Complete TB-006 batch 1 SSO so admin apps use Authentik without double login.

Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.
2026-06-10 23:52:14 -05:00
parent 109cc0d5cb
commit 63889fc150
19 changed files with 424 additions and 94 deletions
@@ -38,6 +38,12 @@ services:
      - /storage1/labdata/resume/minio:/data
    env_file:
      - stack.env
+    environment:
+      - MINIO_BROWSER_REDIRECT_URL=https://minio.ginnoir.com
+      - MINIO_IDENTITY_OPENID_CONFIG_URL=https://auth.ginnoir.com/application/o/minio/.well-known/openid-configuration
+      - MINIO_IDENTITY_OPENID_CLIENT_ID=${MINIO_OIDC_CLIENT_ID}
+      - MINIO_IDENTITY_OPENID_CLIENT_SECRET=${MINIO_OIDC_CLIENT_SECRET}
+      - MINIO_IDENTITY_OPENID_SCOPES=openid,profile,email
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:9000/minio/health/live || exit 1"]
      interval: 30s