chore(terraform): deploy authentik tf too

kubernetes/apps/main/flux-system/tf-controller/terraforms/authentik.yaml

@@ -0,0 +1,37 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.ok8.sh/infra.contrib.fluxcd.io/terraform_v1alpha2.json
+apiVersion: infra.contrib.fluxcd.io/v1alpha2
+kind: Terraform
+metadata:
+  name: kubernetes-authentik
+spec:
+  suspend: false
+  approvePlan: auto
+  interval: 12h
+  path: ./main/authentik
+  sourceRef:
+    kind: OCIRepository
+    name: terraform
+    namespace: flux-system
+  backendConfig:
+    disable: true
+  cliConfigSecretRef:
+    name: tf-controller-tfrc-secret
+  runnerPodTemplate:
+    spec:
+      env:
+        - name: OP_CONNECT_HOST
+          value: http://onepassword-connect.kube-system.svc.cluster.local
+        - name: OP_CONNECT_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: &secret tf-controller-secret
+              key: OP_CONNECT_TOKEN
+      volumeMounts:
+        - name: sops
+          mountPath: /home/runner/.config/sops/age/keys.txt
+          subPath: SOPS_PRIVATE_KEY
+      volumes:
+        - name: sops
+          secret:
+            secretName: *secret

terraform/main/authentik/applications.tf

@@ -0,0 +1,46 @@
+module "oauth2-grafana" {
+  source             = "./oauth2_application"
+  name               = "Grafana"
+  icon_url           = "https://raw.githubusercontent.com/grafana/grafana/main/public/img/icons/mono/grafana.svg"
+  launch_url         = "https://grafana.ok8.sh"
+  description        = "Infrastructure Graphs"
+  newtab             = true
+  group              = "Infrastructure"
+  auth_groups        = [authentik_group.infrastructure.id]
+  authorization_flow = resource.authentik_flow.provider-authorization-implicit-consent.uuid
+  client_id          = module.secret_grafana.fields["OIDC_CLIENT_ID"]
+  client_secret      = module.secret_grafana.fields["OIDC_CLIENT_SECRET"]
+  redirect_uris      = ["https://grafana.ok8.sh/login/generic_oauth"]
+}
+
+module "oauth2-minio" {
+  source             = "./oauth2_application"
+  name               = "Minio"
+  icon_url           = "https://www.cloudfoundry.org/wp-content/uploads/2017/01/Minio-logo_1_1_.png"
+  launch_url         = "https://minio.ok8.sh/"
+  description        = "Infrastructure S3 Storage"
+  newtab             = true
+  group              = "Infrastructure"
+  auth_groups        = [authentik_group.infrastructure.id]
+  authorization_flow = resource.authentik_flow.provider-authorization-implicit-consent.uuid
+  client_id          = module.secret_minio.fields["OIDC_CLIENT_ID"]
+  client_secret      = module.secret_minio.fields["OIDC_CLIENT_SECRET"]
+  additional_property_mappings = formatlist(authentik_scope_mapping.openid-minio.id)
+  redirect_uris      = ["https://minio.ok8.sh/oauth_callback"]
+}
+
+module "oauth2-weave-gitops" {
+  source             = "./oauth2_application"
+  name               = "Weave Gitops"
+  icon_url           = "https://docs.gitops.weave.works/img/weave-logo.png"
+  launch_url         = "https://gitops.ok8.sh"
+  description        = "Infrastructure GitOps"
+  newtab             = true
+  group              = "Infrastructure"
+  auth_groups        = [authentik_group.infrastructure.id]
+  authorization_flow = resource.authentik_flow.provider-authorization-implicit-consent.uuid
+  client_id          = module.secret_weave-gitops.fields["OIDC_CLIENT_ID"]
+  client_secret      = module.secret_weave-gitops.fields["OIDC_CLIENT_SECRET"]
+  redirect_uris      = ["https://gitops.ok8.sh/oauth2/callback"]
+}
+

terraform/main/authentik/customization.tf

@@ -0,0 +1,62 @@
+resource "authentik_policy_password" "password-complexity" {
+  name             = "password-complexity"
+  length_min       = 8
+  amount_digits    = 1
+  amount_lowercase = 1
+  amount_uppercase = 1
+  error_message    = "Minimum password length: 10. At least 1 of each required: uppercase, lowercase, digit"
+}
+
+resource "authentik_policy_expression" "user-settings-authorization" {
+  name       = "user-settings-authorization"
+  expression = <<-EOT
+  from authentik.lib.config import CONFIG
+  from authentik.core.models import (
+      USER_ATTRIBUTE_CHANGE_EMAIL,
+      USER_ATTRIBUTE_CHANGE_NAME,
+      USER_ATTRIBUTE_CHANGE_USERNAME
+  )
+  prompt_data = request.context.get('prompt_data')
+
+  if not request.user.group_attributes(request.http_request).get(
+      USER_ATTRIBUTE_CHANGE_EMAIL, CONFIG.y_bool('default_user_change_email', True)
+  ):
+      if prompt_data.get('email') != request.user.email:
+          ak_message('Not allowed to change email address.')
+          return False
+
+  if not request.user.group_attributes(request.http_request).get(
+      USER_ATTRIBUTE_CHANGE_NAME, CONFIG.y_bool('default_user_change_name', True)
+  ):
+      if prompt_data.get('name') != request.user.name:
+          ak_message('Not allowed to change name.')
+          return False
+
+  if not request.user.group_attributes(request.http_request).get(
+      USER_ATTRIBUTE_CHANGE_USERNAME, CONFIG.y_bool('default_user_change_username', True)
+  ):
+      if prompt_data.get('username') != request.user.username:
+          ak_message('Not allowed to change username.')
+          return False
+
+  return True
+  EOT
+}
+## OAuth scopes
+data "authentik_scope_mapping" "scopes" {
+  managed_list = [
+    "goauthentik.io/providers/oauth2/scope-email",
+    "goauthentik.io/providers/oauth2/scope-openid",
+    "goauthentik.io/providers/oauth2/scope-profile"
+  ]
+}
+
+resource "authentik_scope_mapping" "openid-minio" {
+  name       = "minio"
+  scope_name = "minio"
+  expression = <<EOF
+return {
+  "policy": "readwrite",
+}
+EOF
+}

terraform/main/authentik/directory.tf

@@ -0,0 +1,23 @@
+resource "authentik_group" "users" {
+  name         = "users"
+  is_superuser = false
+}
+
+resource "authentik_group" "media" {
+  name         = "media"
+  is_superuser = false
+  parent       = resource.authentik_group.users.id
+}
+
+resource "authentik_group" "infrastructure" {
+  name         = "infrastructure"
+  is_superuser = false
+}
+
+data "authentik_group" "admins" {
+  name = "authentik Admins"
+}
+
+data "authentik_group" "s3-admin" {
+  name = "S3 Superuser"
+}