Erich Blume 71cb256527 Deploy Authentik identity provider (C2 Mikado) (#227 )

## Summary
C2 Mikado chain for deploying Authentik as the SSO identity provider, replacing Dex.

This PR will evolve over multiple sessions. Each iteration adds documentation (prerequisite cards) and eventually code as leaf nodes are resolved.

## Current Mikado State
- **Goal:** `deploy-authentik` (active)
- **Leaf prerequisites:**
  - `build-authentik-container` — Build Nix container image
  - `provision-authentik-database` — Create PostgreSQL database on CNPG cluster
  - `create-authentik-secrets` — Create 1Password item with credentials

## Process refinements
- Updated agent-change-process with lessons from first attempt: reset code before committing cards, open PRs early

## Test plan
- [ ] `mise run docs-mikado` shows correct dependency chain
- [ ] Leaf nodes can be worked independently
- [ ] Container builds on ringtail
- [ ] Authentik starts and reaches healthy state
- [ ] Forgejo OAuth2 connector works

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/227

2026-02-20 12:55:59 -08:00

723 B

Raw Blame History

title

modified

Completed Plans

Plans that have been fully implemented and verified. Kept for historical reference and as templates for future plans.

Plan	Completed	Description
adopt-dagger-ci	2026-02-11	Adopt Dagger as CI/CD build engine (Phases 1–3)
segment-home-network	2026-02-14	Manual three-network segmentation for UniFi Express 7
operationalize-reolink-camera	2026-02-15	Deploy Frigate NVR stack with Mosquitto, Ntfy, and frigate-notify
adopt-oidc-provider	2026-02-19	Deploy OIDC identity provider with Grafana SSO (initially Dex, replaced by Authentik)

723 B Raw Blame History Unescape Escape

Completed Plans

723 B

Raw Blame History