# OAuth2/OIDC provider + application for the Jellyfin web UI SSO, consumed by
# jellyfin-plugin-sso (OIDC) so the browser signs in via Authentik while native
# clients use the LDAP outpost (see providers_ldap/jellyfin-ldap.yaml).
#
# ONE shared confidential client (client_id jellyfin) serves BOTH Jellyfin
# instances -- fafflix (adults, jellyfin.k8s.syd1.au.unkin.net) and cheeztv
# (kids, cheeztv.unkin.net + cheeztv.k8s.syd1.au.unkin.net). Each instance runs
# the SSO plugin with provider name "authentik", so its callback is
# https://<host>/sso/OID/redirect/authentik (verified plugin path shape); all
# three hosts are listed as strict redirect URIs.
#
# Access is gated to media users only: akP-media-fafflix and akP-media-cheeztv
# carry `application: jellyfin` and bind to this app, so only members of the
# media roles (akR-media-adult / akR-media-kids) can authorize. Per-instance
# authorization (adults -> fafflix + cheeztv, kids -> cheeztv only) is enforced
# downstream by the media proxy reading the hierarchical ak_groups claim.
# Admin vs. user role inside Jellyfin is still mapped by the plugin matching the
# ak_groups claim against akP-jellyfin-admin / akP-jellyfin-user.
#
# client_secret is read from Vault (seeded out of band), never committed. Both
# instances share this one secret; terraform reads it from the fafflix namespace
# path, and the cheeztv Deployment reads the same value from its own namespace.
name: Jellyfin
authorization_flow: default-provider-authorization-implicit-consent
invalidation_flow: default-provider-invalidation-flow
client_type: confidential
client_id: jellyfin
# Explicit dashboard tile launch URL (the fafflix Jellyfin web UI).
launch_url: https://jellyfin.k8s.syd1.au.unkin.net/
client_secret_vault:
  mount: kv
  path: kubernetes/namespace/fafflix/default/oauth-credentials
scope_mappings:
  - goauthentik.io/providers/oauth2/scope-openid
  - goauthentik.io/providers/oauth2/scope-email
  - goauthentik.io/providers/oauth2/scope-profile
redirect_uris:
  # fafflix (adults)
  - matching_mode: strict
    url: https://jellyfin.k8s.syd1.au.unkin.net/sso/OID/redirect/authentik
  # cheeztv (kids) -- external + in-cluster hostnames
  - matching_mode: strict
    url: https://cheeztv.unkin.net/sso/OID/redirect/authentik
  - matching_mode: strict
    url: https://cheeztv.k8s.syd1.au.unkin.net/sso/OID/redirect/authentik