From beb13cc3dec5c9d3b4948badf9d33f2784a00be6 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 19 Sep 2026 12:02:44 +1000
Subject: [PATCH] Point jellyfin SSO at public Authentik hostname

The internal-CA identity.k8s.syd1.au.unkin.net host has no CA bundle
mounted in the jellyfin pods, so discovery fetch fails TLS handshake.
Authentik's discovery response is host-relative, so the endpoint must
be the publicly-trusted hostname browsers can also reach.

- Change OidEndpoint to identity.unkin.net in fafflix and cheeztv plugin config
---
 apps/base/cheeztv/plugin-configmap.yaml | 2 +-
 apps/base/fafflix/plugin-configmap.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/base/cheeztv/plugin-configmap.yaml b/apps/base/cheeztv/plugin-configmap.yaml
index 0b21790..3e56d57 100644
--- a/apps/base/cheeztv/plugin-configmap.yaml
+++ b/apps/base/cheeztv/plugin-configmap.yaml
@@ -26,7 +26,7 @@ data:
           </key>
           <value>
             <PluginConfiguration>
-              <OidEndpoint>https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/</OidEndpoint>
+              <OidEndpoint>https://identity.unkin.net/application/o/jellyfin/</OidEndpoint>
               <OidClientId>jellyfin</OidClientId>
               <OidSecret>@@CLIENT_SECRET@@</OidSecret>
               <Enabled>true</Enabled>
diff --git a/apps/base/fafflix/plugin-configmap.yaml b/apps/base/fafflix/plugin-configmap.yaml
index e5b9e19..cdfd2bb 100644
--- a/apps/base/fafflix/plugin-configmap.yaml
+++ b/apps/base/fafflix/plugin-configmap.yaml
@@ -26,7 +26,7 @@ data:
           </key>
           <value>
             <PluginConfiguration>
-              <OidEndpoint>https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/</OidEndpoint>
+              <OidEndpoint>https://identity.unkin.net/application/o/jellyfin/</OidEndpoint>
               <OidClientId>jellyfin</OidClientId>
               <OidSecret>@@CLIENT_SECRET@@</OidSecret>
               <Enabled>true</Enabled>
-- 
2.47.3