diff --git a/terraform/authentik/.terraform.lock.hcl b/terraform/authentik/.terraform.lock.hcl deleted file mode 100644 index d1a105b..0000000 --- a/terraform/authentik/.terraform.lock.hcl +++ /dev/null @@ -1,44 +0,0 @@ -# This file is maintained automatically by "terraform init". -# Manual edits may be lost in future updates. - -provider "registry.terraform.io/goauthentik/authentik" { - version = "2025.12.1" - constraints = ">= 2023.10.0, 2025.12.1" - hashes = [ - "h1:p9AGeRqK50wTHEIp7z7O4MUP83cs+lt7wPajZ9m9TB8=", - "zh:0e856d3b13614bc32346a236a8e84ba55ecd17238c2008d4b3e71aa8cb49f515", - "zh:2dcc44cd499c18ebbc4f763eff97a7b725763c8ac8fbb5d69c935413ccdc4962", - "zh:434100fc75ec7cd6b64cc9497e8273e79325fa8d285e9fd9d341c1a67421643b", - "zh:483484f66d2e8ce6fa4bfd91e824ceebf07d10acb5df5f366397c55227c4ae91", - "zh:596743a6f1c77a6f103b06ef8d932fe8f2376793b92478853dc84571d17c429f", - "zh:5ed2d5eb7db13229baaf042c725d5c64b58ffdcc641370175e0a88900af94bf1", - "zh:8aecd4cf782c82bee01098f72fe4ffff83707516007b32a01c7fcb19a9260338", - "zh:928c05ecac309287ff7d73ed6e478350fe3003557658ae5dc2be817a4268dba7", - "zh:9b9fd36dfb3e75da8b4478485272505ae9a3c67b10db173e1d2d76cfe2b637b8", - "zh:ab7cd8c61ab67a045854e32f0be1940a92746770dbf3c17bbe923e0259c4f897", - "zh:bb1360ec19a4fc1095d0ef1b7b6c5c3c1a91daac7cd1957d43a4cdbb7356a2e3", - "zh:d2186f4063aa1a547b52a53745d472e43f5343bc1674f2bbb91421c61b0fab50", - "zh:d74bbb67a77951b18ffd7b2863954e70ac03450ad2023cc305c66a5ff25d8d18", - "zh:f5970569ea0a479bbfbf2d452f5962e1c9bd472b82756db822d0e951363daa25", - ] -} - -provider "registry.terraform.io/hashicorp/random" { - version = "3.8.1" - constraints = ">= 3.5.0" - hashes = [ - "h1:u8AKlWVDTH5r9YLSeswoVEjiY72Rt4/ch7U+61ZDkiQ=", - "zh:08dd03b918c7b55713026037c5400c48af5b9f468f483463321bd18e17b907b4", - "zh:0eee654a5542dc1d41920bbf2419032d6f0d5625b03bd81339e5b33394a3e0ae", - "zh:229665ddf060aa0ed315597908483eee5b818a17d09b6417a0f52fd9405c4f57", - "zh:2469d2e48f28076254a2a3fc327f184914566d9e40c5780b8d96ebf7205f8bc0", - "zh:37d7eb334d9561f335e748280f5535a384a88675af9a9eac439d4cfd663bcb66", - "zh:741101426a2f2c52dee37122f0f4a2f2d6af6d852cb1db634480a86398fa3511", - "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:a902473f08ef8df62cfe6116bd6c157070a93f66622384300de235a533e9d4a9", - "zh:b85c511a23e57a2147355932b3b6dce2a11e856b941165793a0c3d7578d94d05", - "zh:c5172226d18eaac95b1daac80172287b69d4ce32750c82ad77fa0768be4ea4b8", - "zh:dab4434dba34aad569b0bc243c2d3f3ff86dd7740def373f2a49816bd2ff819b", - "zh:f49fd62aa8c5525a5c17abd51e27ca5e213881d58882fd42fec4a545b53c9699", - ] -} diff --git a/terraform/authentik/README.md b/terraform/authentik/README.md deleted file mode 100644 index ae55621..0000000 --- a/terraform/authentik/README.md +++ /dev/null @@ -1,81 +0,0 @@ -# Authentik Terraform Configuration - -Root Terraform configuration for managing Authentik SSO — applications (OAuth2/OIDC, Proxy, SAML), groups, outposts, flows, certificates, and property mappings. - -State is stored in Terraform Cloud (organization `ultradesu`, workspace `Authentik`). - -## Structure - -``` -. -├── main.tf # Resources: groups, outposts, policy bindings, module calls -├── variables.tf # Input variable definitions -├── outputs.tf # Outputs (app details, groups, flows, wiki data) -├── providers.tf # Authentik provider (goauthentik/authentik 2025.12.1) -├── state.tf # Terraform Cloud backend -├── terraform.tfvars # General settings: authentik_url, outposts, flows, tags -├── oauth2-apps.auto.tfvars # OAuth2/OIDC application definitions -├── proxy-apps.auto.tfvars # Proxy application definitions -├── groups.auto.tfvars # Group definitions -└── modules/ - ├── oauth-provider/ # OAuth2/OIDC provider + application - ├── proxy-provider/ # Proxy provider + application - └── saml-provider/ # SAML provider + application -``` - -## Usage - -```bash -# Set the API token -export TF_VAR_authentik_token="..." - -terraform init -terraform plan -terraform apply -``` - -All `*.auto.tfvars` files are loaded automatically — no `-var-file` flags needed. - -## Adding applications - -OAuth2/OIDC — add to `oauth2-apps.auto.tfvars`: - -```hcl -oauth_applications = { - "my-app" = { - name = "My App" - slug = "my-app" - group = "Tools" - redirect_uris = ["https://my-app.example.com/callback"] - create_group = true - access_groups = ["admins"] - } -} -``` - -Proxy — add to `proxy-apps.auto.tfvars`: - -```hcl -proxy_applications = { - "my-proxy" = { - name = "My Proxy" - slug = "my-proxy" - group = "Tools" - external_host = "https://my-proxy.example.com" - internal_host = "http://my-service.namespace.svc:80" - outpost = "kubernetes-outpost" - create_group = true - access_groups = ["admins"] - } -} -``` - -## CI/CD - -Managed via Gitea Actions (`.gitea/workflows/authentik-apps.yaml`). Runs `terraform apply` on push to `main` when files in `terraform/authentik/` change. Also generates a wiki page with the applications list. - -## Requirements - -- Terraform >= 1.0 -- goauthentik/authentik provider 2025.12.1 -- Authentik API token with admin permissions diff --git a/terraform/authentik/groups.auto.tfvars b/terraform/authentik/groups.auto.tfvars deleted file mode 100644 index 5dd26f7..0000000 --- a/terraform/authentik/groups.auto.tfvars +++ /dev/null @@ -1,10 +0,0 @@ -groups = { - "admins" = { - name = "Administrators" - is_superuser = true - attributes = { - notes = "Managed by Terraform" - } - } -} - diff --git a/terraform/authentik/main.tf b/terraform/authentik/main.tf deleted file mode 100644 index 2b7fc5c..0000000 --- a/terraform/authentik/main.tf +++ /dev/null @@ -1,361 +0,0 @@ -data "authentik_flow" "default_authorization_flow" { - slug = var.default_authorization_flow -} - -data "authentik_flow" "default_authentication_flow" { - slug = var.default_authentication_flow -} - -data "authentik_flow" "default_invalidation_flow" { - slug = var.default_invalidation_flow -} - -# Root groups (without parent) -resource "authentik_group" "root_groups" { - for_each = { - for k, v in var.groups : k => v - if v.parent == null - } - - name = each.value.name - is_superuser = each.value.is_superuser - attributes = jsonencode(each.value.attributes) -} - -# Child groups (with parent) -resource "authentik_group" "child_groups" { - for_each = { - for k, v in var.groups : k => v - if v.parent != null - } - - name = each.value.name - is_superuser = each.value.is_superuser - parents = authentik_group.root_groups[each.value.parent].id - attributes = jsonencode(each.value.attributes) - - depends_on = [authentik_group.root_groups] -} - -# Auto-created groups for proxy applications -resource "authentik_group" "proxy_app_groups" { - for_each = { - for k, v in var.proxy_applications : k => v - if v.create_group == true - } - - name = "TF-${each.value.name} Users" - is_superuser = false - attributes = jsonencode({ - notes = "Auto-created for ${each.value.name} application" - app_slug = each.value.slug - }) -} - -# Auto-created groups for OAuth applications -resource "authentik_group" "oauth_app_groups" { - for_each = { - for k, v in var.oauth_applications : k => v - if v.create_group == true - } - - name = "TF-${each.value.name} Users" - is_superuser = false - attributes = jsonencode({ - notes = "Auto-created for ${each.value.name} application" - app_slug = each.value.slug - }) -} - -resource "authentik_certificate_key_pair" "certificates" { - for_each = var.certificates - - name = each.value.name - certificate_data = each.value.certificate_data - key_data = each.value.key_data -} - - -data "authentik_service_connection_kubernetes" "local_k8s" { - name = "Local Kubernetes Cluster" -} - -resource "authentik_flow" "flows" { - for_each = var.flows - - name = each.value.name - title = each.value.title - slug = each.value.slug - designation = each.value.designation - policy_engine_mode = each.value.policy_engine_mode - compatibility_mode = each.value.compatibility_mode - layout = each.value.layout - denied_action = each.value.denied_action -} - -resource "authentik_property_mapping_provider_scope" "oidc_mappings" { - for_each = { - for k, v in var.property_mappings : k => v - if v.oidc_scope != null - } - - name = each.value.name - scope_name = each.value.oidc_scope - expression = each.value.expression -} - -resource "authentik_property_mapping_provider_saml" "saml_mappings" { - for_each = { - for k, v in var.property_mappings : k => v - if v.saml_name != null - } - - name = each.value.name - saml_name = each.value.saml_name - expression = each.value.expression -} - -module "oauth_applications" { - source = "./modules/oauth-provider" - - for_each = var.oauth_applications - - name = each.value.name - app_name = each.value.name - app_slug = each.value.slug - app_group = each.value.group - client_id = each.value.client_id - authorization_flow = try(authentik_flow.flows[each.value.authorization_flow].id, data.authentik_flow.default_authorization_flow.id) - invalidation_flow = data.authentik_flow.default_invalidation_flow.id - redirect_uris = each.value.redirect_uris - client_type = each.value.client_type - include_claims_in_id_token = each.value.include_claims_in_id_token - access_code_validity = each.value.access_code_validity - access_token_validity = each.value.access_token_validity - refresh_token_validity = each.value.refresh_token_validity - property_mappings = each.value.property_mappings - signing_key = each.value.signing_key - policy_engine_mode = each.value.policy_engine_mode - meta_description = each.value.meta_description - meta_launch_url = each.value.meta_launch_url - meta_icon = each.value.meta_icon - scope_mappings = each.value.scope_mappings - - # Access control - only pass explicitly defined groups - access_groups = [ - for group_key in each.value.access_groups : - try( - authentik_group.root_groups[group_key].id, - authentik_group.child_groups[group_key].id - ) - ] -} - -module "proxy_applications" { - source = "./modules/proxy-provider" - - for_each = var.proxy_applications - - name = each.value.name - app_name = each.value.name - app_slug = each.value.slug - app_group = each.value.group - external_host = each.value.external_host - internal_host = each.value.internal_host - internal_host_ssl_validation = each.value.internal_host_ssl_validation - authorization_flow = try(authentik_flow.flows[each.value.authorization_flow].id, data.authentik_flow.default_authorization_flow.id) - invalidation_flow = data.authentik_flow.default_invalidation_flow.id - mode = each.value.mode - intercept_header_auth = each.value.intercept_header_auth - basic_auth_enabled = each.value.basic_auth_enabled - basic_auth_user_attribute = each.value.basic_auth_username_attribute - basic_auth_password_attribute = each.value.basic_auth_password_attribute - cookie_domain = each.value.cookie_domain - skip_path_regex = each.value.skip_path_regex - policy_engine_mode = each.value.policy_engine_mode - meta_description = each.value.meta_description - meta_launch_url = each.value.meta_launch_url - meta_icon = each.value.meta_icon - - # Access control - only pass explicitly defined groups - access_groups = [ - for group_key in each.value.access_groups : - try( - authentik_group.root_groups[group_key].id, - authentik_group.child_groups[group_key].id - ) - ] -} - -# Binding auto-created groups to their applications -resource "authentik_policy_binding" "auto_group_bindings" { - for_each = { - for k, v in var.proxy_applications : k => v - if v.create_group == true - } - - target = module.proxy_applications[each.key].application_uuid - group = authentik_group.proxy_app_groups[each.key].id - order = 100 - - depends_on = [ - module.proxy_applications, - authentik_group.proxy_app_groups - ] -} - -# Binding auto-created groups to their OAuth applications -resource "authentik_policy_binding" "oauth_auto_group_bindings" { - for_each = { - for k, v in var.oauth_applications : k => v - if v.create_group == true - } - - target = module.oauth_applications[each.key].application_uuid - group = authentik_group.oauth_app_groups[each.key].id - order = 100 - - depends_on = [ - module.oauth_applications, - authentik_group.oauth_app_groups - ] -} - -module "saml_applications" { - source = "./modules/saml-provider" - - for_each = var.saml_applications - - name = each.value.name - app_name = each.value.name - app_slug = each.value.slug - app_group = each.value.group - authorization_flow = try(authentik_flow.flows[each.value.authorization_flow].id, data.authentik_flow.default_authorization_flow.id) - invalidation_flow = data.authentik_flow.default_invalidation_flow.id - acs_url = each.value.acs_url - issuer = each.value.issuer - audience = each.value.audience - sp_binding = each.value.sp_binding - signing_key = each.value.signing_key - property_mappings = [for pm in each.value.property_mappings : authentik_property_mapping_provider_saml.saml_mappings[pm].id] - name_id_mapping = each.value.name_id_mapping != null ? authentik_property_mapping_provider_saml.saml_mappings[each.value.name_id_mapping].id : null - assertion_valid_not_before = each.value.assertion_valid_not_before - assertion_valid_not_on_or_after = each.value.assertion_valid_not_on_or_after - session_valid_not_on_or_after = each.value.session_valid_not_on_or_after - policy_engine_mode = each.value.policy_engine_mode - meta_description = each.value.meta_description - meta_launch_url = each.value.meta_launch_url - meta_icon = each.value.meta_icon -} - -locals { - oauth_outpost_assignments = { - for app_key, app in var.oauth_applications : app_key => app.outpost - if app.outpost != null - } - - proxy_outpost_assignments = { - for app_key, app in var.proxy_applications : app_key => app.outpost - if app.outpost != null - } - - outpost_providers = { - for outpost_key, outpost in var.outposts : outpost_key => concat( - [for app_key, app_outpost in local.oauth_outpost_assignments : - module.oauth_applications[app_key].provider_id if app_outpost == outpost_key], - [for app_key, app_outpost in local.proxy_outpost_assignments : - module.proxy_applications[app_key].provider_id if app_outpost == outpost_key] - ) - } -} - -resource "authentik_outpost" "outposts" { - for_each = { - for k, v in var.outposts : k => v - if length(lookup(local.outpost_providers, k, [])) > 0 - } - - name = each.value.name - type = "proxy" - protocol_providers = local.outpost_providers[each.key] - service_connection = data.authentik_service_connection_kubernetes.local_k8s.id - config = jsonencode({ - log_level = "info" - docker_labels = null - authentik_host = var.authentik_url - docker_network = null - container_image = null - docker_map_ports = true - refresh_interval = "minutes=5" - kubernetes_replicas = 1 - kubernetes_namespace = "authentik" - authentik_host_browser = "" - object_naming_template = "ak-outpost-%(name)s" - authentik_host_insecure = false - kubernetes_json_patches = { - deployment = [ - { - op = "add" - path = "/spec/template/spec/containers/0/env/-" - value = { - name = "AUTHENTIK_POSTGRESQL__HOST" - value = "psql.psql.svc" - } - }, - { - op = "add" - path = "/spec/template/spec/containers/0/env/-" - value = { - name = "AUTHENTIK_POSTGRESQL__PORT" - value = "5432" - } - }, - { - op = "add" - path = "/spec/template/spec/containers/0/env/-" - value = { - name = "AUTHENTIK_POSTGRESQL__NAME" - value = "authentik" - } - }, - { - op = "add" - path = "/spec/template/spec/containers/0/env/-" - value = { - name = "AUTHENTIK_POSTGRESQL__USER" - valueFrom = { - secretKeyRef = { - name = "authentik-creds" - key = "AUTHENTIK_POSTGRESQL__USER" - } - } - } - }, - { - op = "add" - path = "/spec/template/spec/containers/0/env/-" - value = { - name = "AUTHENTIK_POSTGRESQL__PASSWORD" - valueFrom = { - secretKeyRef = { - name = "authentik-creds" - key = "AUTHENTIK_POSTGRESQL__PASSWORD" - } - } - } - } - ] - } - kubernetes_service_type = "ClusterIP" - kubernetes_image_pull_secrets = [] - kubernetes_ingress_class_name = null - kubernetes_disabled_components = [] - kubernetes_ingress_annotations = {} - kubernetes_ingress_secret_name = "idm-tls" - }) - - depends_on = [ - module.oauth_applications, - module.proxy_applications - ] -} diff --git a/terraform/authentik/modules/oauth-provider/main.tf b/terraform/authentik/modules/oauth-provider/main.tf deleted file mode 100644 index f87b9a0..0000000 --- a/terraform/authentik/modules/oauth-provider/main.tf +++ /dev/null @@ -1,103 +0,0 @@ -terraform { - required_providers { - authentik = { - source = "goauthentik/authentik" - version = ">= 2023.10.0" - } - random = { - source = "hashicorp/random" - version = ">= 3.5.0" - } - } -} - -# Get all available scope mappings -data "authentik_property_mapping_provider_scope" "all_scopes" { - managed_list = [ - "goauthentik.io/providers/oauth2/scope-email", - "goauthentik.io/providers/oauth2/scope-openid", - "goauthentik.io/providers/oauth2/scope-profile" - ] -} - -# Filter scope mappings based on requested scopes -locals { - scope_name_mapping = { - "openid" = "goauthentik.io/providers/oauth2/scope-openid" - "profile" = "goauthentik.io/providers/oauth2/scope-profile" - "email" = "goauthentik.io/providers/oauth2/scope-email" - } - - selected_scope_ids = [ - for scope in var.scope_mappings : - data.authentik_property_mapping_provider_scope.all_scopes.ids[index(data.authentik_property_mapping_provider_scope.all_scopes.managed_list, local.scope_name_mapping[scope])] - if contains(keys(local.scope_name_mapping), scope) - ] -} - -resource "random_password" "client_secret" { - count = var.client_secret == null ? 1 : 0 - length = 40 - special = true -} - -resource "authentik_provider_oauth2" "provider" { - name = var.name - client_id = var.client_id != null ? var.client_id : random_id.client_id[0].hex - client_secret = var.client_secret != null ? var.client_secret : random_password.client_secret[0].result - client_type = var.client_type - authorization_flow = var.authorization_flow - invalidation_flow = var.invalidation_flow - include_claims_in_id_token = var.include_claims_in_id_token - access_code_validity = var.access_code_validity - access_token_validity = var.access_token_validity - refresh_token_validity = var.refresh_token_validity - signing_key = var.signing_key - - allowed_redirect_uris = [ - for uri in var.redirect_uris : { - matching_mode = "strict" - url = uri - } - ] - - property_mappings = length(var.property_mappings) > 0 ? var.property_mappings : local.selected_scope_ids -} - -resource "random_id" "client_id" { - count = var.client_id == null ? 1 : 0 - byte_length = 20 -} - -resource "authentik_application" "app" { - name = var.app_name - slug = var.app_slug - protocol_provider = authentik_provider_oauth2.provider.id - group = var.app_group - policy_engine_mode = var.policy_engine_mode - meta_description = var.meta_description - meta_launch_url = var.meta_launch_url - meta_icon = var.meta_icon -} - -resource "authentik_policy_binding" "app_access" { - for_each = var.access_policies - - target = authentik_application.app.id - policy = each.value.policy_id - order = each.value.order - - enabled = lookup(each.value, "enabled", true) - timeout = lookup(each.value, "timeout", 30) - negate = lookup(each.value, "negate", false) - failure_result = lookup(each.value, "failure_result", true) -} - -# Binding groups to the application -resource "authentik_policy_binding" "group_bindings" { - for_each = { for idx, group_id in var.access_groups : idx => group_id } - - target = authentik_application.app.uuid - group = each.value - order = 10 + each.key -} \ No newline at end of file diff --git a/terraform/authentik/modules/oauth-provider/outputs.tf b/terraform/authentik/modules/oauth-provider/outputs.tf deleted file mode 100644 index 41b1235..0000000 --- a/terraform/authentik/modules/oauth-provider/outputs.tf +++ /dev/null @@ -1,30 +0,0 @@ -output "provider_id" { - description = "ID of the OAuth2 provider" - value = authentik_provider_oauth2.provider.id -} - -output "application_id" { - description = "ID of the application" - value = authentik_application.app.id -} - -output "application_uuid" { - description = "UUID of the application" - value = authentik_application.app.uuid -} - -output "client_id" { - description = "OAuth2 Client ID" - value = authentik_provider_oauth2.provider.client_id -} - -output "client_secret" { - description = "OAuth2 Client Secret" - value = authentik_provider_oauth2.provider.client_secret - sensitive = true -} - -output "application_slug" { - description = "Application slug" - value = authentik_application.app.slug -} \ No newline at end of file diff --git a/terraform/authentik/modules/oauth-provider/variables.tf b/terraform/authentik/modules/oauth-provider/variables.tf deleted file mode 100644 index cdab7c1..0000000 --- a/terraform/authentik/modules/oauth-provider/variables.tf +++ /dev/null @@ -1,150 +0,0 @@ -variable "name" { - description = "Name of the OAuth2 provider" - type = string -} - -variable "app_name" { - description = "Name of the application" - type = string -} - -variable "app_slug" { - description = "Slug of the application" - type = string -} - -variable "app_group" { - description = "Group for the application" - type = string - default = "" -} - -variable "client_id" { - description = "OAuth2 Client ID" - type = string - default = null -} - -variable "client_secret" { - description = "OAuth2 Client Secret" - type = string - default = null - sensitive = true -} - -variable "client_type" { - description = "OAuth2 Client type (confidential or public)" - type = string - default = "confidential" - - validation { - condition = contains(["confidential", "public"], var.client_type) - error_message = "Client type must be either 'confidential' or 'public'." - } -} - -variable "authorization_flow" { - description = "Authorization flow UUID" - type = string -} - -variable "invalidation_flow" { - description = "Invalidation flow UUID" - type = string -} - -variable "redirect_uris" { - description = "List of allowed redirect URIs" - type = list(string) - default = [] -} - -variable "access_code_validity" { - description = "Access code validity duration" - type = string - default = "minutes=1" -} - -variable "access_token_validity" { - description = "Access token validity duration" - type = string - default = "minutes=5" -} - -variable "refresh_token_validity" { - description = "Refresh token validity duration" - type = string - default = "days=30" -} - -variable "include_claims_in_id_token" { - description = "Include claims in ID token" - type = bool - default = true -} - -variable "signing_key" { - description = "Signing key UUID" - type = string - default = null -} - -variable "property_mappings" { - description = "List of property mapping UUIDs" - type = list(string) - default = [] -} - -variable "policy_engine_mode" { - description = "Policy engine mode" - type = string - default = "all" - - validation { - condition = contains(["all", "any"], var.policy_engine_mode) - error_message = "Policy engine mode must be either 'all' or 'any'." - } -} - -variable "meta_description" { - description = "Application meta description" - type = string - default = "" -} - -variable "meta_launch_url" { - description = "Application launch URL" - type = string - default = "" -} - -variable "meta_icon" { - description = "Application icon URL" - type = string - default = "" -} - -variable "access_policies" { - description = "Access policies for the application" - type = map(object({ - policy_id = string - order = number - enabled = optional(bool, true) - timeout = optional(number, 30) - negate = optional(bool, false) - failure_result = optional(bool, true) - })) - default = {} -} - -variable "access_groups" { - description = "List of group IDs that have access to the application" - type = list(string) - default = [] -} - -variable "scope_mappings" { - description = "List of scope mappings for the OAuth provider" - type = list(string) - default = ["openid", "profile", "email"] -} \ No newline at end of file diff --git a/terraform/authentik/modules/proxy-provider/main.tf b/terraform/authentik/modules/proxy-provider/main.tf deleted file mode 100644 index 44b2fad..0000000 --- a/terraform/authentik/modules/proxy-provider/main.tf +++ /dev/null @@ -1,58 +0,0 @@ -terraform { - required_providers { - authentik = { - source = "goauthentik/authentik" - version = ">= 2023.10.0" - } - } -} - -resource "authentik_provider_proxy" "provider" { - name = var.name - external_host = var.external_host - internal_host = var.internal_host - internal_host_ssl_validation = var.internal_host_ssl_validation - authorization_flow = var.authorization_flow - invalidation_flow = var.invalidation_flow - mode = var.mode - cookie_domain = var.cookie_domain - skip_path_regex = var.skip_path_regex - intercept_header_auth = var.intercept_header_auth - basic_auth_enabled = var.basic_auth_enabled - basic_auth_password_attribute = var.basic_auth_password_attribute - - property_mappings = var.property_mappings -} - -resource "authentik_application" "app" { - name = var.app_name - slug = var.app_slug - protocol_provider = authentik_provider_proxy.provider.id - group = var.app_group - policy_engine_mode = var.policy_engine_mode - meta_description = var.meta_description - meta_launch_url = var.meta_launch_url - meta_icon = var.meta_icon -} - -resource "authentik_policy_binding" "app_access" { - for_each = var.access_policies - - target = authentik_application.app.id - policy = each.value.policy_id - order = each.value.order - - enabled = lookup(each.value, "enabled", true) - timeout = lookup(each.value, "timeout", 30) - negate = lookup(each.value, "negate", false) - failure_result = lookup(each.value, "failure_result", true) -} - -# Binding groups to the application -resource "authentik_policy_binding" "group_bindings" { - for_each = { for idx, group_id in var.access_groups : idx => group_id } - - target = authentik_application.app.uuid - group = each.value - order = 10 + each.key -} \ No newline at end of file diff --git a/terraform/authentik/modules/proxy-provider/outputs.tf b/terraform/authentik/modules/proxy-provider/outputs.tf deleted file mode 100644 index 58f8d71..0000000 --- a/terraform/authentik/modules/proxy-provider/outputs.tf +++ /dev/null @@ -1,35 +0,0 @@ -output "provider_id" { - description = "ID of the Proxy provider" - value = authentik_provider_proxy.provider.id -} - -output "application_id" { - description = "ID of the application" - value = authentik_application.app.id -} - -output "application_uuid" { - description = "UUID of the application" - value = authentik_application.app.uuid -} - -output "application_slug" { - description = "Application slug" - value = authentik_application.app.slug -} - -output "launch_url" { - description = "Application launch URL" - value = authentik_application.app.meta_launch_url -} - -output "external_host" { - description = "External host URL" - value = authentik_provider_proxy.provider.external_host -} - -output "internal_host" { - description = "Internal host URL" - value = authentik_provider_proxy.provider.internal_host -} - diff --git a/terraform/authentik/modules/proxy-provider/variables.tf b/terraform/authentik/modules/proxy-provider/variables.tf deleted file mode 100644 index 2829a28..0000000 --- a/terraform/authentik/modules/proxy-provider/variables.tf +++ /dev/null @@ -1,151 +0,0 @@ -variable "name" { - description = "Name of the Proxy provider" - type = string -} - -variable "app_name" { - description = "Name of the application" - type = string -} - -variable "app_slug" { - description = "Slug of the application" - type = string -} - -variable "app_group" { - description = "Group for the application" - type = string - default = "" -} - -variable "external_host" { - description = "External hostname for the proxy" - type = string -} - -variable "internal_host" { - description = "Internal hostname for the proxy" - type = string - default = "" -} - -variable "internal_host_ssl_validation" { - description = "Enable SSL validation for internal host" - type = bool - default = true -} - -variable "authorization_flow" { - description = "Authorization flow UUID" - type = string -} - -variable "invalidation_flow" { - description = "Invalidation flow UUID" - type = string -} - -variable "mode" { - description = "Proxy mode (proxy, forward_single, forward_domain)" - type = string - default = "proxy" - - validation { - condition = contains(["proxy", "forward_single", "forward_domain"], var.mode) - error_message = "Mode must be one of: proxy, forward_single, forward_domain." - } -} - - -variable "cookie_domain" { - description = "Cookie domain for the proxy" - type = string - default = "" -} - - -variable "skip_path_regex" { - description = "Regular expression for paths to skip authentication" - type = string - default = "" -} - -variable "intercept_header_auth" { - description = "Intercept header authentication" - type = bool - default = false -} - -variable "basic_auth_enabled" { - description = "Enable basic authentication" - type = bool - default = false -} - -variable "basic_auth_password_attribute" { - description = "Attribute for basic auth password" - type = string - default = "" -} - -variable "basic_auth_user_attribute" { - description = "Attribute for basic auth username" - type = string - default = "" -} - -variable "property_mappings" { - description = "List of property mapping UUIDs" - type = list(string) - default = [] -} - -variable "policy_engine_mode" { - description = "Policy engine mode" - type = string - default = "all" - - validation { - condition = contains(["all", "any"], var.policy_engine_mode) - error_message = "Policy engine mode must be either 'all' or 'any'." - } -} - -variable "meta_description" { - description = "Application meta description" - type = string - default = "" -} - -variable "meta_launch_url" { - description = "Application launch URL" - type = string - default = "" -} - -variable "meta_icon" { - description = "Application icon URL" - type = string - default = "" -} - - -variable "access_policies" { - description = "Access policies for the application" - type = map(object({ - policy_id = string - order = number - enabled = optional(bool, true) - timeout = optional(number, 30) - negate = optional(bool, false) - failure_result = optional(bool, true) - })) - default = {} -} - -variable "access_groups" { - description = "List of group IDs that have access to the application" - type = list(string) - default = [] -} \ No newline at end of file diff --git a/terraform/authentik/modules/saml-provider/main.tf b/terraform/authentik/modules/saml-provider/main.tf deleted file mode 100644 index 33ebd39..0000000 --- a/terraform/authentik/modules/saml-provider/main.tf +++ /dev/null @@ -1,53 +0,0 @@ -terraform { - required_providers { - authentik = { - source = "goauthentik/authentik" - version = ">= 2023.10.0" - } - } -} - -data "authentik_certificate_key_pair" "default" { - name = "authentik Self-signed Certificate" -} - -resource "authentik_provider_saml" "provider" { - name = var.name - authorization_flow = var.authorization_flow - invalidation_flow = var.invalidation_flow - acs_url = var.acs_url - issuer = var.issuer - audience = var.audience - sp_binding = var.sp_binding - signing_kp = var.signing_key != null ? var.signing_key : data.authentik_certificate_key_pair.default.id - property_mappings = var.property_mappings - name_id_mapping = var.name_id_mapping - - assertion_valid_not_before = var.assertion_valid_not_before - assertion_valid_not_on_or_after = var.assertion_valid_not_on_or_after - session_valid_not_on_or_after = var.session_valid_not_on_or_after -} - -resource "authentik_application" "app" { - name = var.app_name - slug = var.app_slug - protocol_provider = authentik_provider_saml.provider.id - group = var.app_group - policy_engine_mode = var.policy_engine_mode - meta_description = var.meta_description - meta_launch_url = var.meta_launch_url - meta_icon = var.meta_icon -} - -resource "authentik_policy_binding" "app_access" { - for_each = var.access_policies - - target = authentik_application.app.id - policy = each.value.policy_id - order = each.value.order - - enabled = lookup(each.value, "enabled", true) - timeout = lookup(each.value, "timeout", 30) - negate = lookup(each.value, "negate", false) - failure_result = lookup(each.value, "failure_result", true) -} \ No newline at end of file diff --git a/terraform/authentik/modules/saml-provider/outputs.tf b/terraform/authentik/modules/saml-provider/outputs.tf deleted file mode 100644 index f950740..0000000 --- a/terraform/authentik/modules/saml-provider/outputs.tf +++ /dev/null @@ -1,24 +0,0 @@ -output "provider_id" { - description = "ID of the SAML provider" - value = authentik_provider_saml.provider.id -} - -output "application_id" { - description = "ID of the application" - value = authentik_application.app.id -} - -output "provider_name" { - description = "Name of the SAML provider" - value = authentik_provider_saml.provider.name -} - -output "acs_url" { - description = "Assertion Consumer Service URL" - value = authentik_provider_saml.provider.acs_url -} - -output "issuer" { - description = "SAML Issuer" - value = authentik_provider_saml.provider.issuer -} \ No newline at end of file diff --git a/terraform/authentik/modules/saml-provider/variables.tf b/terraform/authentik/modules/saml-provider/variables.tf deleted file mode 100644 index d0dd9a7..0000000 --- a/terraform/authentik/modules/saml-provider/variables.tf +++ /dev/null @@ -1,124 +0,0 @@ -variable "name" { - description = "Name of the SAML provider" - type = string -} - -variable "app_name" { - description = "Name of the application" - type = string -} - -variable "app_slug" { - description = "Slug of the application" - type = string -} - -variable "app_group" { - description = "Group of the application" - type = string - default = "" -} - -variable "authorization_flow" { - description = "Authorization flow ID" - type = string -} - -variable "invalidation_flow" { - description = "Invalidation flow ID" - type = string -} - -variable "acs_url" { - description = "Assertion Consumer Service URL" - type = string -} - -variable "issuer" { - description = "SAML Issuer" - type = string -} - -variable "audience" { - description = "SAML Audience" - type = string -} - -variable "sp_binding" { - description = "Service Provider binding (post or redirect)" - type = string - default = "post" -} - -variable "signing_key" { - description = "Certificate key pair ID for signing" - type = string - default = null -} - -variable "property_mappings" { - description = "List of property mapping IDs" - type = list(string) - default = [] -} - -variable "name_id_mapping" { - description = "Property mapping ID for NameID" - type = string - default = null -} - -variable "assertion_valid_not_before" { - description = "Assertion valid not before" - type = string - default = "minutes=-5" -} - -variable "assertion_valid_not_on_or_after" { - description = "Assertion valid not on or after" - type = string - default = "minutes=5" -} - -variable "session_valid_not_on_or_after" { - description = "Session valid not on or after" - type = string - default = "minutes=86400" -} - -variable "policy_engine_mode" { - description = "Policy engine mode" - type = string - default = "all" -} - -variable "meta_description" { - description = "Application description" - type = string - default = "" -} - -variable "meta_launch_url" { - description = "Application launch URL" - type = string - default = "" -} - -variable "meta_icon" { - description = "Application icon URL" - type = string - default = "" -} - -variable "access_policies" { - description = "Access policies for the application" - type = map(object({ - policy_id = string - order = number - enabled = optional(bool, true) - timeout = optional(number, 30) - negate = optional(bool, false) - failure_result = optional(bool, true) - })) - default = {} -} \ No newline at end of file diff --git a/terraform/authentik/oauth2-apps.auto.tfvars b/terraform/authentik/oauth2-apps.auto.tfvars deleted file mode 100644 index ea6d510..0000000 --- a/terraform/authentik/oauth2-apps.auto.tfvars +++ /dev/null @@ -1,232 +0,0 @@ -oauth_applications = { - "paperless" = { - name = "Paperless-NGX" - slug = "paperless" - group = "Tools" - meta_description = "Document management system" - meta_icon = "https://img.icons8.com/fluency/48/documents.png" - redirect_uris = ["https://docs.hexor.cy/accounts/oidc/authentik/login/callback/"] - client_type = "confidential" - include_claims_in_id_token = true - access_code_validity = "minutes=1" - access_token_validity = "minutes=5" - refresh_token_validity = "days=30" - scope_mappings = ["openid", "profile", "email"] - create_group = true - access_groups = ["admins"] - } - - "gitea" = { - name = "Gitea" - slug = "gitea" - group = "Tools" - meta_description = "Git repository hosting" - meta_icon = "https://img.icons8.com/?size=100&id=20906&format=png&color=000000" - redirect_uris = ["https://gt.hexor.cy/user/oauth2/Authentik/callback"] - client_type = "confidential" - include_claims_in_id_token = true - access_code_validity = "minutes=1" - access_token_validity = "minutes=10" - refresh_token_validity = "days=30" - scope_mappings = ["openid", "profile", "email"] - access_groups = ["admins"] - } - - "jellyfin" = { - name = "Jellyfin" - slug = "jellyfin" - group = "Media and Storage" - meta_description = "Media streaming server" - meta_icon = "https://img.icons8.com/plasticine/100/jellyfin.png" - redirect_uris = [ - "https://jf.hexor.cy/sso/OID/r/authentik", - "https://jf.hexor.cy/sso/OID/redirect/authentik" - ] - client_type = "confidential" - include_claims_in_id_token = true - access_code_validity = "minutes=1" - access_token_validity = "minutes=10" - refresh_token_validity = "days=30" - scope_mappings = ["openid", "profile", "email"] - access_groups = ["admins"] - } - - "argocd" = { - name = "ArgoCD" - slug = "argocd" - group = "Core" - meta_description = "GitOps deployment tool" - meta_icon = "https://img.icons8.com/color-glass/48/octopus.png" - redirect_uris = ["https://ag.hexor.cy/auth/callback"] - client_type = "confidential" - include_claims_in_id_token = true - access_code_validity = "minutes=1" - access_token_validity = "minutes=5" - refresh_token_validity = "days=30" - scope_mappings = ["openid", "profile", "email"] - signing_key = "1b1b5bec-034a-4d96-871a-133f11322360" - access_groups = ["admins"] - } - - "grafana" = { - name = "Grafana" - slug = "grafana" - group = "Core" - meta_description = "Monitoring and observability" - meta_icon = "https://img.icons8.com/fluency/48/grafana.png" - redirect_uris = ["https://gf.hexor.cy/login/generic_oauth"] - client_type = "confidential" - include_claims_in_id_token = true - access_code_validity = "minutes=1" - access_token_validity = "minutes=5" - refresh_token_validity = "days=30" - scope_mappings = ["openid", "profile", "email"] - access_groups = ["admins"] - } - - "immich" = { - name = "Immich" - slug = "immich" - group = "Media and Storage" - meta_description = "Photo and video management" - meta_icon = "https://img.icons8.com/fluency/48/photos.png" - redirect_uris = [ - "https://photos.hexor.cy/auth/login", - "https://photos.hexor.cy/user-settings", - "app.immich:///oauth-callback", - "http://photos.homenet:30283/auth/login", - "http://photos.homenet:30283/user-settings" - ] - client_type = "confidential" - include_claims_in_id_token = true - access_code_validity = "minutes=1" - access_token_validity = "minutes=5" - refresh_token_validity = "days=30" - scope_mappings = ["openid", "profile", "email"] - signing_key = "1b1b5bec-034a-4d96-871a-133f11322360" - access_groups = ["admins"] - create_group = true - } - - "pgadmin" = { - name = "Postgres WEB Admin" - slug = "pgadmin" - group = "Core" - meta_description = "PostgreSQL WEB administration" - meta_icon = "https://img.icons8.com/?size=100&id=JRnxU7ZWP4mi&format=png&color=000000" - redirect_uris = ["https://pg.hexor.cy/oauth2/authorize"] - client_type = "confidential" - include_claims_in_id_token = true - access_code_validity = "minutes=1" - access_token_validity = "minutes=5" - refresh_token_validity = "days=30" - scope_mappings = ["openid", "profile", "email"] - access_groups = ["admins"] - signing_key = "1b1b5bec-034a-4d96-871a-133f11322360" - } - - "home-assistant-lms" = { - name = "Home Assistant LMS" - slug = "home-assistant-lms" - group = "Internal" - meta_description = "Home Assistant Limassol" - meta_icon = "https://img.icons8.com/stickers/100/smart-home-automation.png" - redirect_uris = [ - "http://ha-lms:8123/auth/oidc/callback", - "http://ha-lms.homenet:8123/auth/oidc/callback", - ] - meta_launch_url = "http://ha-lms:8123/auth/oidc/welcome" - client_type = "confidential" - include_claims_in_id_token = true - access_code_validity = "minutes=1" - access_token_validity = "minutes=5" - refresh_token_validity = "days=30" - scope_mappings = ["openid", "profile", "email"] - access_groups = ["admins"] - create_group = true - signing_key = "1b1b5bec-034a-4d96-871a-133f11322360" - } - "home-assistant-london" = { - name = "Home Assistant London" - slug = "home-assistant-london" - group = "Internal" - meta_description = "Home Assistant London" - meta_icon = "https://img.icons8.com/stickers/100/smart-home-automation.png" - redirect_uris = [ - "http://ha-london:8123/auth/oidc/callback", - "http://ha-london.tail2fe2d.ts.net:8123/auth/oidc/callback", - ] - meta_launch_url = "http://ha-london:8123/auth/oidc/welcome" - client_type = "confidential" - include_claims_in_id_token = true - access_code_validity = "minutes=1" - access_token_validity = "minutes=5" - refresh_token_validity = "days=30" - scope_mappings = ["openid", "profile", "email"] - access_groups = ["admins"] - create_group = true - signing_key = "1b1b5bec-034a-4d96-871a-133f11322360" - } - - "openwebui" = { - name = "OpenWeb UI" - slug = "openwebui" - group = "Tools" - meta_description = "OpenWeb UI" - meta_icon = "https://ollama.com/public/ollama.png" - redirect_uris = [ - "https://ai.hexor.cy/oauth/oidc/callback", - ] - meta_launch_url = "https://ai.hexor.cy" - client_type = "confidential" - include_claims_in_id_token = true - access_code_validity = "minutes=1" - access_token_validity = "minutes=5" - refresh_token_validity = "days=30" - scope_mappings = ["openid", "profile", "email"] - access_groups = ["admins"] - create_group = true - signing_key = "1b1b5bec-034a-4d96-871a-133f11322360" - } - "matrix" = { - name = "Matrix Chat" - slug = "matrix" - group = "Tools" - meta_description = "Matrix Chat" - meta_icon = "https://img.icons8.com/ios/100/40C057/matrix-logo.png" - redirect_uris = [ - "https://auth.matrix.hexor.cy/upstream/callback/001KKV4EKY7KG98W2M9T806K6A", - ] - meta_launch_url = "https://chat.matrix.hexor.cy" - client_type = "confidential" - include_claims_in_id_token = true - access_code_validity = "minutes=1" - access_token_validity = "minutes=5" - refresh_token_validity = "days=30" - scope_mappings = ["openid", "profile", "email"] - access_groups = [] - create_group = false - signing_key = "1b1b5bec-034a-4d96-871a-133f11322360" - } - "furumi-ng-web" = { - name = "Furumi Web Player" - slug = "furumi-ng-web" - group = "Tools" - meta_description = "Furumi Web Player" - meta_icon = "https://img.icons8.com/pulsar-color/48/music.png" - redirect_uris = [ - "https://music.hexor.cy/auth/callback", - ] - meta_launch_url = "https://music.hexor.cy" - client_type = "confidential" - include_claims_in_id_token = true - access_code_validity = "minutes=1" - access_token_validity = "minutes=5" - refresh_token_validity = "days=30" - scope_mappings = ["openid", "profile", "email"] - access_groups = [] - create_group = true - signing_key = "1b1b5bec-034a-4d96-871a-133f11322360" - } -} - diff --git a/terraform/authentik/outputs.tf b/terraform/authentik/outputs.tf deleted file mode 100644 index 868a740..0000000 --- a/terraform/authentik/outputs.tf +++ /dev/null @@ -1,124 +0,0 @@ -output "oauth_applications" { - description = "OAuth2/OpenID applications details" - value = { - for k, v in module.oauth_applications : k => { - application_id = v.application_id - application_uuid = v.application_uuid - client_id = v.client_id - client_secret = v.client_secret - slug = v.application_slug - } - } - sensitive = true -} - -output "proxy_applications" { - description = "Proxy applications details" - value = { - for k, v in module.proxy_applications : k => { - application_id = v.application_id - application_uuid = v.application_uuid - external_host = v.external_host - internal_host = v.internal_host - slug = v.application_slug - } - } -} - -output "outposts" { - description = "Outposts details" - value = { - for k, v in authentik_outpost.outposts : k => { - id = v.id - name = v.name - type = v.type - } - } -} - -output "groups" { - description = "Groups details" - value = merge( - { - for k, v in authentik_group.root_groups : k => { - id = v.id - name = v.name - } - }, - { - for k, v in authentik_group.child_groups : k => { - id = v.id - name = v.name - } - }, - { - for k, v in authentik_group.proxy_app_groups : k => { - id = v.id - name = v.name - auto_created = true - type = "proxy" - } - }, - { - for k, v in authentik_group.oauth_app_groups : k => { - id = v.id - name = v.name - auto_created = true - type = "oauth" - } - } - ) -} - -output "flows" { - description = "Custom flows details" - value = { - for k, v in authentik_flow.flows : k => { - id = v.id - slug = v.slug - name = v.name - } - } -} - -output "certificates" { - description = "Certificates details" - value = { - for k, v in authentik_certificate_key_pair.certificates : k => { - id = v.id - name = v.name - fingerprint_sha256 = v.fingerprint_sha256 - fingerprint_sha1 = v.fingerprint_sha1 - } - } -} - -# Output for applications table generation -output "applications_for_wiki" { - description = "Applications data formatted for wiki table generation" - value = { - proxy_apps = { - for k, v in var.proxy_applications : k => { - name = v.name - type = "Proxy" - url = v.external_host - internal_url = v.internal_host - group = v.group - description = v.meta_description - icon = v.meta_icon - slug = v.slug - } - } - oauth_apps = { - for k, v in var.oauth_applications : k => { - name = v.name - type = "OAuth2/OpenID" - url = length(v.redirect_uris) > 0 ? "https://${split("/", replace(v.redirect_uris[0], "https://", ""))[0]}" : "" - group = v.group - description = v.meta_description - icon = v.meta_icon - slug = v.slug - } - } - } -} \ No newline at end of file diff --git a/terraform/authentik/providers.tf b/terraform/authentik/providers.tf deleted file mode 100644 index 3a494c8..0000000 --- a/terraform/authentik/providers.tf +++ /dev/null @@ -1,13 +0,0 @@ -terraform { - required_providers { - authentik = { - source = "goauthentik/authentik" - version = "2025.12.1" - } - } -} - -provider "authentik" { - url = var.authentik_url - token = var.authentik_token -} diff --git a/terraform/authentik/proxy-apps.auto.tfvars b/terraform/authentik/proxy-apps.auto.tfvars deleted file mode 100644 index aac1fb9..0000000 --- a/terraform/authentik/proxy-apps.auto.tfvars +++ /dev/null @@ -1,193 +0,0 @@ -proxy_applications = { - "k8s-dashboard" = { - name = "K8S dashboard" - slug = "k8s-dashboard-ns" - group = "Core" - external_host = "https://k8s.hexor.cy" - internal_host = "http://kubernetes-dashboard.kubernetes-dashboard.svc" - internal_host_ssl_validation = false - meta_description = "K8S dashboard chart" - mode = "proxy" - outpost = "kubernetes-outpost" - meta_icon = "https://img.icons8.com/color/48/kubernetes.png" - create_group = true - access_groups = ["admins"] - } - "filemanager" = { - name = "FM filemanager" - slug = "fm-filemanager" - group = "Core" - external_host = "https://fm.hexor.cy" - internal_host = "http://fb-filemanager-filebrowser.syncthing.svc" - internal_host_ssl_validation = false - meta_description = "K8S dashboard chart" - mode = "proxy" - outpost = "kubernetes-outpost" - meta_icon = "https://img.icons8.com/external-anggara-flat-anggara-putra/32/external-folder-basic-user-interface-anggara-flat-anggara-putra.png" - create_group = true - access_groups = ["admins"] - } - - "prometheus" = { - name = "Prometheus" - slug = "prometheus" - group = "Core" - external_host = "https://prom.hexor.cy" - internal_host = "http://prometheus-kube-prometheus-prometheus.prometheus.svc:9090" - meta_description = "" - meta_icon = "https://img.icons8.com/fluency/48/prometheus-app.png" - mode = "proxy" - outpost = "kubernetes-outpost" - internal_host_ssl_validation = false - create_group = true - access_groups = ["admins"] - } - - "mtproxy-links" = { - name = "mtproxy-links" - slug = "mtproxy-links" - group = "Core" - external_host = "https://proxy.hexor.cy" - internal_host = "http://secret-reader.mtproxy.svc:80" - internal_host_ssl_validation = false - meta_description = "" - skip_path_regex = <<-EOT -/webhook -EOT - meta_icon = "https://img.icons8.com/ios-filled/50/password.png" - mode = "proxy" - outpost = "kubernetes-outpost" - create_group = true - access_groups = ["admins"] - } - - # Tools applications - "qbittorrent" = { - name = "qBittorent" - slug = "qbittorent" - group = "Tools" - external_host = "https://qbt.hexor.cy" - internal_host = "http://qbittorrent.jellyfin.svc" - internal_host_ssl_validation = false - meta_description = "" - meta_icon = "https://img.icons8.com/nolan/64/qbittorrent--v2.png" - mode = "proxy" - outpost = "kubernetes-outpost" - create_group = true - access_groups = ["admins"] - } - - # Media and Storage applications - "kopia" = { - name = "Kopia" - slug = "kopia" - group = "Media and Storage" - external_host = "https://backup.hexor.cy" - internal_host = "http://100.72.135.2:51515" - internal_host_ssl_validation = false - meta_description = "" - meta_icon = "https://img.icons8.com/external-flaticons-lineal-color-flat-icons/64/external-backup-productivity-flaticons-lineal-color-flat-icons.png" - mode = "proxy" - outpost = "kubernetes-outpost" - create_group = true - access_groups = ["admins"] - } - - "syncthing-router" = { - name = "Syncthing" - slug = "syncthing" - group = "Media and Storage" - external_host = "https://ss.hexor.cy" - internal_host = "http://syncthing-router.syncthing.svc:80" - internal_host_ssl_validation = false - meta_description = "" - meta_icon = "https://img.icons8.com/?size=100&id=Id4NcEcXcYzF&format=png&color=000000" - mode = "proxy" - outpost = "kubernetes-outpost" - create_group = true - access_groups = ["admins"] - } - - "truenas" = { - name = "TrueNAS" - slug = "truenas-proxy" - group = "Media and Storage" - external_host = "https://nas.hexor.cy" - internal_host = "http://10.0.5.107:81" - internal_host_ssl_validation = false - meta_description = "" - meta_icon = "https://img.icons8.com/dusk/64/nas.png" - mode = "proxy" - outpost = "kubernetes-outpost" - create_group = true - access_groups = ["admins"] - } - - "khm" = { - name = "KHM" - slug = "khm" - group = "Media and Storage" - external_host = "https://khm.hexor.cy" - internal_host = "http://khm.khm.svc:8080" - internal_host_ssl_validation = false - meta_description = "" - meta_icon = "https://img.icons8.com/liquid-glass/48/key.png" - mode = "proxy" - outpost = "kubernetes-outpost" - access_groups = ["admins", "khm"] - create_group = true - access_groups = ["admins"] - } - - "minecraft" = { - name = "Minecraft" - slug = "minecraft" - group = "Media and Storage" - external_host = "https://minecraft.hexor.cy" - internal_host = "http://minecraft-dynmap.minecraft.svc" - internal_host_ssl_validation = false - meta_description = "" - meta_icon = "https://img.icons8.com/color/48/minecraft-grass-cube.png" - mode = "proxy" - outpost = "kubernetes-outpost" - skip_path_regex = <<-EOT -/clients -EOT - } - "pasarguard" = { - name = "PasarGuard" - slug = "pasarguard" - group = "Tools" - external_host = "https://ps.hexor.cy" - internal_host = "https://pasarguard.pasarguard.svc:80" - internal_host_ssl_validation = false - meta_description = "" - skip_path_regex = <<-EOT -/ -/sub/ -/dashboard/ -/api/ -EOT - meta_icon = "https://img.icons8.com/?size=100&id=fqAD3lAB6zTe&format=png&color=000000" - mode = "proxy" - outpost = "kubernetes-outpost" - create_group = true - access_groups = ["admins"] - } - "ollama-public" = { - name = "Ollama Public" - slug = "ollama-public" - group = "AI" - external_host = "https://ollama.hexor.cy" - internal_host = "http://ollama.ollama.svc:11434" - internal_host_ssl_validation = false - meta_description = "" - meta_icon = "https://img.icons8.com/external-icongeek26-outline-icongeek26/64/external-llama-animal-head-icongeek26-outline-icongeek26.png" - mode = "proxy" - outpost = "kubernetes-outpost" - intercept_header_auth = true - create_group = true - access_groups = ["admins"] - } -} - diff --git a/terraform/authentik/state.tf b/terraform/authentik/state.tf deleted file mode 100644 index 1ca6a5a..0000000 --- a/terraform/authentik/state.tf +++ /dev/null @@ -1,8 +0,0 @@ -terraform { - cloud { - organization = "ultradesu" - workspaces { - name = "Authentik" - } - } -} diff --git a/terraform/authentik/terraform.tfvars b/terraform/authentik/terraform.tfvars deleted file mode 100644 index dd3ae58..0000000 --- a/terraform/authentik/terraform.tfvars +++ /dev/null @@ -1,28 +0,0 @@ -authentik_url = "https://idm.hexor.cy" - - -flows = { -} - -tags = { - environment = "production" - managed_by = "terraform" - project = "homelab" -} - - - -outposts = { - "kubernetes-outpost" = { - name = "authentik Embedded Outpost" - type = "proxy" - service_connection = "k8s-cluster" - config = { - authentik_host = "https://idm.hexor.cy" - authentik_host_insecure = false - log_level = "info" - error_reporting = true - #container_image = null - } - } -} diff --git a/terraform/authentik/variables.tf b/terraform/authentik/variables.tf deleted file mode 100644 index ef52ecd..0000000 --- a/terraform/authentik/variables.tf +++ /dev/null @@ -1,174 +0,0 @@ -variable "oauth_applications" { - description = "Map of OAuth2/OpenID applications" - type = map(object({ - name = string - slug = string - group = optional(string, "") - policy_engine_mode = optional(string, "any") - meta_description = optional(string, "") - meta_launch_url = optional(string, "") - meta_icon = optional(string, "") - redirect_uris = list(string) - client_type = optional(string, "confidential") - client_id = optional(string, null) - include_claims_in_id_token = optional(bool, true) - access_code_validity = optional(string, "minutes=1") - access_token_validity = optional(string, "minutes=5") - refresh_token_validity = optional(string, "days=30") - property_mappings = optional(list(string), []) - authorization_flow = optional(string, null) - signing_key = optional(string, null) - outpost = optional(string, null) - create_group = optional(bool, false) - access_groups = optional(list(string), []) - scope_mappings = optional(list(string), ["openid", "profile", "email"]) - })) - default = {} -} - -variable "proxy_applications" { - description = "Map of Proxy applications" - type = map(object({ - name = string - slug = string - group = optional(string, "") - policy_engine_mode = optional(string, "any") - meta_description = optional(string, "") - meta_launch_url = optional(string, "") - meta_icon = optional(string, "") - external_host = string - internal_host = optional(string, "") - internal_host_ssl_validation = optional(bool, true) - mode = optional(string, "proxy") - intercept_header_auth = optional(bool, false) - basic_auth_enabled = optional(bool, false) - basic_auth_username_attribute = optional(string, "") - basic_auth_password_attribute = optional(string, "") - cookie_domain = optional(string, "") - authorization_flow = optional(string, null) - skip_path_regex = optional(string, "") - outpost = optional(string, null) - create_group = optional(bool, false) - access_groups = optional(list(string), []) - })) - default = {} -} - -variable "saml_applications" { - description = "Map of SAML applications" - type = map(object({ - name = string - slug = string - group = optional(string, "") - policy_engine_mode = optional(string, "any") - meta_description = optional(string, "") - meta_launch_url = optional(string, "") - meta_icon = optional(string, "") - acs_url = string - issuer = string - audience = string - sp_binding = optional(string, "post") - signing_key = optional(string, null) - property_mappings = optional(list(string), []) - name_id_mapping = optional(string, null) - assertion_valid_not_before = optional(string, "minutes=-5") - assertion_valid_not_on_or_after = optional(string, "minutes=5") - session_valid_not_on_or_after = optional(string, "minutes=86400") - authorization_flow = optional(string, null) - })) - default = {} -} - -variable "outposts" { - description = "Map of Outposts (only proxy type supported)" - type = map(object({ - name = string - config = optional(map(any), {}) - })) - default = {} -} - -variable "flows" { - description = "Map of authentication flows" - type = map(object({ - name = string - title = string - slug = string - designation = string - policy_engine_mode = optional(string, "any") - compatibility_mode = optional(bool, false) - layout = optional(string, "stacked") - denied_action = optional(string, "message_continue") - })) - default = {} -} - -variable "groups" { - description = "Map of user groups" - type = map(object({ - name = string - is_superuser = optional(bool, false) - parent = optional(string, null) - attributes = optional(map(any), {}) - })) - default = {} -} - -variable "certificates" { - description = "Map of certificates for HTTPS" - type = map(object({ - name = string - certificate_data = string - key_data = string - managed = optional(string, null) - })) - default = {} -} - -variable "property_mappings" { - description = "Custom property mappings for SAML/OAuth" - type = map(object({ - name = string - expression = string - saml_name = optional(string, null) - oidc_scope = optional(string, null) - })) - default = {} -} - - -variable "default_authorization_flow" { - description = "Default authorization flow slug" - type = string - default = "default-provider-authorization-implicit-consent" -} - -variable "default_authentication_flow" { - description = "Default authentication flow slug" - type = string - default = "default-authentication-flow" -} - -variable "default_invalidation_flow" { - description = "Default invalidation flow slug" - type = string - default = "default-provider-invalidation-flow" -} - -variable "tags" { - description = "Tags to apply to all resources" - type = map(string) - default = {} -} - -variable "authentik_url" { - description = "Authentik URL" - type = string - default = "https://idm.hexor.cy" -} - -variable "authentik_token" { - description = "Authentik API token (set via TF_VAR_authentik_token env var)" - type = string - sensitive = true -}