From da1b61db489848a7ae68f59b4606df75e5e5b83e Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 5 Oct 2026 00:29:33 +1100
Subject: [PATCH] Allow grafana.unkin.net redirect for Grafana

---
 config/providers_oauth2/grafana.yaml  |  4 +-
 modules/authentik/.terraform.lock.hcl | 69 ---------------------------
 2 files changed, 3 insertions(+), 70 deletions(-)
 delete mode 100644 modules/authentik/.terraform.lock.hcl

diff --git a/config/providers_oauth2/grafana.yaml b/config/providers_oauth2/grafana.yaml
index 307d2f8..dd19f4a 100644
--- a/config/providers_oauth2/grafana.yaml
+++ b/config/providers_oauth2/grafana.yaml
@@ -1,5 +1,5 @@
 # OAuth2/OIDC provider + application for the in-cluster Grafana
-# (grafana.k8s.syd1.au.unkin.net). client_secret is read from Vault, not committed.
+# (grafana.unkin.net). client_secret is read from Vault, not committed.
 name: Grafana
 authorization_flow: default-provider-authorization-implicit-consent
 invalidation_flow: default-provider-invalidation-flow
@@ -13,5 +13,7 @@ scope_mappings:
   - goauthentik.io/providers/oauth2/scope-email
   - goauthentik.io/providers/oauth2/scope-profile
 redirect_uris:
+  - matching_mode: strict
+    url: https://grafana.unkin.net/login/generic_oauth
   - matching_mode: strict
     url: https://grafana.k8s.syd1.au.unkin.net/login/generic_oauth
diff --git a/modules/authentik/.terraform.lock.hcl b/modules/authentik/.terraform.lock.hcl
deleted file mode 100644
index 7c18bee..0000000
--- a/modules/authentik/.terraform.lock.hcl
+++ /dev/null
@@ -1,69 +0,0 @@
-# This file is maintained automatically by "tofu init".
-# Manual edits may be lost in future updates.
-
-provider "registry.opentofu.org/goauthentik/authentik" {
-  version     = "2026.5.1"
-  constraints = "2026.5.1"
-  hashes = [
-    "h1:L9q3pjCoeKQdn0/OApv4O1HiC/PDLDqcnM7Ff5XFB+0=",
-    "zh:05f252734db99792e5d3f52b582a4e0027348ac2614d8c9621bf7e623cff8036",
-    "zh:0e1cd8041650aed9bb8d4af23301e786223ed5d1a00c2a5150b7ad874ae03917",
-    "zh:26b1daebd30650df411f903248e061cf963712a063b38e731782fb13a5755ddf",
-    "zh:362b536ff6bf8866c7c1094c3e2322c22b8c36d8d4caa4db0397cebbcad08561",
-    "zh:3d94367b853960f5e88efe3ae69d995d02a11dc8d60ec4d7413a37aabf78b379",
-    "zh:3e840e204677eabe562d17c2ad12afdfa250098725bebac4e91fb8934e233c22",
-    "zh:4db66139d7a9ec6f7852538573261010d48f0a939e2fe8eeb5c55b01149e3629",
-    "zh:7b88a830fb26c697f9d240f498f604485454b12e56b7604eda4ca35d10660ecd",
-    "zh:851bc8bd2d4a16dc71f30da17b6285aa7d85f4bc4175fde7b8319a6a8987ec65",
-    "zh:8bdfc2c70271d48126eef3b1a30d0d132e868d2118ae7277323ed4c905636e4a",
-    "zh:e85c03eac43f23f25ad5443a2984cc67977c3abdcb4c4c426d37342c2f25c37e",
-    "zh:efc296826a700a4e90ee06f8bd3b137617486ce774772aabed3053d4ef8dd906",
