jhodgkin
a431b87f1f
Local auth stays the primary/always-available login (don't want to lock out the saved admin password) — OIDC is additive, shown as a second button when OIDC_ENABLED=true. Uses openid-client v6 with PKCE. Authentik-side provider was set up via an authentik blueprint (its own declarative automation, see docs/oidc-setup.md) rather than touching any existing admin credentials. Closes #12. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2.1 KiB
Authentik OIDC setup
Local auth (bcrypt + session, the saved Vaultwarden password) is always available.
When OIDC_ENABLED=true, the login page additionally shows a "Sign in with Authentik"
button — this is additive, not a replacement, so the existing admin login keeps working.
How the Authentik side was provisioned
No API token or admin credentials were needed. Authentik supports blueprints —
declarative YAML files it applies automatically — so the OAuth2 Provider + Application
were created via /opt/authentik/blueprints-local/homelab-monitor-oidc.yaml on CT121,
picked up by the worker container on startup. This is purely additive: it doesn't
touch any existing user, group, or admin credential.
- Blueprint volume mount added to
/opt/authentik/docker-compose.yml(backed up asdocker-compose.yml.bak-homelab-monitorbefore editing) for bothserverandworker. - Provider: confidential client,
default-provider-authorization-implicit-consentflow (auto-approve — reasonable for a single-user personal dashboard), signed with Authentik's existing self-signed cert. - Redirect URI:
http://192.168.1.103:8090/api/auth/oidc/callback(LAN-only for now; will need a second redirect URI added once issue #13's public exposure lands). - Application slug:
homelab-monitor.
To change anything (redirect URI, flow, scopes), edit the blueprint file on CT121 and
either wait for Authentik's file-watcher or docker restart authentik-worker-1 — it
re-applies on any change to the file.
API-side implementation
apps/api/src/auth/oidc.ts uses openid-client v6 with PKCE + state, same self-signed
TLS handling pattern as collectors/proxmox.ts (Authentik's cert is self-signed on the
LAN too). Routes in apps/api/src/routes/oidc.ts:
GET /api/auth/oidc/login— redirects to Authentik's authorization endpointGET /api/auth/oidc/callback— exchanges the code, setsreq.session.usernamefrom thepreferred_username(falls back toemail, thensub) ID token claim
Credentials
OIDC_CLIENT_ID/OIDC_CLIENT_SECRET are in CT122's .env and saved in Vaultwarden
alongside the local admin login.