version: 1
metadata:
  name: homelab-monitor-oidc
entries:
  - model: authentik_providers_oauth2.oauth2provider
    id: homelab-monitor-provider
    identifiers:
      name: homelab-monitor
    attrs:
      client_type: confidential
      client_id: 91e5b20f5902319144cc1530559f5c8ba27e0027
      # Real secret lives only in CT122's .env / Vaultwarden -- this
      # blueprint file as deployed to CT121 has the real value baked in
      # (Authentik blueprints don't support secret refs), but the copy
      # tracked in this repo uses a placeholder. If re-deploying from
      # scratch, pull the real secret from Vaultwarden ("Homelab Monitor -
      # Authentik OIDC client") and substitute it before pushing to CT121.
      client_secret: __SEE_VAULTWARDEN_HOMELAB_MONITOR_OIDC_CLIENT__
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      # default-invalidation-flow (full Authentik logout), not
      # default-provider-invalidation-flow (app-scoped only). The app-scoped
      # one leaves Authentik's own browser session cookie valid, so a
      # subsequent "Sign in with Authentik" click silently re-authenticates
      # with no prompt -- doesn't satisfy "sign out should sign out of
      # Authentik too" (issue #19). Confirmed via a full Playwright
      # click-through both ways before settling on this. Per-provider
      # setting; doesn't affect any other app's logout behavior.
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
      signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
      sub_mode: hashed_user_id
      # Without these, the ID token only ever carries the bare required
      # claims (sub/iss/aud/exp/...) -- never preferred_username or email.
      # The app's claim fallback chain (preferred_username ?? email ?? sub)
      # landed on the raw sub hash, which rendered next to the sign-out
      # button looking like a leaked session token. Confirmed root cause by
      # decoding a real captured ID token before concluding this was it,
      # rather than guessing.
      property_mappings:
        - !Find [authentik_providers_oauth2.scopemapping, [name, "authentik default OAuth Mapping: OpenID 'openid'"]]
        - !Find [authentik_providers_oauth2.scopemapping, [name, "authentik default OAuth Mapping: OpenID 'profile'"]]
        - !Find [authentik_providers_oauth2.scopemapping, [name, "authentik default OAuth Mapping: OpenID 'email'"]]
      redirect_uris:
        - matching_mode: strict
          url: https://monitor.jerodrigged.com/api/auth/oidc/callback
        - matching_mode: strict
          url: http://192.168.1.103:8090/api/auth/oidc/callback
  - model: authentik_core.application
    id: homelab-monitor-app
    identifiers:
      slug: homelab-monitor
    attrs:
      name: Homelab Monitor
      provider: !KeyOf homelab-monitor-provider
      open_in_new_tab: false
      meta_launch_url: https://monitor.jerodrigged.com