docs: Add security.html with Passkey/TOTP self-service setup links

Neither Element Web's config.json nor MAS's branding config expose a generic custom-link mechanism, and /if/user/ is blocked for type=external Matrix accounts, so the working Authentik MFA setup flows had nowhere to be discoverable. Added a docs/setup/security.html page, following the exact existing pattern (ConfigMap -> initContainer cp -> nginx), linked from index.html's Support section.
fix: Set Brand.default_application so "/" doesn't dead-end at /if/user/
2026-07-27 12:00:00 +00:00 · 2026-07-27 12:00:00 +00:00 · 2026-07-27 12:00:00 +00:00 · 2026-07-27 12:00:00 +00:00 · 2026-07-27 12:00:00 +00:00 · 2026-07-27 12:00:00 +00:00
7 changed files with 356 additions and 1 deletions
@@ -0,0 +1,228 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentik-blueprints
+  namespace: authentik
+data:
+  matrix-invitation-flow.yaml: |
+    # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
+    version: 1
+    metadata:
+      name: matrix-invitation-flow
+      labels:
+        blueprints.goauthentik.io/instantiate: "true"
+    entries:
+      # Reaffirm the flow itself (already created manually; matched by slug)
+      - model: authentik_flows.flow
+        state: present
+        identifiers:
+          slug: matrix-invitation
+        id: matrix_invitation_flow
+        attrs:
+          name: matrix-invitation
+          title: matrix-invitation
+          designation: enrollment
+
+      # The prompt stage had accumulated 16 unrelated system validation_policies
+      # (e.g. default-user-settings-authorization, default-oobe-password-usable)
+      # from manual UI setup, likely a "select all" slip in the policy picker.
+      # These crash on an anonymous enrollment context ('AnonymousUser' object
+      # has no attribute 'group_attributes', etc). A prompt stage needs none here.
+      - model: authentik_stages_prompt.promptstage
+        state: present
+        identifiers:
+          name: matrix-invitation-prompt
+        attrs:
+          validation_policies: []
+
+      # Correct stage chain, mirroring the working matrix-enrollment flow:
+      # Invite -> Prompt (username/email/password) -> Write -> Password -> Login
+      # Root cause of the original bug: only Invite+Prompt were bound, both at
+      # order=0, so the flow never wrote the user to the DB or logged them in.
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_invitation_flow
+          order: 0
+        attrs:
+          stage: !Find [authentik_stages_invitation.invitationstage, [name, matrix-enrollment-invitation]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_invitation_flow
+          order: 1
+        attrs:
+          stage: !Find [authentik_stages_prompt.promptstage, [name, matrix-invitation-prompt]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_invitation_flow
+          order: 2
+        attrs:
+          stage: !Find [authentik_stages_user_write.userwritestage, [name, default-source-enrollment-write]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_invitation_flow
+          order: 3
+        attrs:
+          stage: !Find [authentik_stages_password.passwordstage, [name, default-authentication-password]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_invitation_flow
+          order: 4
+        attrs:
+          stage: !Find [authentik_stages_user_login.userloginstage, [name, default-source-enrollment-login]]
+
+      # Without an explicit destination, the flow falls back to Authentik's own
+      # /if/user/ dashboard, which refuses type=external users ("Die Oberflaeche
+      # kann nur von internen Nutzern geoeffnet werden") - exactly the user type
+      # these Matrix-only accounts correctly have. Send them to Element instead.
+      - model: authentik_stages_redirect.redirectstage
+        state: present
+        identifiers:
+          name: matrix-invitation-redirect
+        id: matrix_invitation_redirect_stage
+        attrs:
+          mode: static
+          target_static: https://axion1337.chat
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_invitation_flow
+          order: 5
+        attrs:
+          stage: !KeyOf matrix_invitation_redirect_stage
+  matrix-recovery-flow.yaml: |
+    # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
+    version: 1
+    metadata:
+      name: matrix-recovery-flow
+      labels:
+        blueprints.goauthentik.io/instantiate: "true"
+    entries:
+      # matrix-recovery existed but had zero stage bindings (dead flow), and the
+      # real login flow (default-authentication-flow, used by the MAS OAuth2
+      # provider's authentication_flow) didn't link to it at all - no "Forgot
+      # password?" link was ever shown. Reuses the same default-recovery-*
+      # stages the built-in default-recovery-flow already uses successfully,
+      # plus our own redirect stage instead of falling back to the authentik
+      # dashboard (blocked for type=external Matrix users).
