Initial scaffold

- Terraform module for groups, SAML/OAuth2/LDAP providers, applications, and LDAP outposts
- Data-driven YAML config with Terragrunt config loader
- Environment: identity.unkin.net with Consul backend
- Provider: goauthentik/authentik 2026.5.0
- Woodpecker CI pipelines (pre-commit, plan, apply)
- Makefile with Vault AppRole and K8s auth support

.gitignore

@@ -0,0 +1,6 @@
+.terraform/
+*.tfstate
+*.tfstate.backup
+*.tfplan
+backend.tf
+.terragrunt-cache/

.pre-commit-config.yaml

@@ -0,0 +1,24 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.4.0
+    hooks:
+      - id: end-of-file-fixer
+        types: [yaml]
+      - id: trailing-whitespace
+        types: [yaml]
+  - repo: https://github.com/gruntwork-io/pre-commit
+    rev: v0.1.30
+    hooks:
+      - id: tofu-fmt
+      - id: tofu-validate
+      - id: tflint
+      - id: terragrunt-hcl-fmt
+  - repo: https://github.com/adrienverge/yamllint.git
+    rev: v1.37.1
+    hooks:
+      - id: yamllint
+        args:
+          [
+            "-d {extends: relaxed, rules: {line-length: disable}, ignore: chart}",
+            "-s",
+          ]

.woodpecker/apply.yaml

@@ -0,0 +1,23 @@
+when:
+  - event: push
+    branch: main
+
+steps:
+  - name: apply
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    environment:
+      VAULT_AUTH_METHOD: kubernetes
+    commands:
+      - dnf install vault -y
+      - make plan
+      - make apply
+    backend_options:
+      kubernetes:
+        serviceAccountName: terraform-authentik
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/plan.yaml

@@ -0,0 +1,21 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: plan
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    environment:
+      VAULT_AUTH_METHOD: kubernetes
+    commands:
+      - dnf install vault -y
+      - make plan
+    backend_options:
+      kubernetes:
+        serviceAccountName: terraform-authentik
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/pre-commit.yaml

@@ -0,0 +1,18 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: pre-commit
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    commands:
+      - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

Makefile

@@ -0,0 +1,34 @@
+.PHONY: init plan apply format
+
+VAULT_AUTH_METHOD ?= approle
+VAULT_K8S_ROLE ?= woodpecker_terraform_authentik
+VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
+VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
+
+define vault_env
+	@export VAULT_ADDR="https://vault.service.consul:8200" && \
+	if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \
+		export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \
+	else \
+		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
+	fi && \
+	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-authentik)
+endef
+
+init:
+	@$(call vault_env) && \
+	terragrunt run --all --non-interactive init -- -upgrade
+
+plan: init
+	@$(call vault_env) && \
+	terragrunt run --all --parallelism 4 --non-interactive plan
+
+apply: init
+	@$(call vault_env) && \
+	terragrunt run --all --parallelism 2 --non-interactive apply
+
+format:
+	@echo "Formatting OpenTofu files..."
+	@tofu fmt -recursive .
+	@echo "Formatting Terragrunt files..."
+	@terragrunt hcl fmt

README.md

@@ -1,3 +1,35 @@
 # terraform-authentik
 
-Terraform configuration for managing Authentik identity provider
+Terraform configuration for managing the Authentik identity provider at identity.unkin.net.
+
+## Managed Resources
+
+- **Groups** — roles and group hierarchy (users are invited manually)
+- **SAML providers** — SAML application integrations
+- **OAuth2/OIDC providers** — OAuth2 and OpenID Connect integrations
+- **LDAP providers** — LDAP provider and outpost configuration
+- **Applications** — application definitions linked to providers
+
+## Configuration
+
+Resources are defined as YAML files under `config/`:
+
+```
+config/
+├── groups/              # Group definitions
+├── providers_saml/      # SAML provider definitions
+├── providers_oauth2/    # OAuth2/OIDC provider definitions
+└── providers_ldap/      # LDAP provider definitions
+```
+
+## Usage
+
+```sh
+make plan     # init + plan
+make apply    # init + plan + apply
+make format   # format all .tf and .hcl files
+```
+
+### Authentication
+
+Set `VAULT_ROLEID` for local AppRole auth, or `VAULT_AUTH_METHOD=kubernetes` for CI.

config/config.hcl

@@ -0,0 +1,31 @@
+locals {
+  config_files = fileset(".", "**/*.yaml")
+
+  all_configs = {
+    for file_path in local.config_files :
+    file_path => yamldecode(file(file_path))
+  }
+
+  config = {
+    groups = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "groups/")
+    }
+    providers_saml = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "providers_saml/")
+    }
+    providers_oauth2 = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "providers_oauth2/")
+    }
+    providers_ldap = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "providers_ldap/")
+    }
+  }
+}

environments/identity.unkin.net/terragrunt.hcl

@@ -0,0 +1,24 @@
+include "root" {
+  path   = find_in_parent_folders("root.hcl")
+  expose = true
+}
+
+include "config" {
+  path   = "${get_repo_root()}/config/config.hcl"
+  expose = true
+}
+
+locals {
+  config = include.config.locals.config
+}
+
+terraform {
+  source = "../../modules/authentik"
+}
+
+inputs = {
+  groups           = local.config.groups
+  providers_saml   = local.config.providers_saml
+  providers_oauth2 = local.config.providers_oauth2
+  providers_ldap   = local.config.providers_ldap
+}

