ginnoir/homelabstack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Complete TB-006 batch 1 SSO so admin apps use Authentik without double login.
Deploy to valhalla / deploy (push) Has been cancelled
Details

Browse Source 
Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.
This commit is contained in:
ginnoir
2026-06-10 23:52:14 -05:00
parent 109cc0d5cb
commit 63889fc150
19 changed files with 424 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plans/homelab-improvements/tasks/TB-006-authentik-forward-auth.md
+11 -4
View File
@@ -53,7 +53,7 @@
| | |
|---|---|
| **Decision** | Do it — batch 1 admin deployed; batches 2–3 pending |
| **Notes** | Out: obsidian, foundry×2, overseerr. Batch 1: 12 admin sites + Caddy forward_auth + Authentik proxy providers. Push repo to persist authentik compose/blueprint changes. |
| **Notes** | Out: obsidian, foundry×2, overseerr. Batch 1: homarr native OIDC done; rest split native OAuth vs forward_auth+disable local auth (2026-06-11). Portainer needs one-time OAuth in UI; Plane needs god-mode OIDC. Push repo to persist. |
| **Date** | 2026-06-10 (batch 1 deployed) |
---
@@ -69,8 +69,9 @@ Caddyfile + Authentik UI
1. Authentik embedded outpost + proxy provider(s) on `edge`
2. Caddy `(authentik_auth)` snippet — `forward_auth authentik-server:9000` with trusted headers
3. Roll out site-by-site; per-site `handle` bypasses for webhooks/API (`/api/*` where key-auth, Portainer `/api/stacks/webhooks/*`, Gitea hooks, ntfy publish, etc.)
4. Disable or bypass redundant in-app login where the app supports it (optional second pass)
3. Roll out site-by-site; per-site `handle` bypasses for webhooks/API
4. **Important:** `forward_auth` only gates the edge — apps still show their own login unless you add **native OIDC/OAuth** (famapp/homarr pattern) or disable local auth (e.g. code-server `--auth none`). Homarr switched to native OIDC 2026-06-11.
5. **Batch 1 rest (2026-06-11):** BookStack/Gitea/MinIO/Portainer/Plane → native OAuth2 providers; code/uptime/kopia/registry-ui/dbx/vault → forward_auth with local auth disabled where possible. **Portainer:** one-time OAuth setup in Settings → Authentication (see `setup-batch1-oidc.py` output). **Plane:** god-mode at `/god-mode/authentication/oidc`.
**Rollout batches**
@@ -84,7 +85,13 @@ Caddyfile + Authentik UI
### Done when
- [x] Batch 1 admin sites require Authentik before app UI loads
- [x] Batch 1 admin sites require Authentik before app UI loads (or native OAuth equivalent)
- [x] Homarr native OIDC (no double login)
- [x] BookStack, Gitea, MinIO console → native Authentik OAuth/OIDC
- [x] code-server, uptime, kopia → forward_auth only (local auth disabled)
- [x] registry-ui, dbx, vault → forward_auth at edge
- [ ] Portainer OAuth configured in Settings → Authentication (provider created; UI step pending)
- [ ] Plane OIDC configured in god-mode (provider created; UI step pending)
- [x] Portainer git webhooks still work (bypass path)
- [x] Gitea `/api/*` + `.git` and Vault `/v1/*` bypass forward_auth
- [ ] Batch 2 media sites