+      - model: authentik_flows.flow
+        state: present
+        identifiers:
+          slug: matrix-recovery
+        id: matrix_recovery_flow
+        attrs:
+          designation: recovery
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_recovery_flow
+          order: 10
+        attrs:
+          stage: !Find [authentik_stages_identification.identificationstage, [name, default-recovery-identification]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_recovery_flow
+          order: 20
+        attrs:
+          stage: !Find [authentik_stages_email.emailstage, [name, default-recovery-email]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_recovery_flow
+          order: 30
+        attrs:
+          stage: !Find [authentik_stages_prompt.promptstage, [name, "Change your password"]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_recovery_flow
+          order: 40
+        attrs:
+          stage: !Find [authentik_stages_user_write.userwritestage, [name, default-recovery-user-write]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_recovery_flow
+          order: 100
+        attrs:
+          stage: !Find [authentik_stages_user_login.userloginstage, [name, default-recovery-user-login]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_recovery_flow
+          order: 110
+        attrs:
+          stage: !Find [authentik_stages_redirect.redirectstage, [name, matrix-invitation-redirect]]
+
+      # Wire the "Forgot password?" link on the real login flow used by MAS
+      - model: authentik_stages_identification.identificationstage
+        state: present
+        identifiers:
+          name: default-authentication-identification
+        attrs:
+          recovery_flow: !KeyOf matrix_recovery_flow
+  matrix-mfa-setup-redirect.yaml: |
+    # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
+    version: 1
+    metadata:
+      name: matrix-mfa-setup-redirect
+      labels:
+        blueprints.goauthentik.io/instantiate: "true"
+    entries:
+      # 2FA is optional (default-authentication-mfa-validation has
+      # not_configured_action=skip - login never blocks on missing MFA).
+      # Users who want to opt in use these built-in single-stage setup flows
+      # directly (unreachable via /if/user/, which is blocked for type=external
+      # Matrix accounts). Without a stage after the setup itself, completion
+      # fell back to the same blocked /if/user/ dashboard - append our redirect.
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !Find [authentik_flows.flow, [slug, default-authenticator-totp-setup]]
+          order: 10
+        attrs:
+          stage: !Find [authentik_stages_redirect.redirectstage, [name, matrix-invitation-redirect]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !Find [authentik_flows.flow, [slug, default-authenticator-webauthn-setup]]
+          order: 10
+        attrs:
+          stage: !Find [authentik_stages_redirect.redirectstage, [name, matrix-invitation-redirect]]
+  matrix-brand-default-app.yaml: |
+    # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
+    version: 1
+    metadata:
+      name: matrix-brand-default-app
+      labels:
+        blueprints.goauthentik.io/instantiate: "true"
+    entries:
+      # Root cause behind several dead ends: an authenticated user hitting "/"
+      # with no other destination (e.g. after logging in mid-way through the
+      # TOTP/WebAuthn setup flows) falls back to Brand.default_application: if
+      # unset, that's /if/user/, which type=external Matrix accounts can't
+      # open. Only affects the bare "/" fallback - explicit URLs like
+      # /if/admin/ are unaffected, so internal/staff access is unchanged.
