Fix Homarr appdata bind mount and deploy Authentik forward auth on admin sites.

Homarr-labs stores state under /appdata; the old compose mapped empty paths and lost the dashboard on redeploy. TB-006 batch 1 adds Caddy forward_auth for 12 admin UIs with API and webhook bypasses.

stacks/authentik/blueprints/homelab-forward-auth-admin.yaml

@@ -0,0 +1,353 @@
+# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
+# TB-006 batch 1 — forward-auth proxy providers for admin *.ginnoir.com sites.
+version: 1
+metadata:
+  name: Homelab forward auth — admin batch 1
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+
+entries:
+  - model: authentik_providers_proxy.proxyprovider
+    state: present
+    identifiers:
+      name: homelab-portainer
+    attrs:
+      name: homelab-portainer
+      mode: forward_single
+      external_host: https://portainer.ginnoir.com
+      access_token_validity: hours=24
+      token_validity: hours=24
+      refresh_token_validity: days=30
+      intercept_header_auth: true
+      internal_host_ssl_validation: true
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: portainer
+    attrs:
+      name: Portainer
+      slug: portainer
+      meta_launch_url: https://portainer.ginnoir.com
+      policy_engine_mode: any
+      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-portainer]]
+
+  - model: authentik_providers_proxy.proxyprovider
+    state: present
+    identifiers:
+      name: homelab-code
+    attrs:
+      name: homelab-code
+      mode: forward_single
+      external_host: https://code.ginnoir.com
+      access_token_validity: hours=24
+      token_validity: hours=24
+      refresh_token_validity: days=30
+      intercept_header_auth: true
+      internal_host_ssl_validation: true
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: code
+    attrs:
+      name: code-server
+      slug: code
+      meta_launch_url: https://code.ginnoir.com
+      policy_engine_mode: any
+      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-code]]
+
+  - model: authentik_providers_proxy.proxyprovider
+    state: present
+    identifiers:
+      name: homelab-registry-ui
+    attrs:
+      name: homelab-registry-ui
+      mode: forward_single
+      external_host: https://registry-ui.ginnoir.com
+      access_token_validity: hours=24
+      token_validity: hours=24
+      refresh_token_validity: days=30
+      intercept_header_auth: true
+      internal_host_ssl_validation: true
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: registry-ui
+    attrs:
+      name: Registry UI
+      slug: registry-ui
+      meta_launch_url: https://registry-ui.ginnoir.com
+      policy_engine_mode: any
+      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-registry-ui]]
+
+  - model: authentik_providers_proxy.proxyprovider
+    state: present
+    identifiers:
+      name: homelab-vault
+    attrs:
+      name: homelab-vault
+      mode: forward_single
+      external_host: https://vault.ginnoir.com
+      access_token_validity: hours=24
+      token_validity: hours=24
+      refresh_token_validity: days=30
+      intercept_header_auth: true
+      internal_host_ssl_validation: true
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: vault
+    attrs:
+      name: Vault
+      slug: vault
+      meta_launch_url: https://vault.ginnoir.com
+      policy_engine_mode: any
+      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-vault]]
+
+  - model: authentik_providers_proxy.proxyprovider
+    state: present
+    identifiers:
+      name: homelab-minio
+    attrs:
+      name: homelab-minio
+      mode: forward_single
+      external_host: https://minio.ginnoir.com
+      access_token_validity: hours=24
+      token_validity: hours=24
+      refresh_token_validity: days=30
+      intercept_header_auth: true
+      internal_host_ssl_validation: true
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: minio
+    attrs:
+      name: MinIO Console
+      slug: minio
+      meta_launch_url: https://minio.ginnoir.com
+      policy_engine_mode: any
+      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-minio]]
+
+  - model: authentik_providers_proxy.proxyprovider
+    state: present
+    identifiers:
+      name: homelab-homarr
+    attrs:
+      name: homelab-homarr
+      mode: forward_single
+      external_host: https://homarr.ginnoir.com
+      access_token_validity: hours=24
+      token_validity: hours=24
+      refresh_token_validity: days=30
+      intercept_header_auth: true
+      internal_host_ssl_validation: true
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: homarr
+    attrs:
+      name: Homarr
+      slug: homarr
+      meta_launch_url: https://homarr.ginnoir.com
+      policy_engine_mode: any
+      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-homarr]]
+
+  - model: authentik_providers_proxy.proxyprovider
+    state: present
+    identifiers:
+      name: homelab-uptime
+    attrs:
+      name: homelab-uptime
+      mode: forward_single
