Complete TB-006 batch 1 SSO so admin apps use Authentik without double login.

Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.
2026-06-10 23:52:14 -05:00
parent 109cc0d5cb
commit 63889fc150
19 changed files with 424 additions and 94 deletions
@@ -44,7 +44,5 @@ else
  echo "init-kopia: B2 credentials empty — start UI only; configure repo manually (see README)"
 fi

-# Web UI uses HTTP basic auth (distinct from repository encryption password).
-exec kopia server start --ui --insecure --address=0.0.0.0:51515 \
-  --server-username=kopia \
-  --server-password="${KOPIA_PASSWORD}"
+# Web UI auth is handled by Caddy forward_auth — no second login prompt.
+exec kopia server start --ui --insecure --address=0.0.0.0:51515 --without-password