moritz/infrapuzzle
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(wiki): isolate silverbullet pvc, add pre-commit wall, family group, and audit alert

Browse Source
This commit is contained in:
Moritz Graf
2026-09-27 21:15:10 +02:00
parent b54b9fdb53
commit 41df233840
6 changed files with 232 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/openclaw/cronjob-wiki-audit.secret.yaml
BIN
View File
Binary file not shown.
k8s/openclaw/silverbullet.secret.yaml
BIN
View File
Binary file not shown.
knowledge-wiki
+1 -1
Submodule knowledge-wiki updated: 4af9e1502a...073cb8fcb9
terraform/authentik.tf
+18
View File
@@ -46,6 +46,17 @@ resource "authentik_group" "verein_mitglieder" {
is_superuser = false
}
data "authentik_user" "amy" {
username = "Amy"
}
resource "authentik_group" "family" {
name = "family"
is_superuser = false
users = [data.authentik_user.amy.pk]
}
# --- Flows: Authorization, Invalidation & Custom Invitation Flow ---
data "authentik_flow" "default_authorization_flow" {
@@ -740,6 +751,13 @@ resource "authentik_policy_binding" "silverbullet_admin_only" {
order = 0
}
resource "authentik_policy_binding" "silverbullet_family" {
target = authentik_application.silverbullet.uuid
group = authentik_group.family.id
order = 1
}
# 2. Shared & Member Applications (Accessible to all authenticated users)
resource "authentik_policy_binding" "grafana_users" {
target = authentik_application.grafana.uuid
terraform/terraform.tfstate
+99 -4
View File
@@ -1,7 +1,7 @@
{
"version": 4,
"terraform_version": "1.14.3",
"serial": 410,
"serial": 413,
"lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e",
"outputs": {
"coder_oauth_client_secret": {
@@ -197,6 +197,39 @@
}
]
},
{
"mode": "data",
"type": "authentik_user",
"name": "amy",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"attributes": "{\"settings\":{\"locale\":\"\"}}",
"avatar": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NHB4IiBoZWlnaHQ9IjY0cHgiIHZpZXdCb3g9IjAgMCA2NCA2NCIgdmVyc2lvbj0iMS4xIj48cmVjdCBmaWxsPSIjODgzNzllIiBjeD0iMzIiIGN5PSIzMiIgd2lkdGg9IjY0IiBoZWlnaHQ9IjY0IiByPSIzMiIvPjx0ZXh0IHg9IjUwJSIgeT0iNTAlIiBzdHlsZT0iY29sb3I6ICNmZmY7IGxpbmUtaGVpZ2h0OiAxOyBmb250LWZhbWlseTogJ1JlZEhhdFRleHQnLCdPdmVycGFzcycsb3ZlcnBhc3MsaGVsdmV0aWNhLGFyaWFsLHNhbnMtc2VyaWY7ICIgZmlsbD0iI2ZmZiIgYWxpZ25tZW50LWJhc2VsaW5lPSJtaWRkbGUiIGRvbWluYW50LWJhc2VsaW5lPSJtaWRkbGUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIGZvbnQtc2l6ZT0iMjgiIGZvbnQtd2VpZ2h0PSI0MDAiIGR5PSIuMWVtIj5BRzwvdGV4dD48L3N2Zz4=",
"date_joined": "2026-09-05T14:23:01.528947Z",
"email": "",
"groups": [
"ad33b003-77a4-4571-bec8-8301f6d6552b"
],
"id": "7",
"is_active": true,
"is_superuser": false,
"last_login": "2026-09-05T14:23:02.674777Z",
"name": "Amelie Graf",
"path": "users",
"pk": 7,
"type": "internal",
"uid": "771cd00470626adede1ffc8b70a4589a6778daf6de3280dfeaeaf11ae2aef8cf",
"username": "Amy",
"uuid": "bf49987e-864e-4b22-925b-e08bb8dc6cc9"
},
"sensitive_attributes": [],
"identity_schema_version": 0
}
]
},
{
"mode": "managed",
"type": "authentik_application",
@@ -692,7 +725,7 @@
{
"schema_version": 0,
"attributes": {
"backchannel_providers": null,
"backchannel_providers": [],
"group": "",
"id": "silverbullet",
"meta_description": "",
@@ -961,6 +994,34 @@
}
]
},
{
"mode": "managed",
"type": "authentik_group",
"name": "family",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"attributes": "{}",
"id": "5e91f468-a0f2-4433-aa23-a7b6ad69df38",
"is_superuser": false,
"name": "family",
"parents": null,
"roles": null,
"users": [
7
]
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"data.authentik_user.amy"
]
}
]
},
{
"mode": "managed",
"type": "authentik_group",
@@ -1574,6 +1635,40 @@
}
]
},
{
"mode": "managed",
"type": "authentik_policy_binding",
"name": "silverbullet_family",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"enabled": true,
"failure_result": false,
"group": "5e91f468-a0f2-4433-aa23-a7b6ad69df38",