-    "zh:f249033dc242c51600cd3968535efa0780352d5ae7435e8ab1482a7ccc9c2f5e",
-  ]
-}
-
-provider "registry.opentofu.org/hashicorp/random" {
-  version     = "3.9.1"
-  constraints = ">= 3.6.0"
-  hashes = [
-    "h1:CEQeHfnUDB3uqAkKoEWfWgbj+kpoQHgcuPbAjPzbh+U=",
-    "zh:09aaf19b0d22726d2378e0e89fbbefc183494d7bd585759d6c4e69ba50951a2f",
-    "zh:31575ca9bc0db20337096d178ea73bce3ebca343ed071c67f78cf39f800c9ec6",
-    "zh:624fb6ed552abc34a5aaac41e76a373da65ac08e524b09b672f29c60e6ac896a",
-    "zh:6a4760d55132b9750ac1a04f6fc32e247034daa999f71452dba9cbca225a529a",
-    "zh:768a6047cfb8958e7b0b120c580aa3de6624a7fbb2c56ad6df85cd559ed26ec7",
-    "zh:8983c788ba660bcb587e64ff9c3e4323515caf78facbe0abe6432e7aff8df893",
-    "zh:8d570eb026a4f00b58a1d36be0ce3c13adf4d973efcd4162b05cb295bbc14257",
-    "zh:a2259540854d5f699c36b89244fb202ebb2c219b64669a51072687d04fb47152",
-    "zh:aaa51d905b0e80a28e02f9bee2cf6c91ffade7389d77ab9198aa12809ed04955",
-    "zh:afb60995e98573facddfb47baedf7e288408680eb00b5d3df570611758947c72",
-    "zh:b9a46d852ce53fa037f47537a7de53f37b759ccf211600b7ba44c66ba4b616b7",
-    "zh:bafcfeeefcd0dfefeff120b655b45edb0497c4717534ffe5201b3cb556d1ffe6",
-    "zh:c3ac24d397eae054aca2290e20943e0c767592cc661c890850c25ac01829308d",
-    "zh:eafba4127ebadcc5ed0e427935c66fb5e2da7cfdaae39a66d52f4a50d51faf1e",
-    "zh:f39d4bce213ed9bba3474bad468136af08ff6c4c33adaafcc10c1f78067adfe3",
-  ]
-}
-
-provider "registry.opentofu.org/hashicorp/vault" {
-  version     = "5.12.0"
-  constraints = ">= 4.0.0"
-  hashes = [
-    "h1:HVdhw1ShP/LlYuDOdVKmLO/kLVfngw9VHM2YfDl879Y=",
-    "zh:070709539eeff2dbf6af13269e6a3c14cea0ee4e5a5fff237d574805df2787e9",
-    "zh:0e017e993252c37008dcf1848deb32f15a14b303335c3e06885d7efea07fef1d",
-    "zh:1717ba0a0f8d906ced0eb5a3ed1e2a1808d824868da5095ea1da12d60904777d",
-    "zh:218f879c5f3f97564f4867bcbb419197c4aa4e41ce5bc3eed50c71926f0519f9",
-    "zh:2437d8f76d6220883c96a073801af973db957c8b1c79187256c204437f4ed08e",
-    "zh:9dce3198d2f03ce05c3fb4cb90433de5863f0d1818fc4abc3e3576f562409c85",
-    "zh:a51d00c192e6cf86d588501d8c4a2a37a258679784651909d55f64d28011b28d",
-    "zh:c99586f88b0166d5522dedfbec9d246a51efae346bbdfcaeb296ff72b5c80f94",
-    "zh:cee10cca2a295e4fd9ce2779239f7f79ab97328d9e30833924cceb349e509051",
-    "zh:d9b5cde1c02db0b211ec3f77b519122f93b442594ce9f20d386ab5d0d05ead93",
-    "zh:deafe53fa413e71dac120177a58b678e81a64279a692ba77eca09a9bce0bff1a",
-    "zh:f372b83c70ee5dabd892bd9ec1eb9127fe6331d88178b7b84fa5f52f616b59df",
-    "zh:f47e4fd82b72e62a5e1eeaaa1b72cc2709545a8431964123b24ed5c03a03e492",
-    "zh:f629a86c98be3fd2aacb58336d26ce268a76fe754b048f58a3faa0712bb4a837",
-    "zh:feaef85debc4a4a72d7a23988b18fff0b4dbc47f37e31a0b51022df071ac7b85",
-  ]
-}