+      - model: authentik_brands.brand
+        state: present
+        identifiers:
+          domain: authentik-default
+        attrs:
+          default_application: !Find [authentik_core.application, [slug, matrix]]
@@ -52,6 +52,10 @@ spec:
        use_tls: true
        from: "Authentik <gamemaster@axion1337.chat>"

+    blueprints:
+      configMaps:
+        - authentik-blueprints
+
    server:
      ingress:
        enabled: false
@@ -4,6 +4,7 @@ resources:
  - namespace.yaml
  - helm-repo.yaml
  - authentik-secret.yaml
+  - authentik-blueprints.yaml
  - certificate.yaml
  - authentik.yaml
  - ingress.yaml
@@ -193,6 +193,7 @@ data:
        <div class="section">
          <h2>❓ Support</h2>
          <p>Für weitere Hilfe besuche: <a href="https://element.io/help" target="_blank">element.io/help</a></p>
+          <p>🔐 <a href="security.html">Konto-Sicherheit (Passkey/2FA einrichten)</a></p>
        </div>

        <div class="support">
@@ -203,6 +204,117 @@ data:
    </body>
    </html>

+  # Security / 2FA setup page
+  "security.html": |
+    <!DOCTYPE html>
+    <html lang="de">
+    <head>
+      <meta charset="UTF-8">
+      <meta name="viewport" content="width=device-width, initial-scale=1.0">
+      <title>Konto-Sicherheit - aXion1337.Chat</title>
+      <style>
+        * { margin: 0; padding: 0; box-sizing: border-box; }
+        body {
+          font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", sans-serif;
+          background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+          min-height: 100vh;
+          padding: 40px 20px;
+        }
+        .container {
+          max-width: 800px;
+          margin: 0 auto;
+          background: white;
+          border-radius: 12px;
+          box-shadow: 0 20px 60px rgba(0,0,0,0.3);
+          padding: 40px;
+        }
+        h1 { color: #333; margin-bottom: 10px; font-size: 2.5em; }
+        .subtitle { color: #666; margin-bottom: 40px; font-size: 1.1em; }
+        .section { margin-bottom: 40px; }
+        .section h2 {
+          color: #667eea;
+          font-size: 1.5em;
+          margin-bottom: 20px;
+          border-bottom: 3px solid #667eea;
+          padding-bottom: 10px;
+        }
+        .download-grid {
+          display: grid;
+          grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+          gap: 20px;
+          margin-bottom: 30px;
+        }
+        .download-card {
+          background: #f8f9fa;
+          border: 2px solid #e9ecef;
+          border-radius: 8px;
+          padding: 20px;
+          text-align: center;
+          transition: all 0.3s ease;
+          text-decoration: none;
+          color: #333;
+        }
+        .download-card:hover {
+          border-color: #667eea;
+          background: #f0f3ff;
+          transform: translateY(-5px);
+          box-shadow: 0 10px 30px rgba(102, 126, 234, 0.2);
+        }
+        .download-card .icon { font-size: 2.5em; margin-bottom: 10px; }
+        .download-card .name { font-weight: 600; font-size: 1.1em; margin-bottom: 5px; }
+        .download-card .desc { font-size: 0.9em; color: #666; }
+        .instructions {
+          background: #e7f3ff;
+          border-left: 4px solid #0066cc;
+          padding: 15px;
+          border-radius: 4px;
+          margin: 15px 0;
+          line-height: 1.6;
+        }
+        .support {
+          text-align: center;
+          color: #666;
+          margin-top: 40px;
+          padding-top: 20px;
+          border-top: 1px solid #e9ecef;
+        }
+        .support a { color: #667eea; text-decoration: none; font-weight: 500; }
+        .support a:hover { text-decoration: underline; }
+      </style>
+    </head>
+    <body>
+      <div class="container">
+        <h1>🔐 Konto-Sicherheit</h1>
+        <p class="subtitle">Zwei-Faktor-Authentifizierung ist optional - richte sie nur ein, wenn du sie nutzen möchtest.</p>
+
+        <div class="section">
+          <h2>🔑 Einrichten</h2>
+          <div class="download-grid">
+            <a href="https://auth.axion1337.chat/if/flow/default-authenticator-webauthn-setup/" class="download-card" target="_blank">
+              <div class="icon">🔑</div>
+              <div class="name">Passkey</div>
+              <div class="desc">WebAuthn / Sicherheitsschlüssel</div>
+            </a>
+            <a href="https://auth.axion1337.chat/if/flow/default-authenticator-totp-setup/" class="download-card" target="_blank">
+              <div class="icon">📱</div>
+              <div class="name">TOTP</div>
+              <div class="desc">Authenticator-App</div>
+            </a>
+          </div>
+          <div class="instructions">
+            <strong>Hinweis:</strong> Du musst bei <code>auth.axion1337.chat</code> eingeloggt sein, damit die
+            Einrichtung funktioniert. Ohne konfiguriertes Gerät wird beim Login einfach kein zweiter Faktor abgefragt -
+            2FA ist nie Voraussetzung zum Anmelden.
