jhodgkin
ce232c5a53
Cloudflare tunnel route -> NPM -> dashboard, Let's Encrypt cert via NPM's API, both public and LAN OIDC redirect URIs registered in Authentik. Hit and fixed a Flexible-SSL redirect loop (ssl_forced must stay false since Cloudflare terminates TLS at the edge and talks plain HTTP to the origin) -- documented clearly so it doesn't get "fixed" by accident later. Closes #13. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2.2 KiB
Authentik OIDC setup
Local auth (bcrypt + session, the saved Vaultwarden password) is always available.
When OIDC_ENABLED=true, the login page additionally shows a "Sign in with Authentik"
button — this is additive, not a replacement, so the existing admin login keeps working.
How the Authentik side was provisioned
No API token or admin credentials were needed. Authentik supports blueprints —
declarative YAML files it applies automatically — so the OAuth2 Provider + Application
were created via /opt/authentik/blueprints-local/homelab-monitor-oidc.yaml on CT121,
picked up by the worker container on startup. This is purely additive: it doesn't
touch any existing user, group, or admin credential.
- Blueprint volume mount added to
/opt/authentik/docker-compose.yml(backed up asdocker-compose.yml.bak-homelab-monitorbefore editing) for bothserverandworker. - Provider: confidential client,
default-provider-authorization-implicit-consentflow (auto-approve — reasonable for a single-user personal dashboard), signed with Authentik's existing self-signed cert. - Redirect URIs (both registered):
https://monitor.jerodrigged.com/api/auth/oidc/callback(primary, set in.env) andhttp://192.168.1.103:8090/api/auth/oidc/callback(LAN fallback, works if the tunnel/DNS is down). - Application slug:
homelab-monitor.
To change anything (redirect URI, flow, scopes), edit the blueprint file on CT121 and
either wait for Authentik's file-watcher or docker restart authentik-worker-1 — it
re-applies on any change to the file.
API-side implementation
apps/api/src/auth/oidc.ts uses openid-client v6 with PKCE + state, same self-signed
TLS handling pattern as collectors/proxmox.ts (Authentik's cert is self-signed on the
LAN too). Routes in apps/api/src/routes/oidc.ts:
GET /api/auth/oidc/login— redirects to Authentik's authorization endpointGET /api/auth/oidc/callback— exchanges the code, setsreq.session.usernamefrom thepreferred_username(falls back toemail, thensub) ID token claim
Credentials
OIDC_CLIENT_ID/OIDC_CLIENT_SECRET are in CT122's .env and saved in Vaultwarden
alongside the local admin login.