From 6cc752336ee67330548200d1120a8104cb60cf69 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 12:09:31 +1000 Subject: [PATCH] Point jellyfin SSO at public Authentik hostname (#470) The internal-CA identity.k8s.syd1.au.unkin.net host has no CA bundle mounted in the jellyfin pods, so the OIDC discovery fetch fails TLS handshake (PartialChain). Authentik's discovery response is host-relative, so the browser-facing hostname must be used, not the internal one. - Change OidEndpoint to identity.unkin.net in fafflix plugin config - Change OidEndpoint to identity.unkin.net in cheeztv plugin config Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/470 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/cheeztv/plugin-configmap.yaml | 2 +- apps/base/fafflix/plugin-configmap.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/base/cheeztv/plugin-configmap.yaml b/apps/base/cheeztv/plugin-configmap.yaml index 0b21790..3e56d57 100644 --- a/apps/base/cheeztv/plugin-configmap.yaml +++ b/apps/base/cheeztv/plugin-configmap.yaml @@ -26,7 +26,7 @@ data: - https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/ + https://identity.unkin.net/application/o/jellyfin/ jellyfin @@CLIENT_SECRET@@ true diff --git a/apps/base/fafflix/plugin-configmap.yaml b/apps/base/fafflix/plugin-configmap.yaml index e5b9e19..cdfd2bb 100644 --- a/apps/base/fafflix/plugin-configmap.yaml +++ b/apps/base/fafflix/plugin-configmap.yaml @@ -26,7 +26,7 @@ data: - https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/ + https://identity.unkin.net/application/o/jellyfin/ jellyfin @@CLIENT_SECRET@@ true