terraform-authentik/config/roles/akR-standard-user.yaml at main - terraform-authentik - Gitea

unkin/terraform-authentik

Files

T

unkin-agent bbbb61777c

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

Add Jellyfin OIDC provider, application and RBAC groups

Jellyfin moves to Authentik SSO via jellyfin-plugin-sso (OIDC), keeping
native clients on Jellyfin local/API auth. Adds the oauth2 provider and
application for jellyfin.k8s.syd1.au.unkin.net plus the akP permission
groups gating access, wired into the standard-user and global-admin
roles per the two-tier RBAC model.

- Adds providers_oauth2/jellyfin.yaml: confidential client, secret read
  from kv/kubernetes/namespace/jellyfin/default/oauth-credentials,
  redirect URIs for the SSO plugin callback paths
- Adds akP-jellyfin-admin and akP-jellyfin-user bound to the app
- Nests akP-jellyfin-user under akR-standard-user and
  akP-jellyfin-admin under akR-global-admin

2026-08-23 12:33:55 +10:00

8 lines

202 B

YAML

Raw Permalink Blame History

 # Role akR-standard-user (name = filename): standard (non-admin) access everywhere.
 permissions:
   - akP-grafana-user
   - akP-argocd-user
   - akP-rancher-user
   - akP-litellm-user
   - akP-jellyfin-user