unkin/terraform-authentik
4
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

watchstate: add external watchstate.unkin.net redirect URI
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details

Browse Source 
watchstate is being exposed externally at watchstate.unkin.net; oauth2-proxy needs the external callback registered.
This commit is contained in:
Unkin Agent
2026-08-25 21:42:26 +10:00
parent 31b92b2b93
commit 643c484dea
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/providers_oauth2/watchstate.yaml
+6 -3
View File
@@ -1,7 +1,8 @@
# OAuth2/OIDC provider + application for watchstate (the internal media # OAuth2/OIDC provider + application for watchstate (the internal media
# watch-state sync admin tool, served at # watch-state sync admin tool, served at
# https://watchstate.k8s.syd1.au.unkin.net in the watchstate namespace). An # https://watchstate.k8s.syd1.au.unkin.net (cluster hostname) and
# oauth2-proxy in front of the UI performs the OIDC login; access is gated on # https://watchstate.unkin.net (external hostname) in the watchstate namespace).
# An oauth2-proxy in front of the UI performs the OIDC login; access is gated on
# the user's hierarchical ak_groups claim (akP-watchstate-admin). # the user's hierarchical ak_groups claim (akP-watchstate-admin).
# client_secret is read from Vault (seeded out of band), never committed. # client_secret is read from Vault (seeded out of band), never committed.
name: watchstate name: watchstate
@@ -9,7 +10,7 @@ authorization_flow: default-provider-authorization-implicit-consent
invalidation_flow: default-provider-invalidation-flow invalidation_flow: default-provider-invalidation-flow
client_type: confidential client_type: confidential
client_id: watchstate client_id: watchstate
launch_url: https://watchstate.k8s.syd1.au.unkin.net/ launch_url: https://watchstate.unkin.net/
client_secret_vault: client_secret_vault:
mount: kv mount: kv
path: kubernetes/namespace/watchstate/default/oauth-credentials path: kubernetes/namespace/watchstate/default/oauth-credentials
@@ -20,3 +21,5 @@ scope_mappings:
redirect_uris: redirect_uris:
- matching_mode: strict - matching_mode: strict
url: https://watchstate.k8s.syd1.au.unkin.net/oauth2/callback url: https://watchstate.k8s.syd1.au.unkin.net/oauth2/callback
- matching_mode: strict
url: https://watchstate.unkin.net/oauth2/callback