From 72e65d78104189fcd4b364b7d29b9a971b1568a2 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 29 Aug 2026 20:57:54 +1000 Subject: [PATCH 1/2] Onboard mediamark to Authentik OIDC Add an oauth2 provider/application for the mediamark kids-content marking UI, a permission group gating it, and nest that permission in akR-media-adult. --- config/permissions/akP-mediamark.yaml | 3 +++ config/providers_oauth2/mediamark.yaml | 25 +++++++++++++++++++++++++ config/roles/akR-media-adult.yaml | 5 ++++- 3 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 config/permissions/akP-mediamark.yaml create mode 100644 config/providers_oauth2/mediamark.yaml diff --git a/config/permissions/akP-mediamark.yaml b/config/permissions/akP-mediamark.yaml new file mode 100644 index 0000000..f60aba0 --- /dev/null +++ b/config/permissions/akP-mediamark.yaml @@ -0,0 +1,3 @@ +# Permission group akP-mediamark (name = filename). Grants access to mediamark: +# bound to the mediamark application, gating the kids-content marking UI. +application: mediamark diff --git a/config/providers_oauth2/mediamark.yaml b/config/providers_oauth2/mediamark.yaml new file mode 100644 index 0000000..6551cbc --- /dev/null +++ b/config/providers_oauth2/mediamark.yaml @@ -0,0 +1,25 @@ +# OAuth2/OIDC provider + application for mediamark (the Go web UI for marking +# media as kids content, served at https://mediamark.unkin.net (external +# hostname) and https://mediamark.k8s.syd1.au.unkin.net (cluster hostname) in +# the arrstack namespace). An oauth2-proxy in front of the UI performs the OIDC +# login with a relative redirect, so both hostnames must be registered; access +# is gated on the user's hierarchical ak_groups claim (akP-mediamark). +# client_secret is read from Vault (seeded out of band), never committed. +name: mediamark +authorization_flow: default-provider-authorization-implicit-consent +invalidation_flow: default-provider-invalidation-flow +client_type: confidential +client_id: mediamark +launch_url: https://mediamark.unkin.net/ +client_secret_vault: + mount: kv + path: kubernetes/namespace/arrstack/default/mediamark-oauth-credentials +scope_mappings: + - goauthentik.io/providers/oauth2/scope-openid + - goauthentik.io/providers/oauth2/scope-email + - goauthentik.io/providers/oauth2/scope-profile +redirect_uris: + - matching_mode: strict + url: https://mediamark.k8s.syd1.au.unkin.net/oauth2/callback + - matching_mode: strict + url: https://mediamark.unkin.net/oauth2/callback diff --git a/config/roles/akR-media-adult.yaml b/config/roles/akR-media-adult.yaml index 16f88e2..c898d49 100644 --- a/config/roles/akR-media-adult.yaml +++ b/config/roles/akR-media-adult.yaml @@ -2,7 +2,10 @@ # adult ("fafflix") and kids ("cheeztv") services, so this role nests both # per-service entitlements. Membership propagates child -> parent, so a member # appears in both permission groups in the hierarchical `ak_groups` claim and the -# media proxy routes/authorizes them for fafflix and cheeztv. +# media proxy routes/authorizes them for fafflix and cheeztv. Adults also curate +# which titles are kids content, so the role nests akP-mediamark for access to +# the mediamark UI. permissions: - akP-media-fafflix - akP-media-cheeztv + - akP-mediamark -- 2.47.3 From 1485962cf5288a5d1662ed8f00ec112daea36413 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 29 Aug 2026 21:13:41 +1000 Subject: [PATCH 2/2] Fix mediamark Vault secret path and permission group name The terraform-authentik runner's Vault policy only grants read on kv/data/kubernetes/namespace/+/default/oauth-credentials (literal trailing filename), so the arrstack/default/mediamark-oauth-credentials path 403s at plan time and reddens CI. mediamark deploys in its own `mediamark` namespace (watchstate model), so point