"id": "210387b6-770a-4ef6-8996-96aa9428e46b",
"negate": false,
"order": 1,
"policy": "",
"target": "7bae1695-db74-48e9-9d1e-be81025701be",
"timeout": 30,
"user": 0
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"authentik_application.silverbullet",
"authentik_group.family",
"authentik_provider_proxy.silverbullet",
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow",
"data.authentik_user.amy"
]
}
]
},
{
"mode": "managed",
"type": "authentik_policy_binding",
@@ -2378,8 +2473,8 @@
"internal_host_ssl_validation": true,
"invalidation_flow": "9add9e98-4fe7-48c5-bca8-d68968e0a7ba",
"jwks_sources": null,
"jwt_federation_providers": null,
"jwt_federation_sources": null,
"jwt_federation_providers": [],
"jwt_federation_sources": [],
"mode": "forward_single",
"name": "SilverBullet",
"property_mappings": null,
terraform/terraform.tfstate.backup
+114 -2
View File
@@ -1,7 +1,7 @@
{
"version": 4,
"terraform_version": "1.14.3",
"serial": 405,
"serial": 410,
"lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e",
"outputs": {
"coder_oauth_client_secret": {
@@ -683,6 +683,41 @@
}
]
},
{
"mode": "managed",
"type": "authentik_application",
"name": "silverbullet",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"backchannel_providers": null,
"group": "",
"id": "silverbullet",
"meta_description": "",
"meta_hide": false,
"meta_icon": "",
"meta_launch_url": "",
"meta_publisher": "",
"name": "SilverBullet",
"open_in_new_tab": false,
"policy_engine_mode": "any",
"protocol_provider": 15,
"slug": "silverbullet",
"uuid": "7bae1695-db74-48e9-9d1e-be81025701be"
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"authentik_provider_proxy.silverbullet",
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow"
]
}
]
},
{
"mode": "managed",
"type": "authentik_application",
@@ -1021,7 +1056,8 @@
2,
7,
3,
10
10,
15
],
"service_connection": "",
"type": "proxy"
@@ -1037,6 +1073,7 @@
"authentik_provider_proxy.nextcloud_phpmyadmin",
"authentik_provider_proxy.openclaw",
"authentik_provider_proxy.prometheus",
"authentik_provider_proxy.silverbullet",
"authentik_provider_proxy.zigbee2mqtt",
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow"
@@ -1504,6 +1541,39 @@
}
]
},
{
"mode": "managed",
"type": "authentik_policy_binding",
"name": "silverbullet_admin_only",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"enabled": true,
"failure_result": false,
"group": "c0ad76f4-d157-4c9e-882c-9ae5b5fc1690",
"id": "b1c88c71-4abc-4fbe-8a0b-d9822b4c2984",
"negate": false,
"order": 0,
"policy": "",
"target": "7bae1695-db74-48e9-9d1e-be81025701be",
"timeout": 30,
"user": 0
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"authentik_application.silverbullet",
"authentik_group.infra_admins",
"authentik_provider_proxy.silverbullet",
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow"
]
}
]
},
{
"mode": "managed",
"type": "authentik_policy_binding",
@@ -2284,6 +2354,48 @@
}
]
},
{
"mode": "managed",
"type": "authentik_provider_proxy",
"name": "silverbullet",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"access_token_validity": "minutes=10",
"authentication_flow": "",
"authorization_flow": "68f43818-60ba-4d8e-ae66-cbac29d7be42",
"basic_auth_enabled": false,
"basic_auth_password_attribute": "",
"basic_auth_username_attribute": "",
"client_id": "XKhBpWI0UUv7YnGsec2EzUzIsNy4nnDnxRUbBHV1",
"cookie_domain": "",
"external_host": "https://wiki.moritzgraf.de",
"id": "15",
"intercept_header_auth": true,
"internal_host": "",
"internal_host_ssl_validation": true,
"invalidation_flow": "9add9e98-4fe7-48c5-bca8-d68968e0a7ba",
"jwks_sources": null,
"jwt_federation_providers": null,
"jwt_federation_sources": null,
"mode": "forward_single",
"name": "SilverBullet",
"property_mappings": null,
"refresh_token_validity": "days=30",
"skip_path_regex": ""
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow"
]
}
]
},
{
"mode": "managed",
"type": "authentik_provider_proxy",