unkinben
0ba2785eb5
Register the k8s Gitea forge as an Authentik OIDC app so it can use SSO at cutover. Redirect URIs cover both the temporary git2 validation host and the final git.unkin.net host so login works across the migration. - add config/providers_oauth2/gitea.yaml (confidential OAuth2 provider + app, client_secret read from kv/kubernetes/namespace/gitea/default/oauth-credentials) Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
terraform-authentik
Terraform configuration for managing the Authentik identity provider at identity.unkin.net.
Managed Resources
- Groups — roles and group hierarchy (users are invited manually)
- SAML providers — SAML application integrations
- OAuth2/OIDC providers — OAuth2 and OpenID Connect integrations
- LDAP providers — LDAP provider and outpost configuration
- Applications — application definitions linked to providers
Configuration
Resources are defined as YAML files under config/:
config/
├── groups/ # Group definitions
├── providers_saml/ # SAML provider definitions
├── providers_oauth2/ # OAuth2/OIDC provider definitions
└── providers_ldap/ # LDAP provider definitions
Usage
make plan # init + plan
make apply # init + plan + apply
make format # format all .tf and .hcl files
Authentication
Set VAULT_ROLEID for local AppRole auth, or VAULT_AUTH_METHOD=kubernetes for CI.