Add logviewer OAuth2 provider/application and akP-logviewer-admin permission #21

Merged

benvin merged 3 commits from benvin/logviewer-oidc into main 2026-08-23 23:02:39 +10:00

Conversation 0 Commits 3 Files Changed 3

+25

unkin-agent commented 2026-08-23 17:25:01 +10:00

Member

Copy Link

Copy Source

The ClickHouse log UI (logviewer) is being exposed at https://logviewer.unkin.net behind oauth2-proxy in the logging namespace; this adds the Authentik side as the prerequisite, mirroring the traefik onboarding.

• Adds config/providers_oauth2/logviewer.yaml: confidential client, client_id logviewer, secret read from Vault kv kubernetes/namespace/logging/default/oauth-credentials (seeded out of band), openid/email/profile scopes (ak_groups is attached to every oauth2 provider by the module), strict redirect URI https://logviewer.unkin.net/oauth2/callback.
• Adds config/permissions/akP-logviewer-admin.yaml bound to the logviewer application.
• Nests akP-logviewer-admin under akR-global-admin per convention.

The ClickHouse log UI (logviewer) is being exposed at https://logviewer.unkin.net behind oauth2-proxy in the `logging` namespace; this adds the Authentik side as the prerequisite, mirroring the traefik onboarding. - Adds `config/providers_oauth2/logviewer.yaml`: confidential client, `client_id` logviewer, secret read from Vault kv `kubernetes/namespace/logging/default/oauth-credentials` (seeded out of band), openid/email/profile scopes (ak_groups is attached to every oauth2 provider by the module), strict redirect URI `https://logviewer.unkin.net/oauth2/callback`. - Adds `config/permissions/akP-logviewer-admin.yaml` bound to the logviewer application. - Nests `akP-logviewer-admin` under `akR-global-admin` per convention.

unkin-agent added 1 commit 2026-08-23 17:25:01 +10:00

Add logviewer OAuth2 provider/application and akP-logviewer-admin permission ... 43d325146c

The ClickHouse log UI (logviewer) is being exposed at
https://logviewer.unkin.net behind oauth2-proxy in the logging namespace;
this adds the Authentik side as the prerequisite.

- Adds config/providers_oauth2/logviewer.yaml mirroring traefik: confidential
  client, client_id logviewer, secret from Vault kv
  kubernetes/namespace/logging/default/oauth-credentials,
  openid/email/profile scopes (ak_groups is attached to every oauth2
  provider by the module), strict redirect URI for the
  logviewer oauth2 callback.
- Adds config/permissions/akP-logviewer-admin.yaml bound to the logviewer
  application and nests it under akR-global-admin.

unkinben added 1 commit 2026-08-23 22:41:13 +10:00

Merge origin/main (jellyfin #19) into benvin/logviewer-oidc ... 937efb0360

Resolve akR-global-admin.yaml keeping both akP-jellyfin-admin (main) and
akP-logviewer-admin (this branch).

unkinben added 1 commit 2026-08-23 22:48:38 +10:00

Merge origin/main (traefik #20) into benvin/logviewer-oidc 0480303db6

benvin merged commit 62fb15791a into main 2026-08-23 23:02:39 +10:00

benvin deleted branch benvin/logviewer-oidc 2026-08-23 23:02:39 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is not working

duplicate

This issue or pull request already exists

enhancement

New feature

help wanted

Need some help

invalid

Something is wrong

question

More information is needed

wontfix

This won't be fixed

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#21