From db5bf753b50a47e9f6644ac30b6284d1f048067e Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Tue, 25 Aug 2026 20:11:38 +1000 Subject: [PATCH 1/2] Onboard watchstate into Authentik for oauth2-proxy watchstate is an internal media watch-state sync admin tool deployed at watchstate.k8s.syd1.au.unkin.net behind oauth2-proxy (OIDC against Authentik). Add the OAuth2/OIDC provider + application mirroring the logviewer/traefik in-cluster admin pattern, gate it with the akP-watchstate-admin permission group bound to the app, and nest that permission into the akR-global-admin role so only the admin team can authorize. --- config/permissions/akP-watchstate-admin.yaml | 3 +++ config/providers_oauth2/watchstate.yaml | 22 ++++++++++++++++++++ config/roles/akR-global-admin.yaml | 1 + 3 files changed, 26 insertions(+) create mode 100644 config/permissions/akP-watchstate-admin.yaml create mode 100644 config/providers_oauth2/watchstate.yaml diff --git a/config/permissions/akP-watchstate-admin.yaml b/config/permissions/akP-watchstate-admin.yaml new file mode 100644 index 0000000..66f4b93 --- /dev/null +++ b/config/permissions/akP-watchstate-admin.yaml @@ -0,0 +1,3 @@ +# Permission group akP-watchstate-admin (name = filename). Grants admin +# access to watchstate: bound to the watchstate application, gating the UI. +application: watchstate diff --git a/config/providers_oauth2/watchstate.yaml b/config/providers_oauth2/watchstate.yaml new file mode 100644 index 0000000..850372d --- /dev/null +++ b/config/providers_oauth2/watchstate.yaml @@ -0,0 +1,22 @@ +# OAuth2/OIDC provider + application for watchstate (the internal media +# watch-state sync admin tool, served at +# https://watchstate.k8s.syd1.au.unkin.net in the watchstate namespace). An +# oauth2-proxy in front of the UI performs the OIDC login; access is gated on +# the user's hierarchical ak_groups claim (akP-watchstate-admin). +# client_secret is read from Vault (seeded out of band), never committed. +name: watchstate +authorization_flow: default-provider-authorization-implicit-consent +invalidation_flow: default-provider-invalidation-flow +client_type: confidential +client_id: watchstate +launch_url: https://watchstate.k8s.syd1.au.unkin.net/ +client_secret_vault: + mount: kv + path: kubernetes/namespace/watchstate/default/oauth-credentials +scope_mappings: + - goauthentik.io/providers/oauth2/scope-openid + - goauthentik.io/providers/oauth2/scope-email + - goauthentik.io/providers/oauth2/scope-profile +redirect_uris: + - matching_mode: strict + url: https://watchstate.k8s.syd1.au.unkin.net/oauth2/callback diff --git a/config/roles/akR-global-admin.yaml b/config/roles/akR-global-admin.yaml index 43c2d49..15b9c61 100644 --- a/config/roles/akR-global-admin.yaml +++ b/config/roles/akR-global-admin.yaml @@ -7,6 +7,7 @@ permissions: - akP-jellyfin-admin - akP-traefik-admin - akP-logviewer-admin + - akP-watchstate-admin # arrstack has no admin tier (it is a proxy front door); grant global admins # the front door plus every per-app entitlement so they reach all media apps. - akP-arrstack-user From 00f835ac8c524e4d4e6a06380fd46b640255f385 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Tue, 25 Aug 2026 20:15:49 +1000 Subject: [PATCH 2/2] Retrigger plan: oauth-credentials kv secret now seeded