+      external_host: https://uptime.ginnoir.com
+      access_token_validity: hours=24
+      token_validity: hours=24
+      refresh_token_validity: days=30
+      intercept_header_auth: true
+      internal_host_ssl_validation: true
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: uptime
+    attrs:
+      name: Uptime Kuma
+      slug: uptime
+      meta_launch_url: https://uptime.ginnoir.com
+      policy_engine_mode: any
+      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-uptime]]
+
+  - model: authentik_providers_proxy.proxyprovider
+    state: present
+    identifiers:
+      name: homelab-backup
+    attrs:
+      name: homelab-backup
+      mode: forward_single
+      external_host: https://backup.ginnoir.com
+      access_token_validity: hours=24
+      token_validity: hours=24
+      refresh_token_validity: days=30
+      intercept_header_auth: true
+      internal_host_ssl_validation: true
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: backup
+    attrs:
+      name: Kopia
+      slug: backup
+      meta_launch_url: https://backup.ginnoir.com
+      policy_engine_mode: any
+      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-backup]]
+
+  - model: authentik_providers_proxy.proxyprovider
+    state: present
+    identifiers:
+      name: homelab-gitea
+    attrs:
+      name: homelab-gitea
+      mode: forward_single
+      external_host: https://gitea.ginnoir.com
+      access_token_validity: hours=24
+      token_validity: hours=24
+      refresh_token_validity: days=30
+      intercept_header_auth: true
+      internal_host_ssl_validation: true
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: gitea
+    attrs:
+      name: Gitea
+      slug: gitea
+      meta_launch_url: https://gitea.ginnoir.com
+      policy_engine_mode: any
+      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-gitea]]
+
+  - model: authentik_providers_proxy.proxyprovider
+    state: present
+    identifiers:
+      name: homelab-dbx
+    attrs:
+      name: homelab-dbx
+      mode: forward_single
+      external_host: https://dbx.ginnoir.com
+      access_token_validity: hours=24
+      token_validity: hours=24
+      refresh_token_validity: days=30
+      intercept_header_auth: true
+      internal_host_ssl_validation: true
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: dbx
+    attrs:
+      name: DBX
+      slug: dbx
+      meta_launch_url: https://dbx.ginnoir.com
+      policy_engine_mode: any
+      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-dbx]]
+
+  - model: authentik_providers_proxy.proxyprovider
+    state: present
+    identifiers:
+      name: homelab-bookstack
+    attrs:
+      name: homelab-bookstack
+      mode: forward_single
+      external_host: https://docs.ginnoir.com
+      access_token_validity: hours=24
+      token_validity: hours=24
+      refresh_token_validity: days=30
+      intercept_header_auth: true
+      internal_host_ssl_validation: true
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: bookstack
+    attrs:
+      name: BookStack
+      slug: bookstack
+      meta_launch_url: https://docs.ginnoir.com
+      policy_engine_mode: any
+      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-bookstack]]
+
+  - model: authentik_providers_proxy.proxyprovider
+    state: present
+    identifiers:
+      name: homelab-plane
+    attrs:
+      name: homelab-plane
+      mode: forward_single
+      external_host: https://plane.ginnoir.com
+      access_token_validity: hours=24
+      token_validity: hours=24
+      refresh_token_validity: days=30
+      intercept_header_auth: true
+      internal_host_ssl_validation: true
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: plane
+    attrs:
+      name: Plane
+      slug: plane
+      meta_launch_url: https://plane.ginnoir.com
+      policy_engine_mode: any
+      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-plane]]
+
+  - model: authentik_outposts.outpost
+    state: present
+    identifiers:
+      name: authentik Embedded Outpost
+    attrs:
+      name: authentik Embedded Outpost
+      type: proxy
+      providers:
+        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-portainer]]
+        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-code]]
+        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-registry-ui]]
+        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-vault]]
+        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-minio]]
+        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-homarr]]
+        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-uptime]]
+        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-backup]]
+        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-gitea]]
+        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-dbx]]
+        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-bookstack]]
+        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-plane]]

