feat: add authentik blueprint for forwarded wiki authentication

apps/authentik/authentik-blueprints.yaml

@@ -422,3 +422,53 @@ data:
           meta_publisher: aXionGaming
           policy_engine_mode: any
           open_in_new_tab: false
+  wiki-forward-auth.yaml: |
+    # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
+    version: 1
+    metadata:
+      name: wiki-forward-auth
+      labels:
+        blueprints.goauthentik.io/instantiate: "true"
+    entries:
+      # Proxy-Provider im Forward-Auth-Modus. Kein internal_host (das wäre der
+      # Proxy-Modus) — forward_single reicht Traefik nur das Ja/Nein zurück.
+      - model: authentik_providers_proxy.proxyprovider
+        state: present
+        identifiers:
+          name: ThreadNet Wiki
+        id: wiki_proxy_provider
+        attrs:
+          mode: forward_single
+          external_host: https://axionwiki.lab
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          access_token_validity: hours=24
+
+      - model: authentik_core.application
+        state: present
+        identifiers:
+          slug: wiki
+        id: wiki_app
+        attrs:
+          name: ThreadNet Wiki
+          provider: !KeyOf wiki_proxy_provider
+          meta_description: Internes Docusaurus-Wiki, nur Gruppe wiki-zugang
+          policy_engine_mode: any
+          open_in_new_tab: true
+
+      # Zugangsbeschränkung: nur Mitglieder dieser Gruppe passieren das Tor.
+      - model: authentik_core.group
+        state: present
+        identifiers:
+          name: wiki-zugang
+        id: wiki_group
+
+      - model: authentik_policies.policybinding
+        state: present
+        identifiers:
+          target: !KeyOf wiki_app
+          group: !KeyOf wiki_group
+          order: 0
+        attrs:
+          enabled: true
+          negate: false