eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions
blumeops/docs/reference/services/authentik.md
Erich Blume 7ac7c6a3e5 Decommission Dex: remove all references, replace with Authentik 
- Delete dex manifests, ArgoCD app, container build, and reference doc
- Remove dex from Caddy reverse proxy config
- Create authentik.md reference doc
- Rewrite federated-login.md for Authentik architecture
- Update grafana, forgejo, ringtail, harden-zot-registry docs
- Update services-check: replace dex health/pod checks with authentik
- Fix all broken [[dex]] wiki-links

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20 12:51:09 -08:00

2.6 KiB
Raw Blame History

title modified tags
Authentik 2026-02-20
service
security
oidc

Authentik

OIDC identity provider for BlumeOps. Authentik is the source of truth for user identity — users are created and managed in Authentik, and services authenticate against it via OIDC.

Quick Reference

Property Value
URL https://authentik.ops.eblu.me
Admin UI https://authentik.ops.eblu.me/if/admin/
Tailscale URL https://authentik.tail8d86e.ts.net
Namespace authentik
Cluster k3s (ringtail)
Image registry.ops.eblu.me/blumeops/authentik:v1.1.2-nix
Manifests argocd/manifests/authentik/
Container build containers/authentik/default.nix

Architecture

Authentik runs on ringtail's k3s cluster, isolated from the main services on indri's minikube. This means the IdP is independent of the minikube cluster lifecycle.

Three deployments:

  • server — HTTP/HTTPS interface, handles OIDC flows
  • worker — Background tasks, blueprint application
  • redis — Caching, sessions, task queue

Database

Uses the shared CNPG blumeops-pg cluster on indri, accessed cross-cluster via pg.ops.eblu.me:5432. Database authentik with managed role.

Blueprints

Authentik configuration is managed via Blueprints (YAML) stored as a ConfigMap mounted into the worker at /blueprints/custom/. Current blueprints define:

  • admins group
  • Grafana OAuth2 provider (client ID: grafana)
  • Grafana application with group-based policy binding

Blueprint file: argocd/manifests/authentik/configmap-blueprint.yaml

OIDC Clients

Client Status
grafana Active

Future clients: forgejo, argocd, miniflux, zot

Secrets

Injected via external-secrets from the "Authentik (blumeops)" 1Password item.

1Password Field Purpose
secret-key Authentik secret key
db-password PostgreSQL password
grafana-client-secret OIDC client secret for Grafana
api-token Authentik API token

Container Image

Nix-built via dockerTools.buildLayeredImage. The entrypoint wrapper symlinks built-in blueprint directories from the Nix store into /blueprints/ at runtime, allowing custom blueprints to coexist with defaults. AUTHENTIK_BLUEPRINTS_DIR=/blueprints overrides the hardcoded Nix store path.

Related