stacks/authentik/docker-compose.yml

@@ -15,9 +15,12 @@ services:
     env_file:
       - stack.env
     environment:
+      AUTHENTIK_HOST: https://auth.ginnoir.com
       AUTHENTIK_REDIS__HOST: authentik-redis
       AUTHENTIK_POSTGRESQL__HOST: authentik-db
       AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
+    volumes:
+      - ./blueprints:/blueprints/custom:ro
     ports:
       - "9200:9000"
     depends_on:

stacks/authentik/scripts/apply-forward-auth-admin.py

@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+"""Apply TB-006 batch 1 proxy providers via authentik ORM (run: ak shell < script)."""
+from authentik.core.models import Application
+from authentik.flows.models import Flow
+from authentik.outposts.models import Outpost, OutpostType
+from authentik.providers.proxy.models import ProxyMode, ProxyProvider
+
+AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
+INVALID = Flow.objects.get(slug="default-provider-invalidation-flow")
+
+SITES = [
+    ("homelab-portainer", "portainer", "Portainer", "https://portainer.ginnoir.com"),
+    ("homelab-code", "code", "code-server", "https://code.ginnoir.com"),
+    ("homelab-registry-ui", "registry-ui", "Registry UI", "https://registry-ui.ginnoir.com"),
+    ("homelab-vault", "vault", "Vault", "https://vault.ginnoir.com"),
+    ("homelab-minio", "minio", "MinIO Console", "https://minio.ginnoir.com"),
+    ("homelab-homarr", "homarr", "Homarr", "https://homarr.ginnoir.com"),
+    ("homelab-uptime", "uptime", "Uptime Kuma", "https://uptime.ginnoir.com"),
+    ("homelab-backup", "backup", "Kopia", "https://backup.ginnoir.com"),
+    ("homelab-gitea", "gitea", "Gitea", "https://gitea.ginnoir.com"),
+    ("homelab-dbx", "dbx", "DBX", "https://dbx.ginnoir.com"),
+    ("homelab-bookstack", "bookstack", "BookStack", "https://docs.ginnoir.com"),
+    ("homelab-plane", "plane", "Plane", "https://plane.ginnoir.com"),
+]
+
+providers = []
+for pname, slug, aname, host in SITES:
+    provider, _ = ProxyProvider.objects.update_or_create(
+        name=pname,
+        defaults={
+            "mode": ProxyMode.FORWARD_SINGLE,
+            "external_host": host,
+            "authorization_flow": AUTHZ,
+            "invalidation_flow": INVALID,
+            "intercept_header_auth": True,
+        },
+    )
+    Application.objects.update_or_create(
+        slug=slug,
+        defaults={
+            "name": aname,
+            "provider": provider,
+            "meta_launch_url": host,
+            "policy_engine_mode": "any",
+        },
+    )
+    providers.append(provider)
+    print(f"ok {slug} -> {host}")
+
+outpost = Outpost.objects.get(name="authentik Embedded Outpost")
+outpost.type = OutpostType.PROXY
+outpost.providers.set(providers)
+outpost.save()
+print(f"outpost providers: {outpost.providers.count()}")

stacks/monitoring/docker-compose.yml

@@ -25,9 +25,9 @@ services:
       - "7575:7575"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - /config/homarr/configs:/app/data/configs
+      # homarr-labs stores SQLite + redis under /appdata (not /data or /app/data/configs).
+      - /config/homarr/appdata:/appdata
       - /config/homarr/icons:/app/public/icons
-      - /config/homarr/data:/data
 
 networks:
   edge: