Complete TB-006 batch 1 SSO so admin apps use Authentik without double login.

Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.
2026-06-10 23:52:14 -05:00
parent 109cc0d5cb
commit 63889fc150
19 changed files with 424 additions and 94 deletions
@@ -0,0 +1,77 @@
+"""Create OAuth2 providers for batch-1 apps with native SSO (ak shell: exec(open(...).read()))."""
+from authentik.core.models import Application
+from authentik.flows.models import Flow
+from authentik.outposts.models import Outpost
+from authentik.providers.oauth2.models import OAuth2Provider, RedirectURI, RedirectURIMatchingMode
+from authentik.providers.proxy.models import ProxyProvider
+
+AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
+INVALID = Flow.objects.get(slug="default-provider-invalidation-flow")
+DEFAULT_MAPPINGS = OAuth2Provider.objects.get(name="famapp").property_mappings.all()
+
+# slug, provider name, redirect URI(s)
+OIDC_APPS = [
+    ("bookstack", "bookstack", ["https://docs.ginnoir.com/oidc/callback"]),
+    ("gitea", "gitea", ["https://gitea.ginnoir.com/user/oauth2/Authentik/callback"]),
+    ("portainer", "portainer", ["https://portainer.ginnoir.com/"]),
+    ("minio", "minio-console", ["https://minio.ginnoir.com/oauth_callback"]),
+    ("plane", "plane", ["https://plane.ginnoir.com/auth/oidc/callback/"]),
+]
+
+native_slugs = []
+for slug, pname, redirects in OIDC_APPS:
+    provider, created = OAuth2Provider.objects.update_or_create(
+        name=pname,
+        defaults={
+            "authorization_flow": AUTHZ,
+            "invalidation_flow": INVALID,
+            "redirect_uris": [
+                RedirectURI(matching_mode=RedirectURIMatchingMode.STRICT, url=url)
+                for url in redirects
+            ],
+            "access_code_validity": "minutes=1",
+            "access_token_validity": "hours=24",
+            "refresh_token_validity": "days=30",
+        },
+    )
+    provider.property_mappings.set(DEFAULT_MAPPINGS)
+    provider.save()
+
+    app, _ = Application.objects.update_or_create(
+        slug=slug,
+        defaults={
+            "name": pname.replace("-", " ").title(),
+            "provider": provider,
+            "meta_launch_url": redirects[0].split("/oidc")[0].split("/user/oauth2")[0].rstrip("/"),
+            "policy_engine_mode": "any",
+        },
+    )
+    app.provider = provider
+    app.save()
+
+    native_slugs.append(slug)
+    print(f"oauth2 {slug} created={created} client_id={provider.client_id}")
+    print(f"  {slug.upper()}_OIDC_CLIENT_ID={provider.client_id}")
+    print(f"  {slug.upper()}_OIDC_CLIENT_SECRET={provider.client_secret}")
+
+# Drop native-OIDC apps from the embedded proxy outpost (avoid double auth).
+PROXY_NAMES = {
+    "bookstack": "homelab-bookstack",
+    "gitea": "homelab-gitea",
+    "portainer": "homelab-portainer",
+    "minio": "homelab-minio",
+    "plane": "homelab-plane",
+}
+outpost = Outpost.objects.get(name="authentik Embedded Outpost")
+for slug in native_slugs:
+    pname = PROXY_NAMES.get(slug)
+    if not pname:
+        continue
+    try:
+        proxy = ProxyProvider.objects.get(name=pname)
+        outpost.providers.remove(proxy)
+        print(f"removed proxy {pname} from embedded outpost")
+    except ProxyProvider.DoesNotExist:
+        print(f"proxy {pname} not found (ok)")
+
+print("done — configure each app with printed client_id/secret")