Thore CimbalandClaude Sonnet 5
c52ff97502
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
Closes issue #36. The OAuth2 Provider ("Matrix Authentication Service") and its Application ("matrix" slug) linking Authentik to MAS were originally clicked together by hand in the UI and existed nowhere as code - unlike the flow fixes already captured in authentik-blueprints.yaml. Losing the Authentik DB would have meant re-creating this from scratch, including a fresh client_secret that MAS would no longer match. The client_secret is read via !Env from AUTHENTIK_MAS_OIDC_CLIENT_SECRET, sourced from a new key in the existing SOPS-encrypted authentik-credentials Secret, rather than inlined into the blueprint ConfigMap (which isn't itself encrypted). Value used is the actual live secret already in use, read directly from the running Authentik DB - not a new/rotated one, so this changes nothing about the current MAS<->Authentik pairing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>