feat(authentik): pin known tokens on proxy outposts too

Generalize the outpost token-pinning path beyond the LDAP outpost so any
proxy outpost declaring a token authenticates against the authentik
server with the vault token instead of the blueprint's auto-generated
one. Drive both from a single rendered script over a target list.

Also raise the server healthcheck start_period to 120s: cold first boot
runs DB migrations plus app init (~90s observed), which tripped
compose --wait as unhealthy at the old 30s.

Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>

roles/authentik/tasks/main.yml

@@ -49,22 +49,32 @@
   until: blueprint_wait_result.rc == 0
   when: blueprints_changed
 
-- name: Render LDAP outpost token script
+# Pin known tokens on the LDAP outpost and on any proxy outpost that
+# declares one, so co-located outposts (e.g. a proxy outpost on another
+# host) can authenticate against the authentik server with the token from
+# the vault instead of the auto-generated one the blueprint creates.
+- name: Set fact whether any outpost needs a pinned token
+  ansible.builtin.set_fact:
+    _authentik_outpost_tokens: >-
+      {{ (authentik_ldap_outpost.name is defined)
+         or (authentik_proxy_outposts | default([]) | selectattr('token', 'defined') | list | length > 0) }}
+
+- name: Render outpost token script
   template:
     src: set-outpost-token.py.j2
     dest: "{{ authentik_docker_volume_dir }}/data/set-outpost-token.py"
     mode: '0644'
-  when: authentik_ldap_outpost.name is defined
-  register: ldap_token_script
+  when: _authentik_outpost_tokens | bool
+  register: outpost_token_script
 
-- name: Set known token for LDAP outpost
+- name: Set known tokens for outposts
   community.docker.docker_compose_v2_exec:
     project_src: "{{ authentik_docker_compose_dir }}"
     service: server
     command: ak shell -c "exec(open('/data/set-outpost-token.py').read())"
-  register: ldap_token_result
-  changed_when: "'changed' in ldap_token_result.stdout"
+  register: outpost_token_result
+  changed_when: "'changed' in outpost_token_result.stdout"
   retries: 30
   delay: 10
-  until: ldap_token_result.rc == 0
-  when: authentik_ldap_outpost.name is defined and (blueprints_changed or ldap_token_script.changed)
+  until: outpost_token_result.rc == 0
+  when: (_authentik_outpost_tokens | bool) and (blueprints_changed or outpost_token_script.changed)