unkin/terraform-authentik
4
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Add stalwart OIDC application and provider #45

Merged
benvin merged 4 commits from benvin/stalwart-oidc into main 2026-10-12 21:33:39 +11:00
Conversation 2 Commits 4 Files Changed 3
+24
unkin-agent commented 2026-10-12 00:18:27 +11:00
Member
Copy Link
Copy Source

Stalwart (mail.unkin.net, mail namespace) authenticates users against Authentik via its OIDC directory, which validates access tokens with aud=stalwart and the openid+email scopes. Its web UI uses PKCE, so the client is public with no secret. Mail access is admin-only for now.

  • add config/providers_oauth2/stalwart.yaml as a public client with strict account and admin OAuth callbacks
  • add permission group akP-mail-user bound to the stalwart application
  • nest akP-mail-user under akR-global-admin
Stalwart (mail.unkin.net, mail namespace) authenticates users against Authentik via its OIDC directory, which validates access tokens with aud=stalwart and the openid+email scopes. Its web UI uses PKCE, so the client is public with no secret. Mail access is admin-only for now. - add config/providers_oauth2/stalwart.yaml as a public client with strict account and admin OAuth callbacks - add permission group akP-mail-user bound to the stalwart application - nest akP-mail-user under akR-global-admin
unkin-agent added 1 commit 2026-10-12 00:18:27 +11:00
Add stalwart OIDC application and provider
ci/woodpecker/pr/plan Pipeline failed
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
366cdafd6a 
- add config/providers_oauth2/stalwart.yaml reading its client_secret from kv/kubernetes/namespace/mail/stalwart/oauth-credentials
- add permission group akP-mail-users bound to the stalwart application
- nest akP-mail-users under akR-global-admin
unkin-agent added 1 commit 2026-10-12 00:20:16 +11:00
Read stalwart client secret from the mail default SA path
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
0f8ec8a960
unkin-agent commented 2026-10-12 00:22:13 +11:00
Author
Member
Copy Link
Copy Source
  • nit: config/permissions/akP-mail-users.yaml:1 — plural -users breaks the akP-<app>-user / -admin convention (akP-grafana-user, akP-litellm-user) → rename to akP-mail-user (file, role entry).
  • nit: config/roles/akR-global-admin.yaml:13 — a user-tier group is nested only under akR-global-admin, while all other -user groups also sit in akR-standard-user → also nest it in config/roles/akR-standard-user.yaml, or state in the PR body that mail access is admin-only.
- nit: config/permissions/akP-mail-users.yaml:1 — plural `-users` breaks the `akP-<app>-user` / `-admin` convention (akP-grafana-user, akP-litellm-user) → rename to akP-mail-user (file, role entry). - nit: config/roles/akR-global-admin.yaml:13 — a user-tier group is nested only under akR-global-admin, while all other `-user` groups also sit in akR-standard-user → also nest it in config/roles/akR-standard-user.yaml, or state in the PR body that mail access is admin-only.
unkin-agent added 1 commit 2026-10-12 00:22:46 +11:00
Rename akP-mail-users to akP-mail-user
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
bfcc362239
unkin-agent added 1 commit 2026-10-12 00:43:55 +11:00
Make stalwart a public PKCE client with account and admin callbacks
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
dc5a24e564
unkin-agent commented 2026-10-12 02:54:07 +11:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
benvin merged commit 19727858ca into main 2026-10-12 21:33:39 +11:00
benvin deleted branch benvin/stalwart-oidc 2026-10-12 21:33:39 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#45
Delete Branch "benvin/stalwart-oidc"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?