Erich Blume
2865bf5c27
## Summary - Rewrites deploy-authentik from a historical changelog into a reproducible process guide - Removes stale version info (`v1.1.2-nix`) and future work section (Forgejo federation is done, rest belongs elsewhere) - Marks deploy-authentik as completed in plans index and completed archive - Removes hardcoded image tag from authentik reference card (use `service-versions.yaml`) - Adds `last-reviewed: 2026-02-23` frontmatter ## Test plan - [x] All pre-commit hooks pass (docs-check-links, docs-check-index, etc.) - [x] ArgoCD app verified synced and healthy - [x] All wiki-links validated Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/257
2.5 KiB
2.5 KiB
| title | modified | last-reviewed | requires | tags | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Deploy Authentik Identity Provider | 2026-02-23 | 2026-02-23 |
|
|
Deploy Authentik Identity Provider
Replace Dex with Authentik as the SSO identity provider. Authentik is the source of truth for user identity in BlumeOps. Users are created and managed in Authentik; services authenticate against it via OIDC.
Architecture Decisions
| Decision | Choice | Rationale |
|---|---|---|
| Identity model | Authentik is source of truth | Central user/group management, not Forgejo-upstream like Dex |
| Cluster | ringtail (k3s) | IdP independent of main services cluster, same as Dex |
| Database | CNPG blumeops-pg on indri |
Cross-cluster via Caddy L4 (pg.ops.eblu.me), no new operator needed |
| Redis | Co-deployed in authentik namespace | Required for caching/sessions/task queue |
| Containers | Nix-built (dockerTools.buildLayeredImage) |
Supply chain control, consistent with Dex/ntfy pattern |
| Manifests | Kustomize (no Helm) | Consistent with all other BlumeOps services |
| Networking | Tailscale Ingress + Caddy reverse proxy | Same pattern as Dex |
| IaC | Authentik Blueprints (YAML in ConfigMap) | GitOps-native, config stored in repo |
Deployment Process
- Build a Nix container image — Authentik needs
coreutilsandbashInteractivealongside the main package; the entrypoint wrapper must symlink built-in blueprint directories so custom blueprints coexist with defaults - Create secrets in 1Password (secret key, DB credentials, OIDC client secrets)
- Provision a dedicated database and managed role on the shared CNPG cluster
- Deploy server, worker, and Redis as separate deployments
- Wire ExternalSecret to pull config from 1Password
- Add Tailscale Ingress and Caddy reverse proxy entries
- Complete the first-run wizard manually (creates admin account)
- Migrate OIDC clients via Blueprints, then decommission the old IdP
URLs
- Admin: https://authentik.ops.eblu.me/if/admin/
- Tailscale: https://authentik.tail8d86e.ts.net
Related
- authentik — OIDC identity provider
- federated-login — How authentication works across BlumeOps
- adopt-oidc-provider — Dex deployment plan (completed)
- ringtail — Target cluster
- agent-change-process — C2 methodology used for this change