the data source at kubernetes/namespace/mediamark/default/oauth-credentials, which the policy covers. Hostnames are unchanged. Rename the permission group to akP-mediamark-user to match the peer tier-suffix convention (akP-watchstate-admin, akP-arrstack-user). The group name is derived from the filename in config/config.hcl, so update the akR-media-adult reference too. --- config/permissions/akP-mediamark-user.yaml | 4 ++++ config/permissions/akP-mediamark.yaml | 3 --- config/providers_oauth2/mediamark.yaml | 9 +++++---- config/roles/akR-media-adult.yaml | 6 +++--- 4 files changed, 12 insertions(+), 10 deletions(-) create mode 100644 config/permissions/akP-mediamark-user.yaml delete mode 100644 config/permissions/akP-mediamark.yaml diff --git a/config/permissions/akP-mediamark-user.yaml b/config/permissions/akP-mediamark-user.yaml new file mode 100644 index 0000000..a7f1e22 --- /dev/null +++ b/config/permissions/akP-mediamark-user.yaml @@ -0,0 +1,4 @@ +# Permission group akP-mediamark-user (name = filename). Grants user access to +# mediamark: bound to the mediamark application, gating the kids-content +# marking UI. +application: mediamark diff --git a/config/permissions/akP-mediamark.yaml b/config/permissions/akP-mediamark.yaml deleted file mode 100644 index f60aba0..0000000 --- a/config/permissions/akP-mediamark.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# Permission group akP-mediamark (name = filename). Grants access to mediamark: -# bound to the mediamark application, gating the kids-content marking UI. -application: mediamark diff --git a/config/providers_oauth2/mediamark.yaml b/config/providers_oauth2/mediamark.yaml index 6551cbc..5114ca8 100644 --- a/config/providers_oauth2/mediamark.yaml +++ b/config/providers_oauth2/mediamark.yaml @@ -1,9 +1,10 @@ # OAuth2/OIDC provider + application for mediamark (the Go web UI for marking # media as kids content, served at https://mediamark.unkin.net (external # hostname) and https://mediamark.k8s.syd1.au.unkin.net (cluster hostname) in -# the arrstack namespace). An oauth2-proxy in front of the UI performs the OIDC -# login with a relative redirect, so both hostnames must be registered; access -# is gated on the user's hierarchical ak_groups claim (akP-mediamark). +# its own mediamark namespace). An oauth2-proxy in front of the UI performs the +# OIDC login with a relative redirect, so both hostnames must be registered; +# access is gated on the user's hierarchical ak_groups claim +# (akP-mediamark-user). # client_secret is read from Vault (seeded out of band), never committed. name: mediamark authorization_flow: default-provider-authorization-implicit-consent @@ -13,7 +14,7 @@ client_id: mediamark launch_url: https://mediamark.unkin.net/ client_secret_vault: mount: kv - path: kubernetes/namespace/arrstack/default/mediamark-oauth-credentials + path: kubernetes/namespace/mediamark/default/oauth-credentials scope_mappings: - goauthentik.io/providers/oauth2/scope-openid - goauthentik.io/providers/oauth2/scope-email diff --git a/config/roles/akR-media-adult.yaml b/config/roles/akR-media-adult.yaml index c898d49..13620d1 100644 --- a/config/roles/akR-media-adult.yaml +++ b/config/roles/akR-media-adult.yaml @@ -3,9 +3,9 @@ # per-service entitlements. Membership propagates child -> parent, so a member # appears in both permission groups in the hierarchical `ak_groups` claim and the # media proxy routes/authorizes them for fafflix and cheeztv. Adults also curate -# which titles are kids content, so the role nests akP-mediamark for access to -# the mediamark UI. +# which titles are kids content, so the role nests akP-mediamark-user for access +# to the mediamark UI. permissions: - akP-media-fafflix - akP-media-cheeztv - - akP-mediamark + - akP-mediamark-user -- 2.47.3