unkin-agent
fedbb2fa42
Global admins get akP-jellyfin-admin but no path to a jellyfin-bound group, so Authentik denies them at the application gate. Add akP-media-fafflix and akP-media-cheeztv to reach it.
24 lines
797 B
YAML
24 lines
797 B
YAML
# Role akR-global-admin (name = filename): full admin across all onboarded apps.
|
|
# Nests akP-media-fafflix / akP-media-cheeztv so admins pass the jellyfin
|
|
# application gate and can reach the akP-jellyfin-admin rights nested below.
|
|
permissions:
|
|
- akP-grafana-admin
|
|
- akP-argocd-admin
|
|
- akP-rancher-admin
|
|
- akP-litellm-admin
|
|
- akP-jellyfin-admin
|
|
- akP-traefik-admin
|
|
- akP-logviewer-admin
|
|
- akP-watchstate-admin
|
|
- akP-repospawner-admin
|
|
- akP-vault-admin
|
|
- akP-artifactapi-admin
|
|
# arrstack has no admin tier (it is a proxy front door); grant global admins
|
|
# the front door plus every per-app entitlement so they reach all media apps.
|
|
- akP-arrstack-user
|
|
- akP-arrstack-sonarr
|
|
- akP-arrstack-radarr
|
|
- akP-arrstack-prowlarr
|
|
- akP-media-fafflix
|
|
- akP-media-cheeztv
|