environments/root.hcl

@@ -0,0 +1,32 @@
+generate "backend" {
+  path      = "backend.tf"
+  if_exists = "overwrite"
+  contents  = <<EOF
+provider "authentik" {
+  url   = "https://${path_relative_to_include()}"
+  token = var.authentik_token
+}
+
+variable "authentik_token" {
+  type      = string
+  sensitive = true
+}
+
+terraform {
+  backend "consul" {
+    address = "https://consul.service.consul"
+    path    = "infra/terraform/authentik/${path_relative_to_include()}/state"
+    scheme  = "https"
+    lock    = true
+    ca_file = "/etc/pki/tls/certs/ca-bundle.crt"
+  }
+  required_version = ">= 1.10"
+  required_providers {
+    authentik = {
+      source  = "goauthentik/authentik"
+      version = "2026.5.0"
+    }
+  }
+}
+EOF
+}

modules/authentik/main.tf

@@ -0,0 +1,85 @@
+resource "authentik_group" "this" {
+  for_each = var.groups
+
+  name         = each.value.name
+  is_superuser = each.value.is_superuser
+  parent       = each.value.parent != null ? authentik_group.this[each.value.parent].id : null
+  attributes   = jsonencode(each.value.attributes)
+}
+
+resource "authentik_provider_saml" "this" {
+  for_each = var.providers_saml
+
+  name               = each.value.name
+  authorization_flow = each.value.authorization_flow
+  acs_url            = each.value.acs_url
+  issuer             = each.value.issuer
+  sp_binding         = each.value.sp_binding
+  audience           = each.value.audience
+  name_id_mapping    = each.value.name_id_mapping
+  signing_kp         = each.value.signing_kp
+}
+
+resource "authentik_provider_oauth2" "this" {
+  for_each = var.providers_oauth2
+
+  name               = each.value.name
+  authorization_flow = each.value.authorization_flow
+  client_type        = each.value.client_type
+  client_id          = each.value.client_id
+  client_secret      = each.value.client_secret
+  redirect_uris      = each.value.redirect_uris
+  property_mappings  = each.value.property_mappings
+  signing_key        = each.value.signing_key
+  access_token_validity = each.value.access_token_validity
+}
+
+resource "authentik_provider_ldap" "this" {
+  for_each = var.providers_ldap
+
+  name               = each.value.name
+  authorization_flow = each.value.authorization_flow
+  base_dn            = each.value.base_dn
+  bind_flow          = each.value.bind_flow
+  search_group       = each.value.search_group
+  certificate        = each.value.certificate
+  tls_server_name    = each.value.tls_server_name
+  uid_start_number   = each.value.uid_start_number
+  gid_start_number   = each.value.gid_start_number
+  search_mode        = each.value.search_mode
+  bind_mode          = each.value.bind_mode
+  mfa_support        = each.value.mfa_support
+}
+
+resource "authentik_application" "saml" {
+  for_each = var.providers_saml
+
+  name              = each.value.name
+  slug              = each.key
+  protocol_provider = authentik_provider_saml.this[each.key].id
+}
+
+resource "authentik_application" "oauth2" {
+  for_each = var.providers_oauth2
+
+  name              = each.value.name
+  slug              = each.key
+  protocol_provider = authentik_provider_oauth2.this[each.key].id
+}
+
+resource "authentik_application" "ldap" {
+  for_each = var.providers_ldap
+
+  name              = each.value.name
+  slug              = each.key
+  protocol_provider = authentik_provider_ldap.this[each.key].id
+}
+
+resource "authentik_outpost" "ldap" {
+  for_each = var.providers_ldap
+
+  name               = "${each.key}-outpost"
+  type               = "ldap"
+  protocol_providers = [authentik_provider_ldap.this[each.key].id]
+  service_connection = "local"
+}

modules/authentik/variables.tf

@@ -0,0 +1,56 @@
+variable "groups" {
+  type = map(object({
+    name       = string
+    is_superuser = optional(bool, false)
+    parent     = optional(string, null)
+    attributes = optional(map(string), {})
+  }))
+  default = {}
+}
+
+variable "providers_saml" {
+  type = map(object({
+    name               = string
+    authorization_flow = string
+    acs_url            = string
+    issuer             = optional(string, null)
+    sp_binding         = optional(string, "post")
+    audience           = optional(string, "")
+    name_id_mapping    = optional(string, null)
+    signing_kp         = optional(string, null)
+  }))
+  default = {}
+}
+
+variable "providers_oauth2" {
+  type = map(object({
+    name               = string
+    authorization_flow = string
+    client_type        = optional(string, "confidential")
+    client_id          = optional(string, null)
+    client_secret      = optional(string, null)
+    redirect_uris      = optional(list(string), [])
+    property_mappings  = optional(list(string), [])
+    signing_key        = optional(string, null)
+    access_token_validity = optional(string, "minutes=5")
+  }))
+  default = {}
+}
+
+variable "providers_ldap" {
+  type = map(object({
+    name               = string
+    authorization_flow = string
+    base_dn            = string
+    bind_flow          = optional(string, null)
+    search_group       = optional(string, null)
+    certificate        = optional(string, null)
+    tls_server_name    = optional(string, null)
+    uid_start_number   = optional(number, 2000)
+    gid_start_number   = optional(number, 4000)
+    search_mode        = optional(string, "cached")
+    bind_mode          = optional(string, "cached")
+    mfa_support        = optional(bool, true)
+  }))
+  default = {}
+}