ginnoir
1ce63153ab
Media sites get Caddy forward_auth; Authentik scripts cover all proxy providers. BookStack OIDC and Plane admin routing fixes included, plus ops scripts for external auth on valhalla.
73 lines
3.2 KiB
Python
73 lines
3.2 KiB
Python
"""Update proxy providers for forward_auth apps (admin batch 1 + media batch 2)."""
|
|
from authentik.core.models import Application
|
|
from authentik.flows.models import Flow
|
|
from authentik.outposts.models import Outpost, OutpostType
|
|
from authentik.providers.proxy.models import ProxyMode, ProxyProvider
|
|
|
|
AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
|
|
INVALID = Flow.objects.get(slug="default-provider-invalidation-flow")
|
|
|
|
UPTIME_UNAUTH = """^/status/.*
|
|
^/assets/.*
|
|
^/api/push/.*
|
|
^/api/badge/.*
|
|
^/api/status-page/heartbeat/.*
|
|
^/icon.svg
|
|
^/upload/.*"""
|
|
|
|
# Proxy-only sites (native OIDC apps managed by setup-batch1-oidc.py).
|
|
SITES = [
|
|
# Batch 1 — admin
|
|
("homelab-code", "code", "code-server", "https://code.ginnoir.com", None, None),
|
|
("homelab-registry-ui", "registry-ui", "Registry UI", "https://registry-ui.ginnoir.com", None, None),
|
|
("homelab-vault", "vault", "Vault", "https://vault.ginnoir.com", None, None),
|
|
("homelab-uptime", "uptime", "Uptime Kuma", "https://uptime.ginnoir.com", "http://uptime-kuma:3001", UPTIME_UNAUTH),
|
|
("homelab-backup", "backup", "Kopia", "https://backup.ginnoir.com", None, None),
|
|
("homelab-dbx", "dbx", "DBX", "https://dbx.ginnoir.com", None, None),
|
|
("homelab-plane", "plane", "Plane", "https://plane.ginnoir.com", None, None),
|
|
# Batch 2 — media
|
|
("homelab-sonarr", "sonarr", "Sonarr", "https://sonarr.ginnoir.com", None, None),
|
|
("homelab-radarr", "radarr", "Radarr", "https://radarr.ginnoir.com", None, None),
|
|
("homelab-bazarr", "bazarr", "Bazarr", "https://bazarr.ginnoir.com", None, None),
|
|
("homelab-prowlarr", "prowlarr", "Prowlarr", "https://prowlarr.ginnoir.com", None, None),
|
|
("homelab-tautulli", "tautulli", "Tautulli", "https://tautulli.ginnoir.com", None, None),
|
|
("homelab-qbit", "qbit", "qBittorrent", "https://qbittorrent.ginnoir.com", None, None),
|
|
("homelab-deluge", "deluge", "Deluge", "https://deluge.ginnoir.com", None, None),
|
|
("homelab-nzbget", "nzbget", "NZBGet", "https://nzbget.ginnoir.com", None, None),
|
|
("homelab-whisparr", "whisparr", "Whisparr", "https://whisparr.ginnoir.com", None, None),
|
|
("homelab-stash", "stash", "Stash", "https://stash.ginnoir.com", None, None),
|
|
]
|
|
|
|
providers = []
|
|
for pname, slug, aname, host, internal, unauth in SITES:
|
|
defaults = {
|
|
"mode": ProxyMode.FORWARD_SINGLE,
|
|
"external_host": host,
|
|
"authorization_flow": AUTHZ,
|
|
"invalidation_flow": INVALID,
|
|
"intercept_header_auth": True,
|
|
}
|
|
if internal:
|
|
defaults["internal_host"] = internal
|
|
if unauth:
|
|
defaults["skip_path_regex"] = unauth
|
|
|
|
provider, _ = ProxyProvider.objects.update_or_create(name=pname, defaults=defaults)
|
|
Application.objects.update_or_create(
|
|
slug=slug,
|
|
defaults={
|
|
"name": aname,
|
|
"provider": provider,
|
|
"meta_launch_url": host,
|
|
"policy_engine_mode": "any",
|
|
},
|
|
)
|
|
providers.append(provider)
|
|
print(f"ok {slug} -> {host}")
|
|
|
|
outpost = Outpost.objects.get(name="authentik Embedded Outpost")
|
|
outpost.type = OutpostType.PROXY
|
|
outpost.providers.set(providers)
|
|
outpost.save()
|
|
print(f"outpost providers: {outpost.providers.count()}")
|