unkin-agent
bbbb61777c
Jellyfin moves to Authentik SSO via jellyfin-plugin-sso (OIDC), keeping native clients on Jellyfin local/API auth. Adds the oauth2 provider and application for jellyfin.k8s.syd1.au.unkin.net plus the akP permission groups gating access, wired into the standard-user and global-admin roles per the two-tier RBAC model. - Adds providers_oauth2/jellyfin.yaml: confidential client, secret read from kv/kubernetes/namespace/jellyfin/default/oauth-credentials, redirect URIs for the SSO plugin callback paths - Adds akP-jellyfin-admin and akP-jellyfin-user bound to the app - Nests akP-jellyfin-user under akR-standard-user and akP-jellyfin-admin under akR-global-admin
14 lines
459 B
YAML
14 lines
459 B
YAML
# Role akR-global-admin (name = filename): full admin across all onboarded apps.
|
|
permissions:
|
|
- akP-grafana-admin
|
|
- akP-argocd-admin
|
|
- akP-rancher-admin
|
|
- akP-litellm-admin
|
|
- akP-jellyfin-admin
|
|
# arrstack has no admin tier (it is a proxy front door); grant global admins
|
|
# the front door plus every per-app entitlement so they reach all media apps.
|
|
- akP-arrstack-user
|
|
- akP-arrstack-sonarr
|
|
- akP-arrstack-radarr
|
|
- akP-arrstack-prowlarr
|