ginnoir
1ce63153ab
Media sites get Caddy forward_auth; Authentik scripts cover all proxy providers. BookStack OIDC and Plane admin routing fixes included, plus ops scripts for external auth on valhalla.
77 lines
3.3 KiB
Python
77 lines
3.3 KiB
Python
#!/usr/bin/env python3
|
|
"""Apply TB-006 forward_auth proxy providers (admin batch 1 + media batch 2).
|
|
|
|
Native OAuth/OIDC apps (bookstack, gitea, portainer, minio, homarr) use
|
|
setup-batch1-oidc.py instead. Run this via: ak shell -c exec(open(...).read())
|
|
"""
|
|
from authentik.core.models import Application
|
|
from authentik.flows.models import Flow
|
|
from authentik.outposts.models import Outpost, OutpostType
|
|
from authentik.providers.proxy.models import ProxyMode, ProxyProvider
|
|
|
|
AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
|
|
INVALID = Flow.objects.get(slug="default-provider-invalidation-flow")
|
|
|
|
UPTIME_UNAUTH = """^/status/.*
|
|
^/assets/.*
|
|
^/api/push/.*
|
|
^/api/badge/.*
|
|
^/api/status-page/heartbeat/.*
|
|
^/icon.svg
|
|
^/upload/.*"""
|
|
|
|
SITES = [
|
|
# Batch 1 — admin
|
|
("homelab-code", "code", "code-server", "https://code.ginnoir.com", None, None),
|
|
("homelab-registry-ui", "registry-ui", "Registry UI", "https://registry-ui.ginnoir.com", None, None),
|
|
("homelab-vault", "vault", "Vault", "https://vault.ginnoir.com", None, None),
|
|
("homelab-uptime", "uptime", "Uptime Kuma", "https://uptime.ginnoir.com", "http://uptime-kuma:3001", UPTIME_UNAUTH),
|
|
("homelab-backup", "backup", "Kopia", "https://backup.ginnoir.com", None, None),
|
|
("homelab-dbx", "dbx", "DBX", "https://dbx.ginnoir.com", None, None),
|
|
("homelab-plane", "plane", "Plane", "https://plane.ginnoir.com", None, None),
|
|
# Batch 2 — media *arr stack (internal_only + forward_auth at Caddy)
|
|
("homelab-sonarr", "sonarr", "Sonarr", "https://sonarr.ginnoir.com", None, None),
|
|
("homelab-radarr", "radarr", "Radarr", "https://radarr.ginnoir.com", None, None),
|
|
("homelab-bazarr", "bazarr", "Bazarr", "https://bazarr.ginnoir.com", None, None),
|
|
("homelab-prowlarr", "prowlarr", "Prowlarr", "https://prowlarr.ginnoir.com", None, None),
|
|
("homelab-tautulli", "tautulli", "Tautulli", "https://tautulli.ginnoir.com", None, None),
|
|
("homelab-qbit", "qbit", "qBittorrent", "https://qbittorrent.ginnoir.com", None, None),
|
|
("homelab-deluge", "deluge", "Deluge", "https://deluge.ginnoir.com", None, None),
|
|
("homelab-nzbget", "nzbget", "NZBGet", "https://nzbget.ginnoir.com", None, None),
|
|
("homelab-whisparr", "whisparr", "Whisparr", "https://whisparr.ginnoir.com", None, None),
|
|
("homelab-stash", "stash", "Stash", "https://stash.ginnoir.com", None, None),
|
|
]
|
|
|
|
providers = []
|
|
for pname, slug, aname, host, internal, unauth in SITES:
|
|
defaults = {
|
|
"mode": ProxyMode.FORWARD_SINGLE,
|
|
"external_host": host,
|
|
"authorization_flow": AUTHZ,
|
|
"invalidation_flow": INVALID,
|
|
"intercept_header_auth": True,
|
|
}
|
|
if internal:
|
|
defaults["internal_host"] = internal
|
|
if unauth:
|
|
defaults["skip_path_regex"] = unauth
|
|
|
|
provider, _ = ProxyProvider.objects.update_or_create(name=pname, defaults=defaults)
|
|
Application.objects.update_or_create(
|
|
slug=slug,
|
|
defaults={
|
|
"name": aname,
|
|
"provider": provider,
|
|
"meta_launch_url": host,
|
|
"policy_engine_mode": "any",
|
|
},
|
|
)
|
|
providers.append(provider)
|
|
print(f"ok {slug} -> {host}")
|
|
|
|
outpost = Outpost.objects.get(name="authentik Embedded Outpost")
|
|
outpost.type = OutpostType.PROXY
|
|
outpost.providers.set(providers)
|
|
outpost.save()
|
|
print(f"outpost providers: {outpost.providers.count()}")
|