unkin-agent
3396b399ce
Completes the Authentik-side plumbing for Jellyfin SSO across both media instances -- fafflix (adults, jellyfin.k8s.syd1.au.unkin.net) and cheeztv (kids, cheeztv.unkin.net + cheeztv.k8s.syd1.au.unkin.net) -- and adds an LDAP outpost so native clients can authenticate with app passwords. Why: the previously-merged jellyfin OIDC provider only covered the fafflix host and gated on the generic jellyfin permission groups. cheeztv needs SSO too, access should be limited to media users, and native (non-browser) clients need a password-based path. How: - providers_oauth2/jellyfin.yaml: one shared confidential client now lists strict redirect URIs for all three hosts using the verified jellyfin-plugin-sso callback path /sso/OID/redirect/authentik. Client secret moved to kv kubernetes/namespace/fafflix/default/oauth-credentials. - Access is gated to media users only: akP-media-fafflix and akP-media-cheeztv now carry `application: jellyfin` and bind to the app; akP-jellyfin-admin / akP-jellyfin-user are demoted to pure role-claim groups (no app binding), still mapped by the plugin for admin/user rights. Per-instance authz (adults -> both, kids -> cheeztv only) stays with the media proxy. - providers_ldap/jellyfin-ldap.yaml: new LDAP provider (base_dn DC=ldap,DC=goauthentik,DC=io, direct bind/search) + application (jellyfin-ldap) + outpost (jellyfin-ldap-outpost) via the existing module. - modules/authentik/main.tf: resolve LDAP bind/unbind flow slugs to ids via data.authentik_flow, matching the oauth2/saml convention.
46 lines
2.3 KiB
YAML
46 lines
2.3 KiB
YAML
# OAuth2/OIDC provider + application for the Jellyfin web UI SSO, consumed by
|
|
# jellyfin-plugin-sso (OIDC) so the browser signs in via Authentik while native
|
|
# clients use the LDAP outpost (see providers_ldap/jellyfin-ldap.yaml).
|
|
#
|
|
# ONE shared confidential client (client_id jellyfin) serves BOTH Jellyfin
|
|
# instances -- fafflix (adults, jellyfin.k8s.syd1.au.unkin.net) and cheeztv
|
|
# (kids, cheeztv.unkin.net + cheeztv.k8s.syd1.au.unkin.net). Each instance runs
|
|
# the SSO plugin with provider name "authentik", so its callback is
|
|
# https://<host>/sso/OID/redirect/authentik (verified plugin path shape); all
|
|
# three hosts are listed as strict redirect URIs.
|
|
#
|
|
# Access is gated to media users only: akP-media-fafflix and akP-media-cheeztv
|
|
# carry `application: jellyfin` and bind to this app, so only members of the
|
|
# media roles (akR-media-adult / akR-media-kids) can authorize. Per-instance
|
|
# authorization (adults -> fafflix + cheeztv, kids -> cheeztv only) is enforced
|
|
# downstream by the media proxy reading the hierarchical ak_groups claim.
|
|
# Admin vs. user role inside Jellyfin is still mapped by the plugin matching the
|
|
# ak_groups claim against akP-jellyfin-admin / akP-jellyfin-user.
|
|
#
|
|
# client_secret is read from Vault (seeded out of band), never committed. Both
|
|
# instances share this one secret; terraform reads it from the fafflix namespace
|
|
# path, and the cheeztv Deployment reads the same value from its own namespace.
|
|
name: Jellyfin
|
|
authorization_flow: default-provider-authorization-implicit-consent
|
|
invalidation_flow: default-provider-invalidation-flow
|
|
client_type: confidential
|
|
client_id: jellyfin
|
|
# Explicit dashboard tile launch URL (the fafflix Jellyfin web UI).
|
|
launch_url: https://jellyfin.k8s.syd1.au.unkin.net/
|
|
client_secret_vault:
|
|
mount: kv
|
|
path: kubernetes/namespace/fafflix/default/oauth-credentials
|
|
scope_mappings:
|
|
- goauthentik.io/providers/oauth2/scope-openid
|
|
- goauthentik.io/providers/oauth2/scope-email
|
|
- goauthentik.io/providers/oauth2/scope-profile
|
|
redirect_uris:
|
|
# fafflix (adults)
|
|
- matching_mode: strict
|
|
url: https://jellyfin.k8s.syd1.au.unkin.net/sso/OID/redirect/authentik
|
|
# cheeztv (kids) -- external + in-cluster hostnames
|
|
- matching_mode: strict
|
|
url: https://cheeztv.unkin.net/sso/OID/redirect/authentik
|
|
- matching_mode: strict
|
|
url: https://cheeztv.k8s.syd1.au.unkin.net/sso/OID/redirect/authentik
|