eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions
blumeops/docs/reference/services/authentik.md
Erich Blume 251873906a Disable SPA mode, remove index files, relax wiki-link constraints 
Fix the Facebook crawler spider trap by disabling Quartz SPA mode and
removing the nginx fallback to index.html. Non-existent URLs now return
404.html instead of the root SPA shell, preventing infinite recursive
crawling.

Remove hand-curated category index files (tutorials.md, reference.md,
how-to.md, explanation.md) — Quartz auto-generates folder pages. Drop
docs-check-index and docs-check-filenames hooks. Update docs-check-links
to allow path-based wiki-links and only error on true ambiguity. Remove
robots.txt exclusions since they're no longer needed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-09 11:57:35 -07:00

3.2 KiB
Raw Blame History

title modified tags
Authentik 2026-02-20
service
security
oidc

Authentik

OIDC identity provider for BlumeOps. Authentik is the source of truth for user identity — users are created and managed in Authentik, and services authenticate against it via OIDC.

Quick Reference

Property Value
URL https://authentik.ops.eblu.me
Admin UI https://authentik.ops.eblu.me/if/admin/
Tailscale URL https://authentik.tail8d86e.ts.net
Namespace authentik
Cluster k3s (ringtail)
Manifests argocd/manifests/authentik/
Container build containers/authentik/default.nix

Architecture

Authentik runs on ringtail's k3s cluster, isolated from the main services on indri's minikube. This means the IdP is independent of the minikube cluster lifecycle.

Three deployments:

  • server — HTTP/HTTPS interface, handles OIDC flows
  • worker — Background tasks, blueprint application
  • redis — Caching, sessions, task queue

Database

Uses the shared CNPG blumeops-pg cluster on indri, accessed cross-cluster via pg.ops.eblu.me:5432. Database authentik with managed role.

Blueprints

Authentik configuration is managed via Blueprints (YAML) stored as a ConfigMap mounted into the worker at /blueprints/custom/. Current blueprints:

  • common.yaml — shared identity resources (admins group)
  • mfa.yaml — MFA enforcement on the default authentication flow (not_configured_action: configure)
  • grafana.yaml — Grafana OAuth2 provider, application, and policy binding
  • forgejo.yaml — Forgejo OAuth2 provider, application, and policy binding

Group membership is included in the profile scope claim (Authentik built-in). Services use --group-claim-name groups to read it.

Blueprint file: argocd/manifests/authentik/configmap-blueprint.yaml

OIDC Clients

Client Status
grafana Active
forgejo Active

Future clients: argocd, miniflux, zot

Secrets

Injected via external-secrets from the "Authentik (blumeops)" 1Password item (see create-authentik-secrets for setup).

1Password Field Purpose
secret-key Authentik secret key
db-password PostgreSQL password
grafana-client-secret OIDC client secret for Grafana
forgejo-client-secret OIDC client secret for Forgejo
api-token Authentik API token

Container Image

Nix-built via dockerTools.buildLayeredImage. The entrypoint wrapper symlinks built-in blueprint directories from the Nix store into /blueprints/ at runtime, allowing custom blueprints to coexist with defaults. AUTHENTIK_BLUEPRINTS_DIR=/blueprints overrides the hardcoded Nix store path.

Related