homelab/terraform/authentik/main.tf

data "authentik_flow" "default_authorization_flow" {
  slug = var.default_authorization_flow
}

data "authentik_flow" "default_authentication_flow" {
  slug = var.default_authentication_flow
}

data "authentik_flow" "default_invalidation_flow" {
  slug = var.default_invalidation_flow
}

resource "authentik_group" "groups" {
  for_each = var.groups

  name         = each.value.name
  is_superuser = each.value.is_superuser
  parent       = each.value.parent
  attributes   = jsonencode(each.value.attributes)
}

resource "authentik_certificate_key_pair" "certificates" {
  for_each = var.certificates

  name             = each.value.name
  certificate_data = each.value.certificate_data
  key_data         = each.value.key_data
}


data "authentik_service_connection_kubernetes" "local_k8s" {
  name = "Local Kubernetes Cluster"
}

resource "authentik_flow" "flows" {
  for_each = var.flows

  name               = each.value.name
  title              = each.value.title
  slug               = each.value.slug
  designation        = each.value.designation
  policy_engine_mode = each.value.policy_engine_mode
  compatibility_mode = each.value.compatibility_mode
  layout             = each.value.layout
  denied_action      = each.value.denied_action
}

resource "authentik_property_mapping_provider_scope" "oidc_mappings" {
  for_each = {
    for k, v in var.property_mappings : k => v
    if v.oidc_scope != null
  }

  name       = each.value.name
  scope_name = each.value.oidc_scope
  expression = each.value.expression
}

resource "authentik_property_mapping_provider_saml" "saml_mappings" {
  for_each = {
    for k, v in var.property_mappings : k => v
    if v.saml_name != null
  }

  name       = each.value.name
  saml_name  = each.value.saml_name
  expression = each.value.expression
}

module "oauth_applications" {
  source = "./modules/oauth-provider"

  for_each = var.oauth_applications

  name                       = each.value.name
  app_name                   = each.value.name
  app_slug                   = each.value.slug
  app_group                  = each.value.group
  client_id                  = each.value.client_id
  authorization_flow         = try(authentik_flow.flows[each.value.authorization_flow].id, data.authentik_flow.default_authorization_flow.id)
  invalidation_flow          = data.authentik_flow.default_invalidation_flow.id
  redirect_uris              = each.value.redirect_uris
  client_type                = each.value.client_type
  include_claims_in_id_token = each.value.include_claims_in_id_token
  access_code_validity       = each.value.access_code_validity
  access_token_validity      = each.value.access_token_validity
  refresh_token_validity     = each.value.refresh_token_validity
  property_mappings          = each.value.property_mappings
  signing_key                = each.value.signing_key
  policy_engine_mode         = each.value.policy_engine_mode
  meta_description           = each.value.meta_description
  meta_launch_url            = each.value.meta_launch_url
  meta_icon                  = each.value.meta_icon
}

module "proxy_applications" {
  source = "./modules/proxy-provider"

  for_each = var.proxy_applications

  name                          = each.value.name
  app_name                      = each.value.name
  app_slug                      = each.value.slug
  app_group                     = each.value.group
  external_host                 = each.value.external_host
  internal_host                 = each.value.internal_host
  internal_host_ssl_validation  = each.value.internal_host_ssl_validation
  authorization_flow            = try(authentik_flow.flows[each.value.authorization_flow].id, data.authentik_flow.default_authorization_flow.id)
  invalidation_flow             = data.authentik_flow.default_invalidation_flow.id
  mode                          = each.value.mode
  intercept_header_auth         = each.value.intercept_header_auth
  basic_auth_enabled            = each.value.basic_auth_enabled
  basic_auth_user_attribute     = each.value.basic_auth_username_attribute
  basic_auth_password_attribute = each.value.basic_auth_password_attribute
  cookie_domain                 = each.value.cookie_domain
  skip_path_regex               = each.value.skip_path_regex
  policy_engine_mode            = each.value.policy_engine_mode
  meta_description              = each.value.meta_description
  meta_launch_url               = each.value.meta_launch_url
  meta_icon                     = each.value.meta_icon
}

locals {
  oauth_outpost_assignments = {
    for app_key, app in var.oauth_applications : app_key => app.outpost
    if app.outpost != null
  }

  proxy_outpost_assignments = {
    for app_key, app in var.proxy_applications : app_key => app.outpost
    if app.outpost != null
  }

  outpost_providers = {
    for outpost_key, outpost in var.outposts : outpost_key => concat(
      [for app_key, app_outpost in local.oauth_outpost_assignments :
      module.oauth_applications[app_key].provider_id if app_outpost == outpost_key],
      [for app_key, app_outpost in local.proxy_outpost_assignments :
      module.proxy_applications[app_key].provider_id if app_outpost == outpost_key]
    )
  }
}

resource "authentik_outpost" "outposts" {
  for_each = {
    for k, v in var.outposts : k => v
    if length(lookup(local.outpost_providers, k, [])) > 0
  }

  name               = each.value.name
  type               = "proxy"
  protocol_providers = local.outpost_providers[each.key]
  service_connection = data.authentik_service_connection_kubernetes.local_k8s.id
  config = jsonencode({
    log_level                      = "info"
    docker_labels                  = null
    authentik_host                 = var.authentik_url
    docker_network                 = null
    container_image                = null
    docker_map_ports               = true
    refresh_interval               = "minutes=5"
    kubernetes_replicas            = 1
    kubernetes_namespace           = "authentik"
    authentik_host_browser         = ""
    object_naming_template         = "ak-outpost-%(name)s"
    authentik_host_insecure        = false
    kubernetes_json_patches        = null
    kubernetes_service_type        = "ClusterIP"
    kubernetes_image_pull_secrets  = []
    kubernetes_ingress_class_name  = null
    kubernetes_disabled_components = []
    kubernetes_ingress_annotations = {}
    kubernetes_ingress_secret_name = "authentik-outpost-tls"
  })

  depends_on = [
    module.oauth_applications,
    module.proxy_applications
  ]
}