diff --git a/k8s/openclaw/cronjob-wiki-audit.secret.yaml b/k8s/openclaw/cronjob-wiki-audit.secret.yaml index b42db5c..8920b71 100644 Binary files a/k8s/openclaw/cronjob-wiki-audit.secret.yaml and b/k8s/openclaw/cronjob-wiki-audit.secret.yaml differ diff --git a/k8s/openclaw/silverbullet.secret.yaml b/k8s/openclaw/silverbullet.secret.yaml index 2cd44fa..3187e7e 100644 Binary files a/k8s/openclaw/silverbullet.secret.yaml and b/k8s/openclaw/silverbullet.secret.yaml differ diff --git a/knowledge-wiki b/knowledge-wiki index 4af9e15..073cb8f 160000 --- a/knowledge-wiki +++ b/knowledge-wiki @@ -1 +1 @@ -Subproject commit 4af9e1502acc00c0935e783ab31c3473279a9e40 +Subproject commit 073cb8fcb9efce32c2a4b16085732cc16c10933d diff --git a/terraform/authentik.tf b/terraform/authentik.tf index a7a935a..33e08d0 100644 --- a/terraform/authentik.tf +++ b/terraform/authentik.tf @@ -46,6 +46,17 @@ resource "authentik_group" "verein_mitglieder" { is_superuser = false } +data "authentik_user" "amy" { + username = "Amy" +} + +resource "authentik_group" "family" { + name = "family" + is_superuser = false + users = [data.authentik_user.amy.pk] +} + + # --- Flows: Authorization, Invalidation & Custom Invitation Flow --- data "authentik_flow" "default_authorization_flow" { @@ -740,6 +751,13 @@ resource "authentik_policy_binding" "silverbullet_admin_only" { order = 0 } +resource "authentik_policy_binding" "silverbullet_family" { + target = authentik_application.silverbullet.uuid + group = authentik_group.family.id + order = 1 +} + + # 2. Shared & Member Applications (Accessible to all authenticated users) resource "authentik_policy_binding" "grafana_users" { target = authentik_application.grafana.uuid diff --git a/terraform/terraform.tfstate b/terraform/terraform.tfstate index d732b0e..ad9cb66 100644 --- a/terraform/terraform.tfstate +++ b/terraform/terraform.tfstate @@ -1,7 +1,7 @@ { "version": 4, "terraform_version": "1.14.3", - "serial": 410, + "serial": 413, "lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e", "outputs": { "coder_oauth_client_secret": { @@ -197,6 +197,39 @@ } ] }, + { + "mode": "data", + "type": "authentik_user", + "name": "amy", + "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "attributes": "{\"settings\":{\"locale\":\"\"}}", + "avatar": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NHB4IiBoZWlnaHQ9IjY0cHgiIHZpZXdCb3g9IjAgMCA2NCA2NCIgdmVyc2lvbj0iMS4xIj48cmVjdCBmaWxsPSIjODgzNzllIiBjeD0iMzIiIGN5PSIzMiIgd2lkdGg9IjY0IiBoZWlnaHQ9IjY0IiByPSIzMiIvPjx0ZXh0IHg9IjUwJSIgeT0iNTAlIiBzdHlsZT0iY29sb3I6ICNmZmY7IGxpbmUtaGVpZ2h0OiAxOyBmb250LWZhbWlseTogJ1JlZEhhdFRleHQnLCdPdmVycGFzcycsb3ZlcnBhc3MsaGVsdmV0aWNhLGFyaWFsLHNhbnMtc2VyaWY7ICIgZmlsbD0iI2ZmZiIgYWxpZ25tZW50LWJhc2VsaW5lPSJtaWRkbGUiIGRvbWluYW50LWJhc2VsaW5lPSJtaWRkbGUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIGZvbnQtc2l6ZT0iMjgiIGZvbnQtd2VpZ2h0PSI0MDAiIGR5PSIuMWVtIj5BRzwvdGV4dD48L3N2Zz4=", + "date_joined": "2026-09-05T14:23:01.528947Z", + "email": "", + "groups": [ + "ad33b003-77a4-4571-bec8-8301f6d6552b" + ], + "id": "7", + "is_active": true, + "is_superuser": false, + "last_login": "2026-09-05T14:23:02.674777Z", + "name": "Amelie Graf", + "path": "users", + "pk": 7, + "type": "internal", + "uid": "771cd00470626adede1ffc8b70a4589a6778daf6de3280dfeaeaf11ae2aef8cf", + "username": "Amy", + "uuid": "bf49987e-864e-4b22-925b-e08bb8dc6cc9" + }, + "sensitive_attributes": [], + "identity_schema_version": 0 + } + ] + }, { "mode": "managed", "type": "authentik_application", @@ -692,7 +725,7 @@ { "schema_version": 0, "attributes": { - "backchannel_providers": null, + "backchannel_providers": [], "group": "", "id": "silverbullet", "meta_description": "", @@ -961,6 +994,34 @@ } ] }, + { + "mode": "managed", + "type": "authentik_group", + "name": "family", + "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "attributes": "{}", + "id": "5e91f468-a0f2-4433-aa23-a7b6ad69df38", + "is_superuser": false, + "name": "family", + "parents": null, + "roles": null, + "users": [ + 7 + ] + }, + "sensitive_attributes": [], + "identity_schema_version": 0, + "private": "bnVsbA==", + "dependencies": [ + "data.authentik_user.amy" + ] + } + ] + }, { "mode": "managed", "type": "authentik_group", @@ -1574,6 +1635,40 @@ } ] }, + { + "mode": "managed", + "type": "authentik_policy_binding", + "name": "silverbullet_family", + "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "enabled": true, + "failure_result": false, + "group": "5e91f468-a0f2-4433-aa23-a7b6ad69df38", + "id": "210387b6-770a-4ef6-8996-96aa9428e46b", + "negate": false, + "order": 1, + "policy": "", + "target": "7bae1695-db74-48e9-9d1e-be81025701be", + "timeout": 