From 3c6d9549fba4cd8e06c854863cf0eb4fd7877380 Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Wed, 12 Aug 2026 12:00:00 +0000
Subject: [PATCH] feat(authentik): declare
 wiki-admin/wiki-betrieb/wiki-anwender groups (#0049)

Deployable group structure for the wiki roles/abschottung. Names match the
Wiki.js groups and flow to Wiki.js via the profile->groups claim. Members are
assigned in the Authentik UI (sorb), not here.
---
 apps/authentik/authentik-blueprints.yaml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/apps/authentik/authentik-blueprints.yaml b/apps/authentik/authentik-blueprints.yaml
index 90badb5..661e578 100644
--- a/apps/authentik/authentik-blueprints.yaml
+++ b/apps/authentik/authentik-blueprints.yaml
@@ -466,3 +466,19 @@ data:
           meta_description: Internes Wiki (Betrieb/Anwender), Zugriff nach Gruppe
           policy_engine_mode: any
           open_in_new_tab: false
+
+      # Rollen/Abschottung (#0049). Namen müssen exakt den Wiki.js-Gruppen
+      # entsprechen — sie kommen über den profile->groups-Claim automatisch mit.
+      # Mitglieder werden in der Authentik-UI zugewiesen (sorb), nicht hier.
+      - model: authentik_core.group
+        state: present
+        identifiers:
+          name: wiki-admin
+      - model: authentik_core.group
+        state: present
+        identifiers:
+          name: wiki-betrieb
+      - model: authentik_core.group
+        state: present
+        identifiers:
+          name: wiki-anwender