ginnoir
51acb44322
Deploy to valhalla / deploy (push) Has been cancelled
Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.
77 lines
3.3 KiB
Python
77 lines
3.3 KiB
Python
#!/usr/bin/env python3
|
||
"""Apply TB-006 forward_auth proxy providers (batches 1–3).
|
||
|
||
Native OAuth/OIDC apps (bookstack, gitea, portainer, minio, homarr) use
|
||
setup-batch1-oidc.py instead. Run this via: ak shell -c exec(open(...).read())
|
||
"""
|
||
from authentik.core.models import Application
|
||
from authentik.flows.models import Flow
|
||
from authentik.outposts.models import Outpost, OutpostType
|
||
from authentik.providers.proxy.models import ProxyMode, ProxyProvider
|
||
|
||
AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
|
||
INVALID = Flow.objects.get(slug="default-provider-invalidation-flow")
|
||
|
||
UPTIME_UNAUTH = """^/status/.*
|
||
^/assets/.*
|
||
^/api/push/.*
|
||
^/api/badge/.*
|
||
^/api/status-page/heartbeat/.*
|
||
^/icon.svg
|
||
^/upload/.*"""
|
||
|
||
SITES = [
|
||
# Batch 1 — admin
|
||
("homelab-code", "code", "code-server", "https://code.ginnoir.com", None, None),
|
||
("homelab-registry-ui", "registry-ui", "Registry UI", "https://registry-ui.ginnoir.com", None, None),
|
||
("homelab-vault", "vault", "Vault", "https://vault.ginnoir.com", None, None),
|
||
("homelab-uptime", "uptime", "Uptime Kuma", "https://uptime.ginnoir.com", "http://uptime-kuma:3001", UPTIME_UNAUTH),
|
||
("homelab-backup", "backup", "Kopia", "https://backup.ginnoir.com", None, None),
|
||
("homelab-dbx", "dbx", "DBX", "https://dbx.ginnoir.com", None, None),
|
||
("homelab-plane", "plane", "Plane", "https://plane.ginnoir.com", None, None),
|
||
# Batch 2 — media *arr stack (internal_only + forward_auth at Caddy)
|
||
("homelab-sonarr", "sonarr", "Sonarr", "https://sonarr.ginnoir.com", None, None),
|
||
("homelab-radarr", "radarr", "Radarr", "https://radarr.ginnoir.com", None, None),
|
||
("homelab-bazarr", "bazarr", "Bazarr", "https://bazarr.ginnoir.com", None, None),
|
||
("homelab-prowlarr", "prowlarr", "Prowlarr", "https://prowlarr.ginnoir.com", None, None),
|
||
("homelab-tautulli", "tautulli", "Tautulli", "https://tautulli.ginnoir.com", None, None),
|
||
("homelab-qbit", "qbit", "qBittorrent", "https://qbittorrent.ginnoir.com", None, None),
|
||
("homelab-deluge", "deluge", "Deluge", "https://deluge.ginnoir.com", None, None),
|
||
("homelab-nzbget", "nzbget", "NZBGet", "https://nzbget.ginnoir.com", None, None),
|
||
("homelab-whisparr", "whisparr", "Whisparr", "https://whisparr.ginnoir.com", None, None),
|
||
("homelab-stash", "stash", "Stash", "https://stash.ginnoir.com", None, None),
|
||
]
|
||
|
||
providers = []
|
||
for pname, slug, aname, host, internal, unauth in SITES:
|
||
defaults = {
|
||
"mode": ProxyMode.FORWARD_SINGLE,
|
||
"external_host": host,
|
||
"authorization_flow": AUTHZ,
|
||
"invalidation_flow": INVALID,
|
||
"intercept_header_auth": True,
|
||
}
|
||
if internal:
|
||
defaults["internal_host"] = internal
|
||
if unauth:
|
||
defaults["skip_path_regex"] = unauth
|
||
|
||
provider, _ = ProxyProvider.objects.update_or_create(name=pname, defaults=defaults)
|
||
Application.objects.update_or_create(
|
||
slug=slug,
|
||
defaults={
|
||
"name": aname,
|
||
"provider": provider,
|
||
"meta_launch_url": host,
|
||
"policy_engine_mode": "any",
|
||
},
|
||
)
|
||
providers.append(provider)
|
||
print(f"ok {slug} -> {host}")
|
||
|
||
outpost = Outpost.objects.get(name="authentik Embedded Outpost")
|
||
outpost.type = OutpostType.PROXY
|
||
outpost.providers.set(providers)
|
||
outpost.save()
|
||
print(f"outpost providers: {outpost.providers.count()}")
|