unkin-agent
c313c7cc3f
## Summary - Adds SSO-Auth.xml, LDAP-Auth.xml, and branding.xml plugin config (rendered by an initContainer into /config) to fafflix and cheeztv - Adds a per-namespace oauth-credentials VaultStaticSecret to each instance - Adds a "Sign in with SSO" login link via jellyfin branding config ## Why Phase-1 jellyfin auth: browser SSO via the 9p4 SSO plugin (Authentik OIDC, ak_groups claim) and phone/TV app-passwords via the LDAP plugin against the Authentik LDAP outpost. Config is declarative — restarts overwrite UI edits. Activates when the plugin-baked jellyfin-ha image lands (separate PR). Reviewed-on: #424 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
49 lines
1.7 KiB
YAML
49 lines
1.7 KiB
YAML
---
|
|
# restic repository password for the k8up fafflix-config backups. Seeded at
|
|
# kv/kubernetes/namespace/fafflix/default/k8up-restic (key: password); the
|
|
# default k8s role's templated policy already grants read here, so no
|
|
# terraform-vault change is needed. VSO syncs it into the fafflix-k8up-restic
|
|
# Secret that the Schedule references via backend.repoPasswordSecretRef.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: fafflix-k8up-restic
|
|
namespace: fafflix
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: fafflix-k8up-restic
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/fafflix/default/k8up-restic
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# Shared Authentik "jellyfin" OAuth2 client secret (key: client_secret) plus the
|
|
# LDAP outpost bind password (key: ldap_bind_password) for the auth plugins.
|
|
# The default k8s role's templated policy is namespace-scoped
|
|
# (kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*), so each instance
|
|
# reads its own namespace path; the SAME shared values must be seeded at both
|
|
# fafflix and cheeztv paths. VSO syncs into the oauth-credentials Secret, whose
|
|
# keys the inject-plugin-config initContainer substitutes into the plugin XML.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: oauth-credentials
|
|
namespace: fafflix
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: oauth-credentials
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/fafflix/default/oauth-credentials
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|