py @@ -0,0 +1,54 @@ +#!/usr/bin/env python3 +"""Apply TB-006 batch 1 proxy providers via authentik ORM (run: ak shell < script).""" +from authentik.core.models import Application +from authentik.flows.models import Flow +from authentik.outposts.models import Outpost, OutpostType +from authentik.providers.proxy.models import ProxyMode, ProxyProvider + +AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent") +INVALID = Flow.objects.get(slug="default-provider-invalidation-flow") + +SITES = [ + ("homelab-portainer", "portainer", "Portainer", "https://portainer.ginnoir.com"), + ("homelab-code", "code", "code-server", "https://code.ginnoir.com"), + ("homelab-registry-ui", "registry-ui", "Registry UI", "https://registry-ui.ginnoir.com"), + ("homelab-vault", "vault", "Vault", "https://vault.ginnoir.com"), + ("homelab-minio", "minio", "MinIO Console", "https://minio.ginnoir.com"), + ("homelab-homarr", "homarr", "Homarr", "https://homarr.ginnoir.com"), + ("homelab-uptime", "uptime", "Uptime Kuma", "https://uptime.ginnoir.com"), + ("homelab-backup", "backup", "Kopia", "https://backup.ginnoir.com"), + ("homelab-gitea", "gitea", "Gitea", "https://gitea.ginnoir.com"), + ("homelab-dbx", "dbx", "DBX", "https://dbx.ginnoir.com"), + ("homelab-bookstack", "bookstack", "BookStack", "https://docs.ginnoir.com"), + ("homelab-plane", "plane", "Plane", "https://plane.ginnoir.com"), +] + +providers = [] +for pname, slug, aname, host in SITES: + provider, _ = ProxyProvider.objects.update_or_create( + name=pname, + defaults={ + "mode": ProxyMode.FORWARD_SINGLE, + "external_host": host, + "authorization_flow": AUTHZ, + "invalidation_flow": INVALID, + "intercept_header_auth": True, + }, + ) + Application.objects.update_or_create( + slug=slug, + defaults={ + "name": aname, + "provider": provider, + "meta_launch_url": host, + "policy_engine_mode": "any", + }, + ) + providers.append(provider) + print(f"ok {slug} -> {host}") + +outpost = Outpost.objects.get(name="authentik Embedded Outpost") +outpost.type = OutpostType.PROXY +outpost.providers.set(providers) +outpost.save() +print(f"outpost providers: {outpost.providers.count()}") diff --git a/stacks/monitoring/docker-compose.yml b/stacks/monitoring/docker-compose.yml index 4f4cab0..4d87c89 100644 --- a/stacks/monitoring/docker-compose.yml +++ b/stacks/monitoring/docker-compose.yml @@ -25,9 +25,9 @@ services: - "7575:7575" volumes: - /var/run/docker.sock:/var/run/docker.sock - - /config/homarr/configs:/app/data/configs + # homarr-labs stores SQLite + redis under /appdata (not /data or /app/data/configs). + - /config/homarr/appdata:/appdata - /config/homarr/icons:/app/public/icons - - /config/homarr/data:/data networks: edge: