feat: add ability to provision using blueprints

roles/authentik/templates/blueprints/blueprint-oidc-app.yaml.j2

@@ -0,0 +1,43 @@
+# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
+version: 1
+metadata:
+  name: "oidc-{{ item.slug }}"
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+    blueprints.goauthentik.io/description: "OIDC provider + application for {{ item.slug }}"
+
+entries:
+  - model: authentik_providers_oauth2.oauth2provider
+    id: oidc-provider-{{ item.slug }}
+    identifiers:
+      name: {{ item.slug }}
+    attrs:
+      name: {{ item.slug }}
+      client_type: confidential
+      client_id: !Env {{ item.client_id_env }}
+      client_secret: !Env {{ item.client_secret_env }}
+
+      redirect_uris:
+{% for ru in item.redirect_uris %}
+        - url: "{{ ru.url }}"
+          matching_mode: {{ ru.matching_mode | default('strict') }}
+{% endfor %}
+
+      authorization_flow: !Find [authentik_flows.flow, [slug, {{ item.flows.authorization_slug | default('default-provider-authorization-implicit-consent') }}]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, {{ item.flows.invalidation_slug | default('default-provider-invalidation-flow') }}]]
+
+      property_mappings:
+{% for s in (item.scopes | default(['openid','email','profile','offline_access'])) %}
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, {{ s }}]]
+{% endfor %}
+
+      signing_key: !Find [authentik_crypto.certificatekeypair, [name, {{ item.signing_key_name | default('authentik Self-signed Certificate') }}]]
+
+  - model: authentik_core.application
+    id: app-{{ item.slug }}
+    identifiers:
+      slug: {{ item.slug }}
+    attrs:
+      name: "{{ item.name | default(item.slug) }}"
+      slug: {{ item.slug }}
+      provider: !KeyOf oidc-provider-{{ item.slug }}

roles/authentik/templates/docker-compose.yml.j2

@@ -29,7 +29,13 @@ services:
       AUTHENTIK_POSTGRESQL__PASSWORD: {{ authentik_postgres_password }}
       AUTHENTIK_LOG_LEVEL: {{ authentik_log_level }}
       AUTHENTIK_ERROR_REPORTING__ENABLED: "{{ authentik_error_reporting_enabled | lower }}"
+{% if authentik_blueprint_env|length > 0 %}
+{%  for k, v in authentik_blueprint_env.items() %}
+      {{ k }}: "{{ v }}"
+{% endfor %}
+{% endif %}
     volumes:
+      - {{ authentik_docker_volume_dir }}/blueprints:/blueprints
       - {{ authentik_docker_volume_dir }}/data:/data
       - {{ authentik_docker_volume_dir }}/templates:/templates
     depends_on:
@@ -63,10 +69,16 @@ services:
       AUTHENTIK_POSTGRESQL__PASSWORD: {{ authentik_postgres_password }}
       AUTHENTIK_LOG_LEVEL: {{ authentik_log_level }}
       AUTHENTIK_ERROR_REPORTING__ENABLED: "{{ authentik_error_reporting_enabled | lower }}"
+{% if authentik_blueprint_env|length > 0 %}
+{%  for k, v in authentik_blueprint_env.items() %}
+      {{ k }}: "{{ v }}"
+{% endfor %}
+{% endif %}
     volumes:
       - {{ authentik_docker_volume_dir }}/data:/data
       - {{ authentik_docker_volume_dir }}/certs:/certs
       - {{ authentik_docker_volume_dir }}/templates:/templates
+      - {{ authentik_docker_volume_dir }}/blueprints:/blueprints
     depends_on:
       postgres:
         condition: service_healthy