reference-ansible/inventories/demo-gymburgdorf/host_vars/application/authentik.yml

---
# Bao secret expected at <mount>/data/authentik with keys:
#   secret_key, postgres_password, admin_password,
#   ldap_outpost_token, proxy_outpost_token,
#   nextcloud_oidc_secret,
#   opnform_oidc_secret, homarr_oidc_secret, bookstack_oidc_secret
_authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/authentik', url=vault_addr) }}"

# Canonical public FQDN browsers and OIDC iss-claim use.
authentik_domains:
  - "auth.gymb.souveredu.ch"

authentik_secret_key: "{{ _authentik.secret_key }}"
authentik_postgres_password: "{{ _authentik.postgres_password }}"

# LDAP outpost (provider for nextcloud)
authentik_ldap_apps:
  - slug: ldap
    name: LDAP
    base_dn: "dc=gymb,dc=souveredu,dc=ch"
    search_group: admins

authentik_ldap_outpost:
  name: "ldap-outpost"
  token: "{{ _authentik.ldap_outpost_token }}"
  config:
    # Outpost pulls config from authentik over the public FQDN, which
    # resolves (internal DNS view) to the DMZ reverseproxy the backend
    # subnet can reach — keeps the round-trip in the LAN with a valid cert.
    authentik_host: "https://auth.gymb.souveredu.ch/"
    log_level: "info"

# Proxy providers (ForwardAuth) — gate downstream services behind
# authentik. The embedded outpost (which authentik ships out of the box)
# hosts these providers under /outpost.goauthentik.io/auth/traefik on the
# canonical FQDN; the service-side traefik attaches a ForwardAuth
# middleware that talks to that endpoint.
authentik_proxy_apps:
  - slug: drawio
    name: Drawio
    external_host: "https://draw.gymb.souveredu.ch"
    internal_host: "http://drawio:8080"
    # drawio is embedded in Nextcloud as an iframe (nextcloud_enable_drawio).
    # Every authenticated Nextcloud user must therefore pass the ForwardAuth
    # gate, otherwise the editor loads a 403 inside the iframe. Allow both
    # standard groups; tightening this back to admins-only would break the
    # Nextcloud integration for regular users.
    allowed_groups:
      - admins
      - users
    flows:
      authentication_slug: default-authentication-flow
      authorization_slug: default-provider-authorization-implicit-consent
      invalidation_slug: default-provider-invalidation-flow
  - slug: garage-webui
    name: "Garage S3 Console"
    external_host: "https://console.s3.gymb.souveredu.ch"
    internal_host: "http://garage-webui:3909"
    allowed_groups:
      - admins
    flows:
      authentication_slug: default-authentication-flow
      authorization_slug: default-provider-authorization-implicit-consent
      invalidation_slug: default-provider-invalidation-flow

# Outpost bindings. drawio runs on this (application) host, so its
# ForwardAuth can use the embedded outpost (same host:9000 as the
# authentik server). garage-webui runs on the storage host; a cross-host
# ForwardAuth to the embedded outpost arrives with a mangled
# X-Forwarded-Host (an extra reverseproxy hop appends :443 / a comma list)
# and the outpost then fails to match the provider's external_host (404).
# So garage-webui is bound to a dedicated proxy outpost deployed on
# storage (role digitalboard.core.authentik_outpost_proxy), whose
# ForwardAuth endpoint the local storage Traefik reaches over the docker
# network — no extra hop, clean X-Forwarded-Host.
authentik_proxy_outposts:
  - name: "authentik Embedded Outpost"
    type: proxy
    providers:
      - drawio
  - name: "storage-proxy-outpost"
    type: proxy
    token: "{{ _authentik.proxy_outpost_token }}"
    providers:
      - garage-webui

# OIDC clients
authentik_oidc_apps:
  - slug: nextcloud
    name: Nextcloud
    client_id: nextcloud
    client_secret: "{{ _authentik.nextcloud_oidc_secret }}"
    redirect_uris:
      - url: "https://cloud.gymb.souveredu.ch/apps/user_oidc/code"
        matching_mode: strict
    signing_key_name: "authentik Self-signed Certificate"
    flows:
      authorization_slug: default-provider-authorization-implicit-consent
      invalidation_slug: default-provider-invalidation-flow
    scopes: [openid, email, profile, offline_access]
  - slug: opnform
    name: OpnForm
    client_id: opnform
    client_secret: "{{ _authentik.opnform_oidc_secret }}"
    redirect_uris:
      - url: "https://forms.gymb.souveredu.ch/auth/authentik/callback"
        matching_mode: strict
    signing_key_name: "authentik Self-signed Certificate"
    flows:
      authorization_slug: default-provider-authorization-implicit-consent
      invalidation_slug: default-provider-invalidation-flow
    # No separate `groups` scope — authentik's default `profile` mapping
    # already emits a `groups` claim built from request.user.groups, so
    # OpnForm's admin-group mapping works without an extra scope.
    scopes: [openid, email, profile]
  - slug: homarr
    name: Homarr
    client_id: homarr
    client_secret: "{{ _authentik.homarr_oidc_secret }}"
    redirect_uris:
      - url: "https://home.gymb.souveredu.ch/api/auth/callback/oidc"
        matching_mode: strict
    signing_key_name: "authentik Self-signed Certificate"
    flows:
      authorization_slug: default-provider-authorization-implicit-consent
      invalidation_slug: default-provider-invalidation-flow
    scopes: [openid, email, profile]
  - slug: bookstack
    name: BookStack
    client_id: bookstack
    client_secret: "{{ _authentik.bookstack_oidc_secret }}"
    redirect_uris:
      - url: "https://wiki.gymb.souveredu.ch/oidc/callback"
        matching_mode: strict
    signing_key_name: "authentik Self-signed Certificate"
    flows:
      authorization_slug: default-provider-authorization-implicit-consent
      invalidation_slug: default-provider-invalidation-flow
    scopes: [openid, email, profile]

authentik_groups:
  - name: admins
  - name: users
  - name: opnform-admins
  - name: homarr-admins
  - name: bookstack-admins

authentik_local_users:
  - username: akadmin
    name: "Authentik Admin"
    email: "admin@gymb.souveredu.ch"
    password: "{{ _authentik.admin_password }}"
    is_active: true
    groups:
      - authentik Admins
      - admins