jhodgkin
ce232c5a53
Cloudflare tunnel route -> NPM -> dashboard, Let's Encrypt cert via NPM's API, both public and LAN OIDC redirect URIs registered in Authentik. Hit and fixed a Flexible-SSL redirect loop (ssl_forced must stay false since Cloudflare terminates TLS at the edge and talks plain HTTP to the origin) -- documented clearly so it doesn't get "fixed" by accident later. Closes #13. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
43 lines
2.2 KiB
Markdown
43 lines
2.2 KiB
Markdown
# Authentik OIDC setup
|
|
|
|
Local auth (bcrypt + session, the saved Vaultwarden password) is always available.
|
|
When `OIDC_ENABLED=true`, the login page additionally shows a "Sign in with Authentik"
|
|
button — this is additive, not a replacement, so the existing admin login keeps working.
|
|
|
|
## How the Authentik side was provisioned
|
|
|
|
No API token or admin credentials were needed. Authentik supports **blueprints** —
|
|
declarative YAML files it applies automatically — so the OAuth2 Provider + Application
|
|
were created via `/opt/authentik/blueprints-local/homelab-monitor-oidc.yaml` on CT121,
|
|
picked up by the `worker` container on startup. This is purely additive: it doesn't
|
|
touch any existing user, group, or admin credential.
|
|
|
|
- Blueprint volume mount added to `/opt/authentik/docker-compose.yml` (backed up as
|
|
`docker-compose.yml.bak-homelab-monitor` before editing) for both `server` and `worker`.
|
|
- Provider: confidential client, `default-provider-authorization-implicit-consent` flow
|
|
(auto-approve — reasonable for a single-user personal dashboard), signed with
|
|
Authentik's existing self-signed cert.
|
|
- Redirect URIs (both registered): `https://monitor.jerodrigged.com/api/auth/oidc/callback` (primary,
|
|
set in `.env`) and `http://192.168.1.103:8090/api/auth/oidc/callback` (LAN fallback, works if the
|
|
tunnel/DNS is down).
|
|
- Application slug: `homelab-monitor`.
|
|
|
|
To change anything (redirect URI, flow, scopes), edit the blueprint file on CT121 and
|
|
either wait for Authentik's file-watcher or `docker restart authentik-worker-1` — it
|
|
re-applies on any change to the file.
|
|
|
|
## API-side implementation
|
|
|
|
`apps/api/src/auth/oidc.ts` uses `openid-client` v6 with PKCE + state, same self-signed
|
|
TLS handling pattern as `collectors/proxmox.ts` (Authentik's cert is self-signed on the
|
|
LAN too). Routes in `apps/api/src/routes/oidc.ts`:
|
|
|
|
- `GET /api/auth/oidc/login` — redirects to Authentik's authorization endpoint
|
|
- `GET /api/auth/oidc/callback` — exchanges the code, sets `req.session.username` from
|
|
the `preferred_username` (falls back to `email`, then `sub`) ID token claim
|
|
|
|
## Credentials
|
|
|
|
`OIDC_CLIENT_ID`/`OIDC_CLIENT_SECRET` are in CT122's `.env` and saved in Vaultwarden
|
|
alongside the local admin login.
|