homelabstack/stacks/authentik/blueprints/homelab-forward-auth-admin.yaml

# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
# TB-006 batch 1 — forward-auth proxy providers for admin *.ginnoir.com sites.
version: 1
metadata:
  name: Homelab forward auth — admin batch 1
  labels:
    blueprints.goauthentik.io/instantiate: "true"

entries:
  - model: authentik_providers_proxy.proxyprovider
    state: present
    identifiers:
      name: homelab-portainer
    attrs:
      name: homelab-portainer
      mode: forward_single
      external_host: https://portainer.ginnoir.com
      access_token_validity: hours=24
      token_validity: hours=24
      refresh_token_validity: days=30
      intercept_header_auth: true
      internal_host_ssl_validation: true
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]

  - model: authentik_core.application
    state: present
    identifiers:
      slug: portainer
    attrs:
      name: Portainer
      slug: portainer
      meta_launch_url: https://portainer.ginnoir.com
      policy_engine_mode: any
      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-portainer]]

  - model: authentik_providers_proxy.proxyprovider
    state: present
    identifiers:
      name: homelab-code
    attrs:
      name: homelab-code
      mode: forward_single
      external_host: https://code.ginnoir.com
      access_token_validity: hours=24
      token_validity: hours=24
      refresh_token_validity: days=30
      intercept_header_auth: true
      internal_host_ssl_validation: true
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]

  - model: authentik_core.application
    state: present
    identifiers:
      slug: code
    attrs:
      name: code-server
      slug: code
      meta_launch_url: https://code.ginnoir.com
      policy_engine_mode: any
      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-code]]

  - model: authentik_providers_proxy.proxyprovider
    state: present
    identifiers:
      name: homelab-registry-ui
    attrs:
      name: homelab-registry-ui
      mode: forward_single
      external_host: https://registry-ui.ginnoir.com
      access_token_validity: hours=24
      token_validity: hours=24
      refresh_token_validity: days=30
      intercept_header_auth: true
      internal_host_ssl_validation: true
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]

  - model: authentik_core.application
    state: present
    identifiers:
      slug: registry-ui
    attrs:
      name: Registry UI
      slug: registry-ui
      meta_launch_url: https://registry-ui.ginnoir.com
      policy_engine_mode: any
      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-registry-ui]]

  - model: authentik_providers_proxy.proxyprovider
    state: present
    identifiers:
      name: homelab-vault
    attrs:
      name: homelab-vault
      mode: forward_single
      external_host: https://vault.ginnoir.com
      access_token_validity: hours=24
      token_validity: hours=24
      refresh_token_validity: days=30
      intercept_header_auth: true
      internal_host_ssl_validation: true
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]

  - model: authentik_core.application
    state: present
    identifiers:
      slug: vault
    attrs:
      name: Vault
      slug: vault
      meta_launch_url: https://vault.ginnoir.com
      policy_engine_mode: any
      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-vault]]

  - model: authentik_providers_proxy.proxyprovider
    state: present
    identifiers:
      name: homelab-minio
    attrs:
      name: homelab-minio
      mode: forward_single
      external_host: https://minio.ginnoir.com
      access_token_validity: hours=24
      token_validity: hours=24
      refresh_token_validity: days=30
      intercept_header_auth: true
      internal_host_ssl_validation: true
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]

  - model: authentik_core.application
    state: present
    identifiers:
      slug: minio
    attrs:
      name: MinIO Console
      slug: minio
      meta_launch_url: https://minio.ginnoir.com
      policy_engine_mode: any
      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-minio]]

  - model: authentik_providers_proxy.proxyprovider
    state: present
    identifiers:
      name: homelab-homarr
    attrs:
      name: homelab-homarr
      mode: forward_single
      external_host: https://homarr.ginnoir.com
      access_token_validity: hours=24
      token_validity: hours=24
      refresh_token_validity: days=30
      intercept_header_auth: true
      internal_host_ssl_validation: true
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]

  - model: authentik_core.application
    state: present
    identifiers:
      slug: homarr
    attrs:
      name: Homarr
      slug: homarr
      meta_launch_url: https://homarr.ginnoir.com
      policy_engine_mode: any
      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-homarr]]

