Fix Homarr appdata bind mount and deploy Authentik forward auth on admin sites.
Deploy to valhalla / deploy (push) Has been cancelled
Deploy to valhalla / deploy (push) Has been cancelled
Homarr-labs stores state under /appdata; the old compose mapped empty paths and lost the dashboard on redeploy. TB-006 batch 1 adds Caddy forward_auth for 12 admin UIs with API and webhook bypasses.
This commit is contained in:
ginnoir
@@ -1,7 +1,7 @@
|
||||
# TB-006 — Authentik on admin UIs
|
||||
# TB-006 — Authentik SSO at the edge
|
||||
|
||||
**Status:** not started
|
||||
**Your call:** _(unset — talk first)_
|
||||
**Status:** batch 1 deployed (2026-06-10) — admin sites live; batches 2–3 pending
|
||||
**Your call:** **Tweak → Do it** (2026-06-10)
|
||||
|
||||
---
|
||||
|
||||
@@ -10,15 +10,34 @@
|
||||
> **Stop.** Don't read Reference until we've talked.
|
||||
> In chat, say **"let's do TB-006"** or **"authentik on admin uis"**.
|
||||
|
||||
**In one sentence:** Require Authentik login before Portainer, code-server, registry, etc.
|
||||
**In one sentence:** Every site that already shows its own login screen should authenticate through Authentik instead — without breaking webhooks, API keys, or Overseerr/Plex for friends.
|
||||
|
||||
**Why it came up:** LAN-only IP checks aren't the same as identity — Authentik is already running for famapp.
|
||||
|
||||
### Questions
|
||||
### Scope (decided 2026-06-10)
|
||||
|
||||
1. Which admin sites do you actually use? (No point gating ones you never open)
|
||||
2. Portainer git webhooks must keep working — okay to test carefully?
|
||||
3. Do this for everything internal, or just the scary ones (Portainer, code, vault)?
|
||||
**In:** All Caddy-proxied sites with an app login UI → Caddy `forward_auth` to Authentik (or keep native OIDC where already wired, e.g. famapp).
|
||||
|
||||
**Out / untouched:**
|
||||
|
||||
- **Overseerr** (`requests.ginnoir.com`) — friends use Plex accounts; leave as-is.
|
||||
- **Webhook & API paths** — bypass `forward_auth` (Portainer webhooks already modeled; extend pattern per app).
|
||||
- **Static / no login** — 5etools, pf2e, ffttsystems, romhacks wiki files, etc.
|
||||
|
||||
**Explicitly out (confirmed):**
|
||||
|
||||
- **Obsidian/CouchDB** — tailnet-only (TB-005); LiveSync stays on CouchDB basic auth.
|
||||
- **Foundry / Foundry2** — players use Foundry accounts; no Authentik.
|
||||
- **Overseerr** — Plex login for friends.
|
||||
|
||||
**Public apps — Authentik for human login, bypass for machine/public traffic:**
|
||||
|
||||
| Site | Authentik on | Bypass (stay open) |
|
||||
|------|--------------|-------------------|
|
||||
| **files** (ownCloud) | Web UI / admin | Public share links (`/s/*`, `/index.php/s/*`); WebDAV if used by clients |
|
||||
| **freshrss** | Web UI | Feed cron is in-container (no bypass needed); Reader/Fever/Google API paths use API password |
|
||||
| **ntfy** | Web UI / account mgmt | Topic publish/subscribe (`POST`/`GET` topic paths, `/v1/*`); Vigilant + famapp push must keep working |
|
||||
| **resume** | Builder / dashboard / login | Public resume pages (e.g. `/ginnoir/resume`); MinIO object GETs on `storage.j-costa.com` if public |
|
||||
|
||||
### Your options
|
||||
|
||||
@@ -33,9 +52,9 @@
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Decision** | |
|
||||
| **Notes** | |
|
||||
| **Date** | |
|
||||
| **Decision** | Do it — batch 1 admin deployed; batches 2–3 pending |
|
||||
| **Notes** | Out: obsidian, foundry×2, overseerr. Batch 1: 12 admin sites + Caddy forward_auth + Authentik proxy providers. Push repo to persist authentik compose/blueprint changes. |
|
||||
| **Date** | 2026-06-10 (batch 1 deployed) |
|
||||
|
||||
---
|
||||
|
||||
@@ -48,13 +67,31 @@ Caddyfile + Authentik UI
|
||||
|
||||
### If we do it — rough steps
|
||||
|
||||
1. Authentik proxy provider + outpost
|
||||
2. Caddy forward_auth snippet
|
||||
3. Tier 1: portainer, code, registry-ui, vault, minio console
|
||||
1. Authentik embedded outpost + proxy provider(s) on `edge`
|
||||
2. Caddy `(authentik_auth)` snippet — `forward_auth authentik-server:9000` with trusted headers
|
||||
3. Roll out site-by-site; per-site `handle` bypasses for webhooks/API (`/api/*` where key-auth, Portainer `/api/stacks/webhooks/*`, Gitea hooks, ntfy publish, etc.)
|
||||
4. Disable or bypass redundant in-app login where the app supports it (optional second pass)
|
||||
|
||||
**Rollout batches**
|
||||
|
||||
| Batch | Sites |
|
||||
|-------|-------|
|
||||
| 1 — Admin | portainer, code, registry-ui, vault, minio, homarr, uptime, backup/kopia, gitea, dbx, bookstack, plane |
|
||||
| 2 — Media | sonarr, radarr, bazarr, prowlarr, tautulli, qbit, deluge, nzbget, whisparr, stash |
|
||||
| 3 — Public + login | files, freshrss, ntfy, resume (with bypass tables above) |
|
||||
| 4 — Other internal | romm, router UI |
|
||||
| Skip | famapp (OIDC done), auth.ginnoir.com, overseerr, obsidian, foundry×2, static sites |
|
||||
|
||||
### Done when
|
||||
|
||||
- [ ] Tier 1 sites require login
|
||||
- [ ] Portainer webhooks still work
|
||||
- [x] Batch 1 admin sites require Authentik before app UI loads
|
||||
- [x] Portainer git webhooks still work (bypass path)
|
||||
- [x] Gitea `/api/*` + `.git` and Vault `/v1/*` bypass forward_auth
|
||||
- [ ] Batch 2 media sites
|
||||
- [ ] Batch 3 public apps (ownCloud shares, FreshRSS, ntfy, resume)
|
||||
- [ ] ownCloud share links work without Authentik session
|
||||
- [ ] FreshRSS still refreshes feeds; Vigilant/famapp still publish to ntfy
|
||||
- [ ] Public resume pages still viewable without Authentik
|
||||
- [ ] Overseerr unchanged for Plex friends
|
||||
|
||||
</details>
|
||||
|
||||
Reference in New Issue
Block a user