Complete TB-006 batch 1 SSO so admin apps use Authentik without double login.

Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.
2026-06-10 23:52:14 -05:00
parent 109cc0d5cb
commit 63889fc150
19 changed files with 424 additions and 94 deletions
@@ -0,0 +1,59 @@
+"""Update proxy providers for forward_auth-only batch-1 apps (ak shell: exec(open(...).read()))."""
+from authentik.core.models import Application
+from authentik.flows.models import Flow
+from authentik.outposts.models import Outpost, OutpostType
+from authentik.providers.proxy.models import ProxyMode, ProxyProvider
+
+AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
+INVALID = Flow.objects.get(slug="default-provider-invalidation-flow")
+
+UPTIME_UNAUTH = """^/status/.*
+^/assets/.*
+^/api/push/.*
+^/api/badge/.*
+^/api/status-page/heartbeat/.*
+^/icon.svg
+^/upload/.*"""
+
+# Proxy-only sites (native OIDC apps managed by setup-batch1-oidc.py).
+SITES = [
+    ("homelab-code", "code", "code-server", "https://code.ginnoir.com", None, None),
+    ("homelab-registry-ui", "registry-ui", "Registry UI", "https://registry-ui.ginnoir.com", None, None),
+    ("homelab-vault", "vault", "Vault", "https://vault.ginnoir.com", None, None),
+    ("homelab-uptime", "uptime", "Uptime Kuma", "https://uptime.ginnoir.com", "http://uptime-kuma:3001", UPTIME_UNAUTH),
+    ("homelab-backup", "backup", "Kopia", "https://backup.ginnoir.com", None, None),
+    ("homelab-dbx", "dbx", "DBX", "https://dbx.ginnoir.com", None, None),
+]
+
+providers = []
+for pname, slug, aname, host, internal, unauth in SITES:
+    defaults = {
+        "mode": ProxyMode.FORWARD_SINGLE,
+        "external_host": host,
+        "authorization_flow": AUTHZ,
+        "invalidation_flow": INVALID,
+        "intercept_header_auth": True,
+    }
+    if internal:
+        defaults["internal_host"] = internal
+    if unauth:
+        defaults["skip_path_regex"] = unauth
+
+    provider, _ = ProxyProvider.objects.update_or_create(name=pname, defaults=defaults)
+    Application.objects.update_or_create(
+        slug=slug,
+        defaults={
+            "name": aname,
+            "provider": provider,
+            "meta_launch_url": host,
+            "policy_engine_mode": "any",
+        },
+    )
+    providers.append(provider)
+    print(f"ok {slug} -> {host}")
+
+outpost = Outpost.objects.get(name="authentik Embedded Outpost")
+outpost.type = OutpostType.PROXY
+outpost.providers.set(providers)
+outpost.save()
+print(f"outpost providers: {outpost.providers.count()}")