+          </div>
+        </div>
+
+        <div class="support">
+          <p><a href="index.html">← Zurück zum Setup</a></p>
+        </div>
+      </div>
+    </body>
+    </html>
+
  # README
  "README-Element-Setup.md": |
    # Element Desktop Setup Scripts
@@ -21,6 +21,7 @@ spec:
        - |
          mkdir -p /html/docs/setup
          cp /config/index.html /html/docs/setup/
+          cp /config/security.html /html/docs/setup/
          cp /config/README-Element-Setup.md /html/docs/setup/
          cp /config/element-setup-windows.cmd /html/docs/setup/
          cp /config/element-setup-macos.command /html/docs/setup/
@@ -206,6 +206,15 @@

 **None** – Alle CRITICAL Tasks erledigt! Nächster Focus: Database Backups

+### Phase 8: Authentik Enrollment/Recovery/MFA Fix (2026-07-27)
+- [x] **matrix-invitation Flow repariert** – fehlende Write/Password/Login-Stages ergänzt, Reihenfolge korrigiert, als Authentik Blueprint (`apps/authentik/authentik-blueprints.yaml`) reproduzierbar gemacht
+- [x] **matrix-invitation-prompt** – 16 fehlerhafte `validation_policies` entfernt (crashten mit `AnonymousUser`/`NoneType`-Fehlern)
+- [x] **Redirect-Stage** – Flow endet jetzt auf `axion1337.chat` statt in der `/if/user/`-Sackgasse (blockiert für `type=external`)
+- [x] **matrix-recovery Flow gebaut** – war komplett leer (0 Stages); Passwort-Reset funktioniert jetzt, verlinkt von der echten Login-Seite
+- [x] **Brand.default_application gesetzt** – behebt mehrere Dead-Ends, wenn eingeloggte User `/` ohne Ziel aufrufen
+- [x] **2FA/Passkey Selbst-Einrichtung** – Links zu `default-authenticator-totp-setup`/`-webauthn-setup` (2FA bleibt optional, `not_configured_action=skip`), dokumentiert unter `axion1337.chat/docs/setup/security.html`
+- [ ] **Backlog**: MAS Custom-Template-Override, um den 2FA/Passkey-Link direkt auf `account.axion1337.chat/account/` anzuzeigen (statt nur über die Doku-Seite) – erfordert Forken der MAS Tera/Askama-Templates via `templates.path`, höherer Aufwand/Risiko, bei MAS-Updates zu pflegen
+
 ---

 ## 📋 Backlog (Weitere Aufgaben)
@@ -86,7 +86,7 @@ Dieser Ordner enthält detaillierte Troubleshooting- und Reparaturanleitungen f
 |---------|--------|-------|--------|
 | Nur Standard Enrollment funktioniert | akadmin ✅ | - | Resolved |
 | User nur in Authentik, nicht in Synapse | Boje | `DIAGNOSTIK-AUTHENTIK-FLOW.md` | In Progress |
-| Einladungslink-Fehler: "kein ausstehender benutzer" | Klaus | `AUTHENTIK-CREATE-INVITATION-FLOW.md` | In Progress |
+| Einladungslink-Fehler: "kein ausstehender benutzer" | Klaus | `AUTHENTIK-CREATE-INVITATION-FLOW.md` | **Fixed (2026-07-27)** — `matrix-invitation` Flow hatte nur Invite+Prompt Stage-Bindings, beide auf `order=0`. Write/Password/Login-Stages fehlten komplett. Live gefixt + als Blueprint (`apps/authentik/authentik-blueprints.yaml`) reproduzierbar gemacht. |
 | OIDC-Integration unklar | General | `AUTHENTIK-FIX-TEMPLATE.md` | Reference |

 ---
Author	SHA1	Message	Date
Thore Cimbal	c0cb864ca2	docs: Add security.html with Passkey/TOTP self-service setup links Neither Element Web's config.json nor MAS's branding config expose a generic custom-link mechanism, and /if/user/ is blocked for type=external Matrix accounts, so the working Authentik MFA setup flows had nowhere to be discoverable. Added a docs/setup/security.html page, following the exact existing pattern (ConfigMap -> initContainer cp -> nginx), linked from index.html's Support section.	2026-07-27 12:00:00 +00:00
Thore Cimbal	235306a840	fix: Set Brand.default_application so "/" doesn't dead-end at /if/user/ Several dead ends (TOTP/WebAuthn setup after an anonymous visit bounces through login and lands on "/") trace back to Brand.default_application being unset, which falls back to /if/user/ - blocked for type=external Matrix accounts. Set it to the matrix Application. Only changes the bare "/" fallback; explicit URLs like /if/admin/ are unaffected.	2026-07-27 12:00:00 +00:00
Thore Cimbal	e9b24a6d1f	fix: Append redirect stage to TOTP/WebAuthn self-service setup flows 2FA is intentionally optional (not_configured_action=skip on the login flow's validate stage). Users who opt in use the built-in single-stage default-authenticator-totp-setup / -webauthn-setup flows directly, since /if/user/ is blocked for type=external Matrix accounts. Both flows had nothing after the setup stage, so completing enrollment fell back to that same blocked dashboard. Appended the shared redirect stage.	2026-07-27 12:00:00 +00:00
Thore Cimbal	0274f9316c	fix: Build matrix-recovery flow and link it as the login page's recovery flow matrix-recovery existed but had zero stage bindings, and the real login flow (default-authentication-flow, MAS's authentication_flow) never linked to it, so users had no working "forgot password" path. Reused the same default-recovery-* stages the built-in default-recovery-flow already uses successfully, added our redirect stage at the end, and set default-authentication-identification.recovery_flow accordingly.	2026-07-27 12:00:00 +00:00
Thore Cimbal	027f567c8b	fix: Add redirect stage so matrix-invitation ends up at Element, not authentik dashboard After the login stage, the flow had no destination, so it fell back to authentik's own /if/user/ interface - which refuses type=external users (the correct type for Matrix-only accounts), showing "Die Oberflaeche kann nur von internen Nutzern geoeffnet werden". Added a static redirect to https://axion1337.chat as the final stage.	2026-07-27 12:00:00 +00:00
Thore Cimbal	d2bcd90291	fix: Clear erroneous validation_policies on matrix-invitation-prompt The prompt stage had 16 unrelated system policies bound (OOBE, user settings, recovery, etc.), likely from a "select all" slip while configuring it manually. They crash when evaluated in an anonymous enrollment context (AnonymousUser has no group_attributes, etc.), surfacing as opaque errors after form submit. Cleared live and via the blueprint so re-application doesn't reintroduce them.	2026-07-27 12:00:00 +00:00
Thore Cimbal	80714fe901	fix: Repair matrix-invitation enrollment flow via Authentik Blueprint The matrix-invitation flow only had Invite+Prompt stage bindings, both at order=0 (undefined order), missing the Write/Password/Login stages entirely — invited users were never written to the DB. Applied the fix live in-cluster (mirroring the working matrix-enrollment stage chain), and captured it as an Authentik Blueprint (ConfigMap, mounted via blueprints.configMaps) so the flow state is reproducible via GitOps instead of manual admin-UI clicks.	2026-07-27 12:00:00 +00:00