Digitalboard/digitalboard.core
6
2
Fork 0
Code Pull requests 3 Releases Packages Activity Actions

feat(authentik): pin proxy outpost tokens; drop obsolete nextcloud patch #11

Open
Simon wants to merge 3 commits from feat/authentik-proxy-outpost-tokens into main
pull from: feat/authentik-proxy-outpost-tokens
merge into: Digitalboard:main
Conversation 0 Commits 3 Files changed 17 +240 -79
Simon commented 2026-07-02 15:13:10 +00:00
Owner
Copy link

Summary

  • Generalize authentik outpost token-pinning beyond the LDAP outpost: any proxy outpost declaring a token now authenticates against the authentik server with the vault token instead of the blueprint's auto-generated one. Both are driven from a single rendered script over a target list.
  • Raise the authentik server healthcheck start_period to 120s — cold first boot runs DB migrations + app init (~90s observed) and tripped compose --wait as unhealthy at the old 30s.
  • Remove the obsolete nextcloud/server#59629 UserConfig::getValueBool TypeError workaround (patch task, container discovery, drift guard, README note). Fixed upstream in 33.0.4.

Commits

  • feat(authentik): pin known tokens on proxy outposts too
  • fix(nextcloud): drop obsolete UserConfig::getValueBool patch

Testing

  • Not deployed yet — review only.
## Summary - Generalize authentik outpost token-pinning beyond the LDAP outpost: any proxy outpost declaring a `token` now authenticates against the authentik server with the vault token instead of the blueprint's auto-generated one. Both are driven from a single rendered script over a target list. - Raise the authentik server healthcheck `start_period` to 120s — cold first boot runs DB migrations + app init (~90s observed) and tripped `compose --wait` as unhealthy at the old 30s. - Remove the obsolete nextcloud/server#59629 `UserConfig::getValueBool` TypeError workaround (patch task, container discovery, drift guard, README note). Fixed upstream in 33.0.4. ## Commits - feat(authentik): pin known tokens on proxy outposts too - fix(nextcloud): drop obsolete UserConfig::getValueBool patch ## Testing - Not deployed yet — review only.
Simon added 3 commits 2026-07-02 15:13:11 +00:00 
Two related additions for gating a cross-host service (garage WebUI on a
storage host) behind authentik without breaking on TLS or X-Forwarded-Host:

garage role:
- Add garage_webui_domains (list), mirroring garage_s3_domains. The
  console router now accepts every entry, so a DMZ reverseproxy can use a
  backend_host whose cert SAN matches an internal *.int.* name instead of
  connecting by IP (which fails acme cert verification). Defaults to the
  single garage_webui_domain so existing inventories are unaffected.

authentik_outpost_proxy role (new):
- Standalone proxy (ForwardAuth) outpost, modelled on authentik_outpost_ldap.
  Co-locate it with the protected service so the ForwardAuth subrequest
  reaches authentik over the local docker network. The embedded outpost
  only works for services on the authentik host: a cross-host subrequest
  routed through an extra reverse-proxy hop arrives with a polluted
  X-Forwarded-Host (port/comma-appended), which the outpost no longer
  matches against the provider's external_host (404).
Generalize the outpost token-pinning path beyond the LDAP outpost so any
proxy outpost declaring a token authenticates against the authentik
server with the vault token instead of the blueprint's auto-generated
one. Drive both from a single rendered script over a target list.

Also raise the server healthcheck start_period to 120s: cold first boot
runs DB migrations plus app init (~90s observed), which tripped
compose --wait as unhealthy at the old 30s.

Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
The nextcloud/server#59629 TypeError workaround (PR #59646) is no longer
needed once nextcloud_image is >= 33.0.4, which now ships the fix.
Remove the in-container sed patch task, its container-discovery and
drift-guard tasks, and the README note.

Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
requested review from Tobias-Wuest 2026-07-02 15:14:08 +00:00
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/authentik-proxy-outpost-tokens:feat/authentik-proxy-outpost-tokens
git checkout feat/authentik-proxy-outpost-tokens

Merge

Merge the changes and update on Forgejo.
git checkout main
git merge --no-ff feat/authentik-proxy-outpost-tokens
git checkout feat/authentik-proxy-outpost-tokens
git rebase main
git checkout main
git merge --ff-only feat/authentik-proxy-outpost-tokens
git checkout feat/authentik-proxy-outpost-tokens
git rebase main
git checkout main
git merge --no-ff feat/authentik-proxy-outpost-tokens
git checkout main
git merge --squash feat/authentik-proxy-outpost-tokens
git checkout main
git merge --ff-only feat/authentik-proxy-outpost-tokens
git checkout main
git merge feat/authentik-proxy-outpost-tokens
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Tobias-Wuest
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Digitalboard/digitalboard.core#11
No description provided.
Delete branch "feat/authentik-proxy-outpost-tokens"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?