Update k8s/core/authentik/values.yaml

k8s/apps/furumi-server/deployment.yaml

@@ -22,7 +22,10 @@ spec:
           imagePullPolicy: Always
           env:
             - name: FURUMI_TOKEN
-              value: "f38387266e75effe891b7953eb9c06b4"
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-token
+                  key: TOKEN
             - name: FURUMI_ROOT
               value: "/media"
           ports:

k8s/apps/furumi-server/external-secrets.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: furumi-ng-token
+spec:
+  target:
+    name: furumi-ng-token
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        TOKEN: |-
+          {{ .token }}
+  data:
+    - secretKey: token
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
+        property: fields[0].value

k8s/apps/furumi-server/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - deployment.yaml
   - service.yaml
   - servicemonitor.yaml
+  - external-secrets.yaml

k8s/apps/matrix/external-secrets.yaml

@@ -52,16 +52,17 @@ spec:
         mas-oidc.yaml: |
           upstream_oauth2:
             providers:
-              - id: authentik
+              - id: 001KKV4EKY7KG98W2M9T806K6A
                 human_name: Authentik
                 issuer: https://idm.hexor.cy/application/o/matrix/
-                client_id: {{ .oauth_client_id }}
-                client_secret: {{ .oauth_client_secret }}
+                client_id: "{{ .oauth_client_id }}"
+                client_secret: "{{ .oauth_client_secret }}"
+                token_endpoint_auth_method: client_secret_post
                 scope: "openid profile email"
                 claims_imports:
                   localpart:
-                    action: require
-                    template: "{{ `{{ user.preferred_username }}` }}"
+                    action: suggest
+                    template: "{{ `{{ user.preferred_username | split(\"@\") | first }}` }}"
                   displayname:
                     action: suggest
                     template: "{{ `{{ user.name }}` }}"

k8s/apps/matrix/matrix-stack-values.yaml

@@ -24,6 +24,8 @@ hookshot:
 ## Synapse homeserver
 synapse:
   enabled: true
+  ingress:
+    host: synapse.matrix.hexor.cy
   postgres:
     host: psql.psql.svc
     port: 5432
@@ -43,6 +45,8 @@ synapse:
 ## Matrix Authentication Service
 matrixAuthenticationService:
   enabled: true
+  ingress:
+    host: auth.matrix.hexor.cy
   postgres:
     host: psql.psql.svc
     port: 5432
@@ -52,9 +56,15 @@ matrixAuthenticationService:
     password:
       secret: matrix-postgres-creds
       secretKey: mas_db_password
-  ## Authentik OIDC upstream provider
+  ## Admin policy
   additional:
-    0-oidc:
+    0-admin-policy:
+      config: |
+        policy:
+          data:
+            admin_users:
+              - username: ultradesu
+    1-oidc:
       configSecret: matrix-oidc-config
       configSecretKey: mas-oidc.yaml
   # nodeSelector:
@@ -64,7 +74,7 @@ matrixAuthenticationService:
 elementWeb:
   enabled: true
   ingress:
-    host: chat.hexor.cy
+    host: chat.matrix.hexor.cy
   # nodeSelector:
   #   kubernetes.io/hostname: nas.homenet
 
@@ -72,7 +82,7 @@ elementWeb:
 elementAdmin:
   enabled: true
   ingress:
-    host: matrix-admin.hexor.cy
+    host: admin.matrix.hexor.cy
   # nodeSelector:
   #   kubernetes.io/hostname: nas.homenet
 

k8s/core/authentik/values.yaml

@@ -54,19 +54,6 @@ server:
         traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
       hosts:
         - idm.hexor.cy
-        - nas.hexor.cy       # TrueNAS Limassol
-        - nc.hexor.cy        # NaxtCloud
-        - of.hexor.cy        # Outfleet-v2
-        - k8s.hexor.cy       # k8s dashboard
-        - qbt.hexor.cy       # qBittorent for Jellyfin
-        - prom.hexor.cy      # Prometheus
-        - khm.hexor.cy       # Known Hosts keys Manager
-        - backup.hexor.cy    # Kopia Backup UI
-        - fm.hexor.cy        # Filemanager
-        - minecraft.hexor.cy # Minecraft UI and server
-        - pass.hexor.cy      # k8s-secret for openai
-        - ps.hexor.cy        # pasarguard UI
-#       - rw.hexor.cy        # RemnaWave UI
       tls:
         - secretName: idm-tls
           hosts:

k8s/core/cert-manager/issuer.yaml

@@ -37,4 +37,5 @@ spec:
           dnsZones:
             - "ps.hexor.cy"
             - "of.hexor.cy"
+            - "matrix.hexor.cy"
 

terraform/authentik/oauth2-apps.auto.tfvars

@@ -195,9 +195,9 @@ oauth_applications = {
     meta_description = "Matrix Chat"
     meta_icon        = "https://img.icons8.com/ios/100/40C057/matrix-logo.png"
     redirect_uris = [
-      "https://matrix.hexor.cy/_matrix/client/unstable/org.matrix.msc2965/auth/upstream/callback",
+      "https://auth.matrix.hexor.cy/upstream/callback/001KKV4EKY7KG98W2M9T806K6A",
     ]
-    meta_launch_url            = "https://matrix.hexor.cy"
+    meta_launch_url            = "https://chat.matrix.hexor.cy"
     client_type                = "confidential"
     include_claims_in_id_token = true
     access_code_validity       = "minutes=1"
@@ -205,7 +205,7 @@ oauth_applications = {
     refresh_token_validity     = "days=30"
     scope_mappings             = ["openid", "profile", "email"]
     access_groups              = []
-    create_group               = true
+    create_group               = false
     signing_key                = "1b1b5bec-034a-4d96-871a-133f11322360"
   }
 }