terraform-authentik

Terraform configuration for managing the Authentik identity provider at identity.unkin.net.

Managed Resources

• Groups — roles and group hierarchy (users are invited manually)
• SAML providers — SAML application integrations
• OAuth2/OIDC providers — OAuth2 and OpenID Connect integrations
• LDAP providers — LDAP provider and outpost configuration
• Applications — application definitions linked to providers
• Service accounts — machine identities with RBAC roles and API tokens (keys published to Vault kv)

Configuration

Resources are defined as YAML files under config/:

config/
├── groups/              # Group definitions
├── providers_saml/      # SAML provider definitions
├── providers_oauth2/    # OAuth2/OIDC provider definitions
├── providers_ldap/      # LDAP provider definitions
└── service_accounts/    # Automation service accounts + API tokens

Usage

make plan     # init + plan
make apply    # init + plan + apply
make format   # format all .tf and .hcl files

Authentication

Set VAULT_ROLEID for local AppRole auth, or VAULT_AUTH_METHOD=kubernetes for CI.