ginnoir
63889fc150
Deploy to valhalla / deploy (push) Has been cancelled
Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.
64 lines
2.3 KiB
Python
64 lines
2.3 KiB
Python
#!/usr/bin/env python3
|
|
"""Apply TB-006 batch 1 forward_auth proxy providers (forward_auth-only sites).
|
|
|
|
Native OAuth/OIDC apps (bookstack, gitea, portainer, minio, plane, homarr) use
|
|
setup-batch1-oidc.py instead. Run this via: ak shell -c exec(open(...).read())
|
|
"""
|
|
from authentik.core.models import Application
|
|
from authentik.flows.models import Flow
|
|
from authentik.outposts.models import Outpost, OutpostType
|
|
from authentik.providers.proxy.models import ProxyMode, ProxyProvider
|
|
|
|
AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
|
|
INVALID = Flow.objects.get(slug="default-provider-invalidation-flow")
|
|
|
|
UPTIME_UNAUTH = """^/status/.*
|
|
^/assets/.*
|
|
^/api/push/.*
|
|
^/api/badge/.*
|
|
^/api/status-page/heartbeat/.*
|
|
^/icon.svg
|
|
^/upload/.*"""
|
|
|
|
SITES = [
|
|
("homelab-code", "code", "code-server", "https://code.ginnoir.com", None, None),
|
|
("homelab-registry-ui", "registry-ui", "Registry UI", "https://registry-ui.ginnoir.com", None, None),
|
|
("homelab-vault", "vault", "Vault", "https://vault.ginnoir.com", None, None),
|
|
("homelab-uptime", "uptime", "Uptime Kuma", "https://uptime.ginnoir.com", "http://uptime-kuma:3001", UPTIME_UNAUTH),
|
|
("homelab-backup", "backup", "Kopia", "https://backup.ginnoir.com", None, None),
|
|
("homelab-dbx", "dbx", "DBX", "https://dbx.ginnoir.com", None, None),
|
|
]
|
|
|
|
providers = []
|
|
for pname, slug, aname, host, internal, unauth in SITES:
|
|
defaults = {
|
|
"mode": ProxyMode.FORWARD_SINGLE,
|
|
"external_host": host,
|
|
"authorization_flow": AUTHZ,
|
|
"invalidation_flow": INVALID,
|
|
"intercept_header_auth": True,
|
|
}
|
|
if internal:
|
|
defaults["internal_host"] = internal
|
|
if unauth:
|
|
defaults["skip_path_regex"] = unauth
|
|
|
|
provider, _ = ProxyProvider.objects.update_or_create(name=pname, defaults=defaults)
|
|
Application.objects.update_or_create(
|
|
slug=slug,
|
|
defaults={
|
|
"name": aname,
|
|
"provider": provider,
|
|
"meta_launch_url": host,
|
|
"policy_engine_mode": "any",
|
|
},
|
|
)
|
|
providers.append(provider)
|
|
print(f"ok {slug} -> {host}")
|
|
|
|
outpost = Outpost.objects.get(name="authentik Embedded Outpost")
|
|
outpost.type = OutpostType.PROXY
|
|
outpost.providers.set(providers)
|
|
outpost.save()
|
|
print(f"outpost providers: {outpost.providers.count()}")
|