Completes the Authentik-side plumbing for Jellyfin SSO across both media
instances -- fafflix (adults, jellyfin.k8s.syd1.au.unkin.net) and cheeztv
(kids, cheeztv.unkin.net + cheeztv.k8s.syd1.au.unkin.net) -- and adds an
LDAP outpost so native clients can authenticate with app passwords.
Why: the previously-merged jellyfin OIDC provider only covered the fafflix
host and gated on the generic jellyfin permission groups. cheeztv needs SSO
too, access should be limited to media users, and native (non-browser)
clients need a password-based path.
How:
- providers_oauth2/jellyfin.yaml: one shared confidential client now lists
strict redirect URIs for all three hosts using the verified
jellyfin-plugin-sso callback path /sso/OID/redirect/authentik. Client
secret moved to kv kubernetes/namespace/fafflix/default/oauth-credentials.
- Access is gated to media users only: akP-media-fafflix and akP-media-cheeztv
now carry `application: jellyfin` and bind to the app; akP-jellyfin-admin /
akP-jellyfin-user are demoted to pure role-claim groups (no app binding),
still mapped by the plugin for admin/user rights. Per-instance authz
(adults -> both, kids -> cheeztv only) stays with the media proxy.
- providers_ldap/jellyfin-ldap.yaml: new LDAP provider (base_dn
DC=ldap,DC=goauthentik,DC=io, direct bind/search) + application
(jellyfin-ldap) + outpost (jellyfin-ldap-outpost) via the existing module.
- modules/authentik/main.tf: resolve LDAP bind/unbind flow slugs to ids via
data.authentik_flow, matching the oauth2/saml convention.
The media services are splitting into an adult (fafflix) and kids (cheeztv)
tier, and Authentik group membership will drive the media proxy's routing and
authorization. This adds the two-tier RBAC groups so users can be assigned the
right media access ahead of the provider/application wiring.
- Add akP-media-fafflix and akP-media-cheeztv per-service permission entitlements
(unbound, so they surface in the hierarchical ak_groups claim for the proxy)
- Add akR-media-adult role nesting both fafflix and cheeztv (adults reach both)
- Add akR-media-kids role nesting only cheeztv (kids reach kids services only)
unkin-agent