sorb/axion1337.chat-gitops
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects 1 Releases 3 Wiki Activity
axion1337.chat-gitops/docs/deployment-guides/02-authentik-identity-provider.md
Scrublord MacBad 0ff598e8e0 Add documentation to wiki branch 
- Deployment guides for TURN, Authentik, Monitoring, Element, Policies
- Task tracking (TASKS.md)
- Element desktop setup scripts for all platforms
- Installation guide

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
2026-05-14 23:38:28 +02:00

1.6 KiB
Raw Permalink Blame History

Authentik als Identity Provider für Matrix

Status: ✅ Stage 1 Deployed (Authentik läuft)
Pending: Stage 2 (MAS Integration)
Domain: auth.axion1337.chat

Überblick

Authentik = OIDC Provider für MAS → Zentrales Login + Einladungs-basierte Registrierung.

Stage 1: Authentik Deployment

Dateien (in apps/authentik/):

  • namespace.yaml, helm-repo.yaml, authentik-secret.yaml (SOPS)
  • authentik.yaml (HelmRelease v2026.x + embedded Postgres)
  • certificate.yaml, ingress.yaml

Flux Kustomization: clusters/matrix/flux-system/authentik-sync.yaml

Deployment-Schritte

  1. DNS A-Record: auth.axion1337.chat → 49.13.132.245
  2. Pods hochfahren: kubectl get pods -n authentik -w
  3. Authentik UI: https://auth.axion1337.chat/if/flow/initial-setup/ → Admin-Passwort setzen
  4. OIDC Provider: Admin UI → OIDC Provider erstellen
  5. Application: Slug matrix (wichtig für Issuer URL!)
  6. Redirect URIs:
    • https://account.axion1337.chat/upstream/callback/01KQDJTR1ZVTG8JQ220F5BNBFZ
    • Post-logout: https://axion1337.chat
  7. Client ID + Secret kopieren

Stage 2: MAS Integration

  1. Decrypt: sops --decrypt --in-place apps/production/custom-configs/mas-secret.yaml
  2. upstream_oauth2_config + passwords-config Blöcke hinzufügen
  3. Encrypt: sops --encrypt --in-place ...
  4. Commit & Push
  5. WICHTIG: passwords: enabled: false erst nach OIDC-Test!

Einladungs-Links

Authentik Admin → Flows & Stages → Invitations → Create

Weitere Details: Siehe Kapitel 2 in diesem Projekt.