30, + "user": 0 + }, + "sensitive_attributes": [], + "identity_schema_version": 0, + "private": "bnVsbA==", + "dependencies": [ + "authentik_application.silverbullet", + "authentik_group.family", + "authentik_provider_proxy.silverbullet", + "data.authentik_flow.default_authorization_flow", + "data.authentik_flow.default_invalidation_flow", + "data.authentik_user.amy" + ] + } + ] + }, { "mode": "managed", "type": "authentik_policy_binding", @@ -2378,8 +2473,8 @@ "internal_host_ssl_validation": true, "invalidation_flow": "9add9e98-4fe7-48c5-bca8-d68968e0a7ba", "jwks_sources": null, - "jwt_federation_providers": null, - "jwt_federation_sources": null, + "jwt_federation_providers": [], + "jwt_federation_sources": [], "mode": "forward_single", "name": "SilverBullet", "property_mappings": null, diff --git a/terraform/terraform.tfstate.backup b/terraform/terraform.tfstate.backup index b96e49c..d732b0e 100644 --- a/terraform/terraform.tfstate.backup +++ b/terraform/terraform.tfstate.backup @@ -1,7 +1,7 @@ { "version": 4, "terraform_version": "1.14.3", - "serial": 405, + "serial": 410, "lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e", "outputs": { "coder_oauth_client_secret": { @@ -683,6 +683,41 @@ } ] }, + { + "mode": "managed", + "type": "authentik_application", + "name": "silverbullet", + "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "backchannel_providers": null, + "group": "", + "id": "silverbullet", + "meta_description": "", + "meta_hide": false, + "meta_icon": "", + "meta_launch_url": "", + "meta_publisher": "", + "name": "SilverBullet", + "open_in_new_tab": false, + "policy_engine_mode": "any", + "protocol_provider": 15, + "slug": "silverbullet", + "uuid": "7bae1695-db74-48e9-9d1e-be81025701be" + }, + "sensitive_attributes": [], + "identity_schema_version": 0, + "private": "bnVsbA==", + "dependencies": [ + "authentik_provider_proxy.silverbullet", + "data.authentik_flow.default_authorization_flow", + "data.authentik_flow.default_invalidation_flow" + ] + } + ] + }, { "mode": "managed", "type": "authentik_application", @@ -1021,7 +1056,8 @@ 2, 7, 3, - 10 + 10, + 15 ], "service_connection": "", "type": "proxy" @@ -1037,6 +1073,7 @@ "authentik_provider_proxy.nextcloud_phpmyadmin", "authentik_provider_proxy.openclaw", "authentik_provider_proxy.prometheus", + "authentik_provider_proxy.silverbullet", "authentik_provider_proxy.zigbee2mqtt", "data.authentik_flow.default_authorization_flow", "data.authentik_flow.default_invalidation_flow" @@ -1504,6 +1541,39 @@ } ] }, + { + "mode": "managed", + "type": "authentik_policy_binding", + "name": "silverbullet_admin_only", + "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "enabled": true, + "failure_result": false, + "group": "c0ad76f4-d157-4c9e-882c-9ae5b5fc1690", + "id": "b1c88c71-4abc-4fbe-8a0b-d9822b4c2984", + "negate": false, + "order": 0, + "policy": "", + "target": "7bae1695-db74-48e9-9d1e-be81025701be", + "timeout": 30, + "user": 0 + }, + "sensitive_attributes": [], + "identity_schema_version": 0, + "private": "bnVsbA==", + "dependencies": [ + "authentik_application.silverbullet", + "authentik_group.infra_admins", + "authentik_provider_proxy.silverbullet", + "data.authentik_flow.default_authorization_flow", + "data.authentik_flow.default_invalidation_flow" + ] + } + ] + }, { "mode": "managed", "type": "authentik_policy_binding", @@ -2284,6 +2354,48 @@ } ] }, + { + "mode": "managed", + "type": "authentik_provider_proxy", + "name": "silverbullet", + "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "access_token_validity": "minutes=10", + "authentication_flow": "", + "authorization_flow": "68f43818-60ba-4d8e-ae66-cbac29d7be42", + "basic_auth_enabled": false, + "basic_auth_password_attribute": "", + "basic_auth_username_attribute": "", + "client_id": "XKhBpWI0UUv7YnGsec2EzUzIsNy4nnDnxRUbBHV1", + "cookie_domain": "", + "external_host": "https://wiki.moritzgraf.de", + "id": "15", + "intercept_header_auth": true, + "internal_host": "", + "internal_host_ssl_validation": true, + "invalidation_flow": "9add9e98-4fe7-48c5-bca8-d68968e0a7ba", + "jwks_sources": null, + "jwt_federation_providers": null, + "jwt_federation_sources": null, + "mode": "forward_single", + "name": "SilverBullet", + "property_mappings": null, + "refresh_token_validity": "days=30", + "skip_path_regex": "" + }, + "sensitive_attributes": [], + "identity_schema_version": 0, + "private": "bnVsbA==", + "dependencies": [ + "data.authentik_flow.default_authorization_flow", + "data.authentik_flow.default_invalidation_flow" + ] + } + ] + }, { "mode": "managed", "type": "authentik_provider_proxy",