Merge pull request 'Add stalwart OIDC application and provider' (#45) from benvin/stalwart-oidc into main

Reviewed-on: #45

config/permissions/akP-mail-user.yaml

@@ -0,0 +1,3 @@
+# Permission group akP-mail-user (name = filename). Grants mailbox access:
+# bound to the stalwart application, gating mail.unkin.net logins.
+application: stalwart

config/providers_oauth2/stalwart.yaml

@@ -0,0 +1,20 @@
+# OAuth2/OIDC provider + application for Stalwart (mail server, web UI/JMAP at
+# https://mail.unkin.net in the mail namespace). Stalwart's OIDC directory
+# validates access tokens (JWT, userinfo fallback) and requires aud=stalwart
+# plus the openid+email scopes; it maps preferred_username/name from profile.
+# public, no secret: the web UI uses PKCE; the strict redirect URIs are the control.
+name: stalwart
+authorization_flow: default-provider-authorization-implicit-consent
+invalidation_flow: default-provider-invalidation-flow
+client_type: public
+client_id: stalwart
+launch_url: https://mail.unkin.net/
+scope_mappings:
+  - goauthentik.io/providers/oauth2/scope-openid
+  - goauthentik.io/providers/oauth2/scope-email
+  - goauthentik.io/providers/oauth2/scope-profile
+redirect_uris:
+  - matching_mode: strict
+    url: https://mail.unkin.net/account/oauth/callback
+  - matching_mode: strict
+    url: https://mail.unkin.net/admin/oauth/callback

config/roles/akR-global-admin.yaml

@@ -10,6 +10,7 @@ permissions:
   - akP-traefik-admin
   - akP-logviewer-admin
   - akP-vlogs-admin
+  - akP-mail-user
   - akP-watchstate-admin
   - akP-repospawner-admin
   - akP-vault-admin