  - model: authentik_providers_proxy.proxyprovider
    state: present
    identifiers:
      name: homelab-uptime
    attrs:
      name: homelab-uptime
      mode: forward_single
      external_host: https://uptime.ginnoir.com
      access_token_validity: hours=24
      token_validity: hours=24
      refresh_token_validity: days=30
      intercept_header_auth: true
      internal_host_ssl_validation: true
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]

  - model: authentik_core.application
    state: present
    identifiers:
      slug: uptime
    attrs:
      name: Uptime Kuma
      slug: uptime
      meta_launch_url: https://uptime.ginnoir.com
      policy_engine_mode: any
      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-uptime]]

  - model: authentik_providers_proxy.proxyprovider
    state: present
    identifiers:
      name: homelab-backup
    attrs:
      name: homelab-backup
      mode: forward_single
      external_host: https://backup.ginnoir.com
      access_token_validity: hours=24
      token_validity: hours=24
      refresh_token_validity: days=30
      intercept_header_auth: true
      internal_host_ssl_validation: true
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]

  - model: authentik_core.application
    state: present
    identifiers:
      slug: backup
    attrs:
      name: Kopia
      slug: backup
      meta_launch_url: https://backup.ginnoir.com
      policy_engine_mode: any
      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-backup]]

  - model: authentik_providers_proxy.proxyprovider
    state: present
    identifiers:
      name: homelab-gitea
    attrs:
      name: homelab-gitea
      mode: forward_single
      external_host: https://gitea.ginnoir.com
      access_token_validity: hours=24
      token_validity: hours=24
      refresh_token_validity: days=30
      intercept_header_auth: true
      internal_host_ssl_validation: true
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]

  - model: authentik_core.application
    state: present
    identifiers:
      slug: gitea
    attrs:
      name: Gitea
      slug: gitea
      meta_launch_url: https://gitea.ginnoir.com
      policy_engine_mode: any
      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-gitea]]

  - model: authentik_providers_proxy.proxyprovider
    state: present
    identifiers:
      name: homelab-dbx
    attrs:
      name: homelab-dbx
      mode: forward_single
      external_host: https://dbx.ginnoir.com
      access_token_validity: hours=24
      token_validity: hours=24
      refresh_token_validity: days=30
      intercept_header_auth: true
      internal_host_ssl_validation: true
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]

  - model: authentik_core.application
    state: present
    identifiers:
      slug: dbx
    attrs:
      name: DBX
      slug: dbx
      meta_launch_url: https://dbx.ginnoir.com
      policy_engine_mode: any
      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-dbx]]

  - model: authentik_providers_proxy.proxyprovider
    state: present
    identifiers:
      name: homelab-bookstack
    attrs:
      name: homelab-bookstack
      mode: forward_single
      external_host: https://docs.ginnoir.com
      access_token_validity: hours=24
      token_validity: hours=24
      refresh_token_validity: days=30
      intercept_header_auth: true
      internal_host_ssl_validation: true
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]

  - model: authentik_core.application
    state: present
    identifiers:
      slug: bookstack
    attrs:
      name: BookStack
      slug: bookstack
      meta_launch_url: https://docs.ginnoir.com
      policy_engine_mode: any
      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-bookstack]]

  - model: authentik_providers_proxy.proxyprovider
    state: present
    identifiers:
      name: homelab-plane
    attrs:
      name: homelab-plane
      mode: forward_single
      external_host: https://plane.ginnoir.com
      access_token_validity: hours=24
      token_validity: hours=24
      refresh_token_validity: days=30
      intercept_header_auth: true
      internal_host_ssl_validation: true
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]

  - model: authentik_core.application
    state: present
    identifiers:
      slug: plane
    attrs:
      name: Plane
      slug: plane
      meta_launch_url: https://plane.ginnoir.com
      policy_engine_mode: any
      provider: !Find [authentik_providers_proxy.proxyprovider, [name, homelab-plane]]

  - model: authentik_outposts.outpost
    state: present
    identifiers:
      name: authentik Embedded Outpost
    attrs:
      name: authentik Embedded Outpost
      type: proxy
      providers:
        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-portainer]]
        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-code]]
        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-registry-ui]]
        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-vault]]
        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-minio]]
        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-homarr]]
        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-uptime]]
        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-backup]]
        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-gitea]]
        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-dbx]]
        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-bookstack]]
        - !Find [authentik_providers_proxy.proxyprovider, [name, homelab-plane]]