sorb/axion1337.chat-gitops
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects 1 Releases 3 Wiki Activity
axion1337.chat-gitops/docs/deployment-guides/02-authentik-identity-provider.md
Scrublord MacBad aee9a34369 Add 5 detailed deployment guides to docs/deployment-guides/ 
- 01-turn-server-setup.md: TURN Server architecture, deployment, verification
- 02-authentik-identity-provider.md: Two-stage OIDC integration (Stage 1 & Stage 2)
- 03-monitoring-integration.md: Alloy, Prometheus, Loki integration with Selendis
- 04-element-customization.md: Custom themes (7), desktop setup scripts, admin panel
- 05-room-policies.md: Message retention, room publication, auto-join policies

All guides include troubleshooting, configuration examples, and best practices.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
2026-05-14 22:47:38 +02:00

1.6 KiB
Raw Blame History

Authentik als Identity Provider für Matrix

Status: ✅ Stage 1 Deployed (Authentik läuft)
Pending: Stage 2 (MAS Integration)
Domain: auth.axion1337.chat

Überblick

Authentik = OIDC Provider für MAS → Zentrales Login + Einladungs-basierte Registrierung.

Stage 1: Authentik Deployment

Dateien (in apps/authentik/):

  • namespace.yaml, helm-repo.yaml, authentik-secret.yaml (SOPS)
  • authentik.yaml (HelmRelease v2026.x + embedded Postgres)
  • certificate.yaml, ingress.yaml

Flux Kustomization: clusters/matrix/flux-system/authentik-sync.yaml

Deployment-Schritte

  1. DNS A-Record: auth.axion1337.chat → 49.13.132.245
  2. Pods hochfahren: kubectl get pods -n authentik -w
  3. Authentik UI: https://auth.axion1337.chat/if/flow/initial-setup/ → Admin-Passwort setzen
  4. OIDC Provider: Admin UI → OIDC Provider erstellen
  5. Application: Slug matrix (wichtig für Issuer URL!)
  6. Redirect URIs:
    • https://account.axion1337.chat/upstream/callback/01KQDJTR1ZVTG8JQ220F5BNBFZ
    • Post-logout: https://axion1337.chat
  7. Client ID + Secret kopieren

Stage 2: MAS Integration

  1. Decrypt: sops --decrypt --in-place apps/production/custom-configs/mas-secret.yaml
  2. upstream_oauth2_config + passwords-config Blöcke hinzufügen
  3. Encrypt: sops --encrypt --in-place ...
  4. Commit & Push
  5. WICHTIG: passwords: enabled: false erst nach OIDC-Test!

Einladungs-Links

Authentik Admin → Flows & Stages → Invitations → Create

Weitere Details: Siehe Kapitel 2 in diesem Projekt.