axion1337.chat-gitops/apps/authentik/authentik-blueprints.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: authentik-blueprints
  namespace: authentik
data:
  matrix-invitation-flow.yaml: |
    # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
    version: 1
    metadata:
      name: matrix-invitation-flow
      labels:
        blueprints.goauthentik.io/instantiate: "true"
    entries:
      # Reaffirm the flow itself (already created manually; matched by slug)
      - model: authentik_flows.flow
        state: present
        identifiers:
          slug: matrix-invitation
        id: matrix_invitation_flow
        attrs:
          name: matrix-invitation
          title: matrix-invitation
          designation: enrollment

      # The prompt stage had accumulated 16 unrelated system validation_policies
      # (e.g. default-user-settings-authorization, default-oobe-password-usable)
      # from manual UI setup, likely a "select all" slip in the policy picker.
      # These crash on an anonymous enrollment context ('AnonymousUser' object
      # has no attribute 'group_attributes', etc). A prompt stage needs none here.
      - model: authentik_stages_prompt.promptstage
        state: present
        identifiers:
          name: matrix-invitation-prompt
        attrs:
          validation_policies: []

      # Correct stage chain, mirroring the working matrix-enrollment flow:
      # Invite -> Prompt (username/email/password) -> Write -> Password -> Login
      # Root cause of the original bug: only Invite+Prompt were bound, both at
      # order=0, so the flow never wrote the user to the DB or logged them in.
      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !KeyOf matrix_invitation_flow
          order: 0
        attrs:
          stage: !Find [authentik_stages_invitation.invitationstage, [name, matrix-enrollment-invitation]]

      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !KeyOf matrix_invitation_flow
          order: 1
        attrs:
          stage: !Find [authentik_stages_prompt.promptstage, [name, matrix-invitation-prompt]]

      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !KeyOf matrix_invitation_flow
          order: 2
        attrs:
          stage: !Find [authentik_stages_user_write.userwritestage, [name, default-source-enrollment-write]]

      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !KeyOf matrix_invitation_flow
          order: 3
        attrs:
          stage: !Find [authentik_stages_password.passwordstage, [name, default-authentication-password]]

      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !KeyOf matrix_invitation_flow
          order: 4
        attrs:
          stage: !Find [authentik_stages_user_login.userloginstage, [name, default-source-enrollment-login]]

      # Without an explicit destination, the flow falls back to Authentik's own
      # /if/user/ dashboard, which refuses type=external users ("Die Oberflaeche
      # kann nur von internen Nutzern geoeffnet werden") - exactly the user type
      # these Matrix-only accounts correctly have. Send them to Element instead.
      - model: authentik_stages_redirect.redirectstage
        state: present
        identifiers:
          name: matrix-invitation-redirect
        id: matrix_invitation_redirect_stage
        attrs:
          mode: static
          target_static: https://axion1337.chat

      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !KeyOf matrix_invitation_flow
          order: 5
        attrs:
          stage: !KeyOf matrix_invitation_redirect_stage
  matrix-recovery-flow.yaml: |
    # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
    version: 1
    metadata:
      name: matrix-recovery-flow
      labels:
        blueprints.goauthentik.io/instantiate: "true"
    entries:
      # matrix-recovery existed but had zero stage bindings (dead flow), and the
      # real login flow (default-authentication-flow, used by the MAS OAuth2
      # provider's authentication_flow) didn't link to it at all - no "Forgot
      # password?" link was ever shown. Reuses the same default-recovery-*
      # stages the built-in default-recovery-flow already uses successfully,
      # plus our own redirect stage instead of falling back to the authentik
      # dashboard (blocked for type=external Matrix users).
      - model: authentik_flows.flow
        state: present
        identifiers:
          slug: matrix-recovery
        id: matrix_recovery_flow
        attrs:
          designation: recovery

      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !KeyOf matrix_recovery_flow
          order: 10
        attrs:
          stage: !Find [authentik_stages_identification.identificationstage, [name, default-recovery-identification]]

      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !KeyOf matrix_recovery_flow
          order: 20
        attrs:
          stage: !Find [authentik_stages_email.emailstage, [name, default-recovery-email]]

      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !KeyOf matrix_recovery_flow
          order: 30
        attrs:
          stage: !Find [authentik_stages_prompt.promptstage, [name, "Change your password"]]

      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !KeyOf matrix_recovery_flow
          order: 40
        attrs:
          stage: !Find [authentik_stages_user_write.userwritestage, [name, default-recovery-user-write]]

      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !KeyOf matrix_recovery_flow
          order: 100
        attrs:
          stage: !Find [authentik_stages_user_login.userloginstage, [name, default-recovery-user-login]]

      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !KeyOf matrix_recovery_flow
          order: 110
        attrs:
          stage: !Find [authentik_stages_redirect.redirectstage, [name, matrix-invitation-redirect]]

      # Wire the "Forgot password?" link on the real login flow used by MAS
      - model: authentik_stages_identification.identificationstage
        state: present
        identifiers:
          name: default-authentication-identification
        attrs:
          recovery_flow: !KeyOf matrix_recovery_flow