unkin-agent
571c3c0320
Wire phase-1 plugin-based auth into both Jellyfin instances so browser users sign in via Authentik OIDC (jellyfin-plugin-sso) and native/app-password clients authenticate through the Authentik LDAP outpost (jellyfin-plugin-ldapauth), JIT-provisioning users. Both instances share the single Authentik "jellyfin" OAuth2 client, so the SSO config is identical; each reads the shared client_secret from its own namespace-scoped Vault path via a per-namespace VaultStaticSecret. - plugin-configmap.yaml: SSO-Auth.xml (OID provider "authentik", issuer identity.k8s.syd1.au.unkin.net/application/o/jellyfin/, EnableAllFolders, groups-claim role mapping akP-jellyfin-admin->admin / akP-jellyfin-user->user), LDAP-Auth.xml (server authentik-ldap.authentik.svc:6636 LDAPS, CreateUsersFromLdap), and branding.xml with a "Sign in with SSO" login link to /sso/OID/start/authentik. - statefulset.yaml: inject-plugin-config initContainer renders the XMLs into /config/plugins/configurations/, substituting client_secret / ldap_bind_password from the VSO-synced Secret (never committed) before Jellyfin starts. - vaultstaticsecret.yaml: per-namespace oauth-credentials VSS. Image tag is intentionally left at v0.1.3; the plugin DLLs land via a separate jellyfin-ha release and a follow-up pin bump.
97 lines
4.5 KiB
YAML
97 lines
4.5 KiB
YAML
---
|
|
# Declarative config for the browser-auth plugins bundled in the jellyfin-ha
|
|
# image (jellyfin-plugin-sso, jellyfin-plugin-ldapauth). Rendered into
|
|
# /config/plugins/configurations/ by the inject-plugin-config initContainer,
|
|
# which substitutes the OidSecret / LdapBindPassword placeholders from the
|
|
# VSO-synced oauth-credentials Secret so no secret is committed here. The SSO
|
|
# provider key "authentik" must match the redirect path segment registered on
|
|
# the shared Authentik "jellyfin" OAuth2 client. Roles/AdminRoles are matched
|
|
# against the hierarchical Authentik groups claim (akP-jellyfin-user grants
|
|
# login, akP-jellyfin-admin grants Jellyfin admin; global admins inherit the
|
|
# latter via akR-global-admin).
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cheeztv-plugin-config
|
|
namespace: cheeztv
|
|
data:
|
|
SSO-Auth.xml: |
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
|
|
<SamlConfigs />
|
|
<OidConfigs>
|
|
<item>
|
|
<key>
|
|
<string>authentik</string>
|
|
</key>
|
|
<value>
|
|
<PluginConfiguration>
|
|
<OidEndpoint>https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/</OidEndpoint>
|
|
<OidClientId>jellyfin</OidClientId>
|
|
<OidSecret>@@CLIENT_SECRET@@</OidSecret>
|
|
<Enabled>true</Enabled>
|
|
<EnableAuthorization>true</EnableAuthorization>
|
|
<EnableAllFolders>true</EnableAllFolders>
|
|
<EnabledFolders />
|
|
<AdminRoles>
|
|
<string>akP-jellyfin-admin</string>
|
|
</AdminRoles>
|
|
<Roles>
|
|
<string>akP-jellyfin-user</string>
|
|
<string>akP-jellyfin-admin</string>
|
|
</Roles>
|
|
<EnableFolderRoles>false</EnableFolderRoles>
|
|
<EnableLiveTvRoles>false</EnableLiveTvRoles>
|
|
<EnableLiveTv>false</EnableLiveTv>
|
|
<EnableLiveTvManagement>false</EnableLiveTvManagement>
|
|
<LiveTvRoles />
|
|
<LiveTvManagementRoles />
|
|
<FolderRoleMappings />
|
|
<RoleClaim>groups</RoleClaim>
|
|
<OidScopes>
|
|
<string>openid</string>
|
|
<string>profile</string>
|
|
<string>email</string>
|
|
</OidScopes>
|
|
<CanonicalLinks></CanonicalLinks>
|
|
<DisableHttps>false</DisableHttps>
|
|
<DoNotValidateEndpoints>false</DoNotValidateEndpoints>
|
|
<DoNotValidateIssuerName>false</DoNotValidateIssuerName>
|
|
<SchemeOverride>https</SchemeOverride>
|
|
</PluginConfiguration>
|
|
</value>
|
|
</item>
|
|
</OidConfigs>
|
|
</PluginConfiguration>
|
|
LDAP-Auth.xml: |
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
|
|
<LdapServer>authentik-ldap.authentik.svc.cluster.local</LdapServer>
|
|
<LdapPort>6636</LdapPort>
|
|
<UseSsl>true</UseSsl>
|
|
<UseStartTls>false</UseStartTls>
|
|
<SkipSslVerify>true</SkipSslVerify>
|
|
<LdapBindUser>cn=jellyfin-ldap,ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBindUser>
|
|
<LdapBindPassword>@@LDAP_BIND_PASSWORD@@</LdapBindPassword>
|
|
<LdapBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBaseDn>
|
|
<LdapSearchFilter>(objectClass=user)</LdapSearchFilter>
|
|
<LdapAdminBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapAdminBaseDn>
|
|
<LdapAdminFilter>(memberOf=cn=akP-jellyfin-admin,ou=groups,DC=ldap,DC=goauthentik,DC=io)</LdapAdminFilter>
|
|
<EnableLdapAdminFilterMemberUid>false</EnableLdapAdminFilterMemberUid>
|
|
<LdapSearchAttributes>uid, cn, mail, displayName</LdapSearchAttributes>
|
|
<CreateUsersFromLdap>true</CreateUsersFromLdap>
|
|
<AllowPassChange>false</AllowPassChange>
|
|
<LdapUidAttribute>cn</LdapUidAttribute>
|
|
<LdapUsernameAttribute>cn</LdapUsernameAttribute>
|
|
<LdapPasswordAttribute>userPassword</LdapPasswordAttribute>
|
|
<EnableAllFolders>true</EnableAllFolders>
|
|
<EnabledFolders />
|
|
</PluginConfiguration>
|
|
branding.xml: |
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<BrandingOptions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
|
|
<LoginDisclaimer><p style="text-align:center"><a href="/sso/OID/start/authentik">Sign in with SSO</a></p></LoginDisclaimer>
|
|
<CustomCss></CustomCss>
|
|
<SplashscreenEnabled>false</SplashscreenEnabled>
|
|
</BrandingOptions>
|