eblume/blumeops
1
1
Fork 0
Code Issues Pull requests 1 Projects Releases 83 Packages Wiki Activity Actions
blumeops/docs/reference/services/authentik.md
Erich Blume 2a2ba0bcb7 Doc review: 5 stalest cards; scale back ai-docs rule; document heph CLI 
Reviewed (verified against live state) and stamped last-reviewed on:
- reference/services/argocd.md: SSO via Authentik (public PKCE client),
  dual-cluster management (minikube + ringtail k3s), corrected sync
  policy (everything is manual sync, including the apps root)
- reference/services/authentik.md: blueprint list grown to 8 OIDC
  clients, postgresql-* secret fields, client-type table
- reference/services/grafana.md: TeslaMate datasource now
  pg.ops.eblu.me:5434 (ringtail), dashboard inventory refreshed,
  TeslaMate dashboards via pinned-tag init container
- reference/infrastructure/unifi.md: UnPoller now a locally-built image
- how-to/mealie/plan-a-meal.md: procedure verified; stored API token
  currently returns 401 (operational fix tracked separately)

AGENTS.md: replace the mandatory full ai-docs read with a find-relevant-
docs-first rule (bulk ai-docs/ai-sources now opt-in), and document the
heph CLI surface for reading and manipulating Blumeops tasks.
agent-change-process.md updated to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-09 15:57:45 -07:00

3.6 KiB
Raw Blame History

title modified last-reviewed tags
Authentik 2026-06-09 2026-06-09
service
security
oidc

Authentik

OIDC identity provider for BlumeOps. Authentik is the source of truth for user identity — users are created and managed in Authentik, and services authenticate against it via OIDC.

Quick Reference

Property Value
URL https://authentik.ops.eblu.me
Admin UI https://authentik.ops.eblu.me/if/admin/
Tailscale URL https://authentik.tail8d86e.ts.net
Namespace authentik
Cluster k3s (ringtail)
Manifests argocd/manifests/authentik/
Container build containers/authentik/default.nix

Architecture

Authentik runs on ringtail's k3s cluster, isolated from the main services on indri's minikube. This means the IdP is independent of the minikube cluster lifecycle.

Three deployments:

  • server — HTTP/HTTPS interface, handles OIDC flows
  • worker — Background tasks, blueprint application
  • redis — Caching, sessions, task queue

Database

Uses the shared CNPG blumeops-pg cluster on indri, accessed cross-cluster via pg.ops.eblu.me:5432. Database authentik with managed role.

Blueprints

Authentik configuration is managed via Blueprints (YAML) stored as a ConfigMap mounted into the worker at /blueprints/custom/. Current blueprints:

  • common.yaml — shared identity resources (admins group)
  • mfa.yaml — MFA enforcement on the default authentication flow (not_configured_action: configure)
  • One blueprint per OIDC client (provider, application, and policy binding): grafana.yaml, forgejo.yaml, zot.yaml, argocd.yaml, jellyfin.yaml, mealie.yaml, paperless.yaml, heph.yaml

Group membership is included in the profile scope claim (Authentik built-in). Services use --group-claim-name groups to read it.

Blueprint file: argocd/manifests/authentik/configmap-blueprint.yaml

OIDC Clients

Client Type
grafana Confidential
forgejo Confidential
zot Confidential
argocd Public (PKCE, shared by web UI and CLI)
jellyfin Confidential
mealie Confidential
paperless Confidential
heph Public (PKCE, with offline_access for spoke sync refresh tokens)

Future clients: miniflux

Secrets

Injected via external-secrets from the "Authentik (blumeops)" 1Password item (see create-authentik-secrets for setup).

1Password Field Purpose
secret-key Authentik secret key
postgresql-host / -port / -name / -user / -password PostgreSQL connection
<client>-client-secret OIDC client secret, one per confidential client (grafana, forgejo, zot, jellyfin, mealie, paperless)

The item also holds an api-token field (Authentik API access for admin scripting); it is not synced into the cluster.

Container Image

Nix-built via dockerTools.buildLayeredImage. The entrypoint wrapper symlinks built-in blueprint directories from the Nix store into /blueprints/ at runtime, allowing custom blueprints to coexist with defaults. AUTHENTIK_BLUEPRINTS_DIR=/blueprints overrides the hardcoded Nix store path.

Related