From 72e65d78104189fcd4b364b7d29b9a971b1568a2 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 29 Aug 2026 20:57:54 +1000 Subject: [PATCH] Onboard mediamark to Authentik OIDC Add an oauth2 provider/application for the mediamark kids-content marking UI, a permission group gating it, and nest that permission in akR-media-adult. --- config/permissions/akP-mediamark.yaml | 3 +++ config/providers_oauth2/mediamark.yaml | 25 +++++++++++++++++++++++++ config/roles/akR-media-adult.yaml | 5 ++++- 3 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 config/permissions/akP-mediamark.yaml create mode 100644 config/providers_oauth2/mediamark.yaml diff --git a/config/permissions/akP-mediamark.yaml b/config/permissions/akP-mediamark.yaml new file mode 100644 index 0000000..f60aba0 --- /dev/null +++ b/config/permissions/akP-mediamark.yaml @@ -0,0 +1,3 @@ +# Permission group akP-mediamark (name = filename). Grants access to mediamark: +# bound to the mediamark application, gating the kids-content marking UI. +application: mediamark diff --git a/config/providers_oauth2/mediamark.yaml b/config/providers_oauth2/mediamark.yaml new file mode 100644 index 0000000..6551cbc --- /dev/null +++ b/config/providers_oauth2/mediamark.yaml @@ -0,0 +1,25 @@ +# OAuth2/OIDC provider + application for mediamark (the Go web UI for marking +# media as kids content, served at https://mediamark.unkin.net (external +# hostname) and https://mediamark.k8s.syd1.au.unkin.net (cluster hostname) in +# the arrstack namespace). An oauth2-proxy in front of the UI performs the OIDC +# login with a relative redirect, so both hostnames must be registered; access +# is gated on the user's hierarchical ak_groups claim (akP-mediamark). +# client_secret is read from Vault (seeded out of band), never committed. +name: mediamark +authorization_flow: default-provider-authorization-implicit-consent +invalidation_flow: default-provider-invalidation-flow +client_type: confidential +client_id: mediamark +launch_url: https://mediamark.unkin.net/ +client_secret_vault: + mount: kv + path: kubernetes/namespace/arrstack/default/mediamark-oauth-credentials +scope_mappings: + - goauthentik.io/providers/oauth2/scope-openid + - goauthentik.io/providers/oauth2/scope-email + - goauthentik.io/providers/oauth2/scope-profile +redirect_uris: + - matching_mode: strict + url: https://mediamark.k8s.syd1.au.unkin.net/oauth2/callback + - matching_mode: strict + url: https://mediamark.unkin.net/oauth2/callback diff --git a/config/roles/akR-media-adult.yaml b/config/roles/akR-media-adult.yaml index 16f88e2..c898d49 100644 --- a/config/roles/akR-media-adult.yaml +++ b/config/roles/akR-media-adult.yaml @@ -2,7 +2,10 @@ # adult ("fafflix") and kids ("cheeztv") services, so this role nests both # per-service entitlements. Membership propagates child -> parent, so a member # appears in both permission groups in the hierarchical `ak_groups` claim and the -# media proxy routes/authorizes them for fafflix and cheeztv. +# media proxy routes/authorizes them for fafflix and cheeztv. Adults also curate +# which titles are kids content, so the role nests akP-mediamark for access to +# the mediamark UI. permissions: - akP-media-fafflix - akP-media-cheeztv + - akP-mediamark