unkin-agent
ec0646657d
The media services are splitting into an adult (fafflix) and kids (cheeztv) tier, and Authentik group membership will drive the media proxy's routing and authorization. This adds the two-tier RBAC groups so users can be assigned the right media access ahead of the provider/application wiring. - Add akP-media-fafflix and akP-media-cheeztv per-service permission entitlements (unbound, so they surface in the hierarchical ak_groups claim for the proxy) - Add akR-media-adult role nesting both fafflix and cheeztv (adults reach both) - Add akR-media-kids role nesting only cheeztv (kids reach kids services only)
terraform-authentik
Terraform configuration for managing the Authentik identity provider at identity.unkin.net.
Managed Resources
- Groups — roles and group hierarchy (users are invited manually)
- SAML providers — SAML application integrations
- OAuth2/OIDC providers — OAuth2 and OpenID Connect integrations
- LDAP providers — LDAP provider and outpost configuration
- Applications — application definitions linked to providers
Configuration
Resources are defined as YAML files under config/:
config/
├── groups/ # Group definitions
├── providers_saml/ # SAML provider definitions
├── providers_oauth2/ # OAuth2/OIDC provider definitions
└── providers_ldap/ # LDAP provider definitions
Usage
make plan # init + plan
make apply # init + plan + apply
make format # format all .tf and .hcl files
Authentication
Set VAULT_ROLEID for local AppRole auth, or VAULT_AUTH_METHOD=kubernetes for CI.