From e7c1f561f15e544ae5af3ee93147e4d7205385ef Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 16 Aug 2026 15:00:05 +1000 Subject: [PATCH 1/2] add arrstack oauth app + per-app access groups Add the Authentik OIDC application that fronts the arrproxy media front door at arrstack.unkin.net, plus the per-app entitlement groups arrproxy reads from the user's groups claim to decide which backends (sonarr/radarr/prowlarr) a user may reach. - config/providers_oauth2/arrstack.yaml: confidential oauth2 client client_id=arrstack, litellm-style auth/invalidation flows, client_secret from Vault kv kubernetes/namespace/arrstack/default/oauth-credentials, openid/email/profile scopes, redirect https://arrstack.unkin.net/oauth2/callback, launch https://arrstack.unkin.net/. The module always attaches the estate's hierarchical ak_groups scope mapping, so the front door emits the groups claim. - config/permissions/akP-arrstack-user.yaml: front-door gate (application: arrstack). - config/permissions/akP-arrstack-{sonarr,radarr,prowlarr}.yaml: per-app entitlements, unbound (no application) so they only surface in the ak_groups claim for arrproxy to authorize backends. - config/roles/akR-arrstack-user.yaml: full media role nesting all four. - akR-global-admin: also nests the arrstack front door + all per-app perms. --- config/permissions/akP-arrstack-prowlarr.yaml | 6 ++++++ config/permissions/akP-arrstack-radarr.yaml | 6 ++++++ config/permissions/akP-arrstack-sonarr.yaml | 6 ++++++ config/permissions/akP-arrstack-user.yaml | 4 ++++ config/providers_oauth2/arrstack.yaml | 21 +++++++++++++++++++ config/roles/akR-arrstack-user.yaml | 10 +++++++++ config/roles/akR-global-admin.yaml | 6 ++++++ 7 files changed, 59 insertions(+) create mode 100644 config/permissions/akP-arrstack-prowlarr.yaml create mode 100644 config/permissions/akP-arrstack-radarr.yaml create mode 100644 config/permissions/akP-arrstack-sonarr.yaml create mode 100644 config/permissions/akP-arrstack-user.yaml create mode 100644 config/providers_oauth2/arrstack.yaml create mode 100644 config/roles/akR-arrstack-user.yaml diff --git a/config/permissions/akP-arrstack-prowlarr.yaml b/config/permissions/akP-arrstack-prowlarr.yaml new file mode 100644 index 0000000..2320348 --- /dev/null +++ b/config/permissions/akP-arrstack-prowlarr.yaml @@ -0,0 +1,6 @@ +# Permission group akP-arrstack-prowlarr (name = filename). Per-app entitlement: +# NOT bound to any application (no `application` field), so it does not gate OIDC. +# It exists purely to appear in the user's hierarchical `ak_groups` claim, which +# arrproxy reads (via oauth2-proxy X-Auth-Request-Groups) to decide whether to +# mint a token allowing the prowlarr backend. +attributes: {} diff --git a/config/permissions/akP-arrstack-radarr.yaml b/config/permissions/akP-arrstack-radarr.yaml new file mode 100644 index 0000000..4d91747 --- /dev/null +++ b/config/permissions/akP-arrstack-radarr.yaml @@ -0,0 +1,6 @@ +# Permission group akP-arrstack-radarr (name = filename). Per-app entitlement: +# NOT bound to any application (no `application` field), so it does not gate OIDC. +# It exists purely to appear in the user's hierarchical `ak_groups` claim, which +# arrproxy reads (via oauth2-proxy X-Auth-Request-Groups) to decide whether to +# mint a token allowing the radarr backend. +attributes: {} diff --git a/config/permissions/akP-arrstack-sonarr.yaml b/config/permissions/akP-arrstack-sonarr.yaml new file mode 100644 index 0000000..e04fdfd --- /dev/null +++ b/config/permissions/akP-arrstack-sonarr.yaml @@ -0,0 +1,6 @@ +# Permission group akP-arrstack-sonarr (name = filename). Per-app entitlement: +# NOT bound to any application (no `application` field), so it does not gate OIDC. +# It exists purely to appear in the user's hierarchical `ak_groups` claim, which +# arrproxy reads (via oauth2-proxy X-Auth-Request-Groups) to decide whether to +# mint a token allowing the sonarr backend. +attributes: {} diff --git a/config/permissions/akP-arrstack-user.yaml b/config/permissions/akP-arrstack-user.yaml new file mode 100644 index 0000000..c06b621 --- /dev/null +++ b/config/permissions/akP-arrstack-user.yaml @@ -0,0 +1,4 @@ +# Permission group akP-arrstack-user (name = filename). Front-door access to the +# arrstack application: bound to the arrstack oauth2 app, so only members of this +# group (or any role that nests it) can complete OIDC to the front door. +application: arrstack diff --git a/config/providers_oauth2/arrstack.yaml b/config/providers_oauth2/arrstack.yaml new file mode 100644 index 0000000..32a8afe --- /dev/null +++ b/config/providers_oauth2/arrstack.yaml @@ -0,0 +1,21 @@ +# OAuth2/OIDC provider + application for the arrstack front door +# (arrstack.unkin.net). An oauth2-proxy sidecar in front of the `arrproxy` Go +# service performs the OIDC login; arrproxy then derives which apps (sonarr, +# radarr, prowlarr) a user may reach from the user's group membership. +# client_secret is read from Vault (seeded out of band), never committed. +name: arrstack +authorization_flow: default-provider-authorization-implicit-consent +invalidation_flow: default-provider-invalidation-flow +client_type: confidential +client_id: arrstack +launch_url: https://arrstack.unkin.net/ +client_secret_vault: + mount: kv + path: kubernetes/namespace/arrstack/default/oauth-credentials +scope_mappings: + - goauthentik.io/providers/oauth2/scope-openid + - goauthentik.io/providers/oauth2/scope-email + - goauthentik.io/providers/oauth2/scope-profile +redirect_uris: + - matching_mode: strict + url: https://arrstack.unkin.net/oauth2/callback diff --git a/config/roles/akR-arrstack-user.yaml b/config/roles/akR-arrstack-user.yaml new file mode 100644 index 0000000..1791447 --- /dev/null +++ b/config/roles/akR-arrstack-user.yaml @@ -0,0 +1,10 @@ +# Role akR-arrstack-user (name = filename): full media access. Nests the +# arrstack front-door permission plus every per-app entitlement, so a member can +# log in at the front door and arrproxy will allow sonarr, radarr and prowlarr. +# For narrower access, assign the individual akP-arrstack- permission groups +# (together with akP-arrstack-user for the door) to a user directly instead. +permissions: + - akP-arrstack-user + - akP-arrstack-sonarr + - akP-arrstack-radarr + - akP-arrstack-prowlarr diff --git a/config/roles/akR-global-admin.yaml b/config/roles/akR-global-admin.yaml index 6c3af26..d7df0fc 100644 --- a/config/roles/akR-global-admin.yaml +++ b/config/roles/akR-global-admin.yaml @@ -4,3 +4,9 @@ permissions: - akP-argocd-admin - akP-rancher-admin - akP-litellm-admin + # arrstack has no admin tier (it is a proxy front door); grant global admins + # the front door plus every per-app entitlement so they reach all media apps. + - akP-arrstack-user + - akP-arrstack-sonarr + - akP-arrstack-radarr + - akP-arrstack-prowlarr -- 2.47.3 From 547cad6542da93eb6cd973db8ff4a3dd1cb27236 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 16 Aug 2026 15:41:33 +1000 Subject: [PATCH 2/2] ci: re-run plan after oauth-credentials seed -- 2.47.3