From 41df233840c79e3d66a4259a796ce6f993fe17a3 Mon Sep 17 00:00:00 2001 From: Moritz Graf Date: Sun, 27 Sep 2026 21:15:10 +0200 Subject: [PATCH] feat(wiki): isolate silverbullet pvc, add pre-commit wall, family group, and audit alert --- k8s/openclaw/cronjob-wiki-audit.secret.yaml | Bin 3349 -> 4151 bytes k8s/openclaw/silverbullet.secret.yaml | Bin 4104 -> 6711 bytes knowledge-wiki | 2 +- terraform/authentik.tf | 18 +++ terraform/terraform.tfstate | 103 ++++++++++++++++- terraform/terraform.tfstate.backup | 116 +++++++++++++++++++- 6 files changed, 232 insertions(+), 7 deletions(-) diff --git a/k8s/openclaw/cronjob-wiki-audit.secret.yaml b/k8s/openclaw/cronjob-wiki-audit.secret.yaml index b42db5c04e64663f76f72aafaaa51ce8159b177d..8920b711b154e216c2bcf7dbaf5c4dfaa492afcf 100644 GIT binary patch literal 4151 zcmV-75XkQUM@dveQdv+`0D@yW4sN3+pX}uJbrsVzaw7C=nYC47=02UbvMMF81~i!R zX9=}wx|1=Vu=(CFQ?gPOIMORnK7R360Dbl2ssSAzLg1ua0J_Gr5%MYn0L>YPw>731 zE0tQk@V8b_iEa@Tg@z`yf(cyx%ri~D`xbf~_|*oeD4MJx{Ll0Np&|NTf>g1GkcrWH z76|u|GR#{j>W6)$ZiY;_ng}ij#W@yIB$3~LI(pDLp(eqheQLOLiis3Qi5rdq1?~>; zZB6nB|r!)l*g!9pYv?t0VeWb=~7w~(TUs1GFoJAWuP`R%oh7yM;R z#4IheHiZQ(VKf%~cfrLcGQ2p}Ht2=mf}&q#mGf(0@#zUMT@K|_@PSRGefA#4YbIqDBr6i-Z%Ai{+u zuSUUKA=a2+lfdlTKqtZ6?;t*VbB-RX1%Mo|OG>&x@?qI7UgVn09XrZU-n_k3Q&_TN zAhDzB>y+9!S()y$;i6`k7v*=GqX~erEJ!c26lqw7Zvw<_HPbr;N4McsB&uhzZMu zrsY50ygNF<+iSQ`AqduE^gmb#jb#DFhA7M-Dl3dSw1p9dKlPaBPE_smbMykU7 zwHd&T0?+xc6}p-&MN0nDu-h%Kz;Qko(V#IDz{5JpDS6qio$%W=>3!*z9Cn|;b0fpS z0r9#kJ5STw%-(+hLKdfEplpa>&FVuZ#j1bVadCM0w{<>nkRHe}F-v_p@-?dzv)-2P z8*>x=_OAjnMFjE@Qai}+BQ%0#d~5qmKU?($D zC9S!)7Ni&1>3br;JR(8eL0(|YgnOo^hr#T{DjTy=!XK8{HQy$afjAI_q|b$Yl($Kq zxL_uUwRHry2aj{$KspBmD^;>`TRUWSA=g1*uZKmI8hdbod%|sLBka7{L^tHl_j4^_ zAn*allcti0z_e!Kh9js7-Rgj|@Z)ilcZz56^Cr{vz92I1@~a;oJIL=YYbh>)1!=xW zU4T-ruYPs2e+DE|aQK+hsjyDELdAv^>McmIr_#-x%HhLXOiCggX{RAK+UWx(4q*~p zqRC>Ce1c%BKK93f!^cFo42OrwMVRa~W{oQd@xfQ1)vvpg`d;@tHknvZUzyF?&Yr2f zM%^^q%8-8{NV{G&%m=0jmOQa}kkx%s!s@wM5VigOkJ;v7r2rDhckcf{Cn$WAvJ-d= z6yBrs{k*Wuiy|qDW5KDW_Fla8UC+Z3co*W}^BsFHYS-2-&MI3Hf^qT7?MBqiDUY+* z);{<)WnZtqLjFGc1jXE$M=JP0giBQ-aFEeIZ6Q*h*t9@vn{_H!&<7)w3lMQV&D%Y# zmOgW?3KsN*2CrBe^B+6(T+x#88CQ{)sr2NiJ(tiPJR!W)CLCEU-_$Ku1Xg&Cz(DrE zYjTyT>TnADriQy_!SM$pRxShnz=2|OF5&@B*#F)P5E%bWa6lHnXtT-rMl|MgKCm%asFF<#SJPM`~nkr&602U zoQM_zeoat_7rSAwEXM2WAw5ZwO3WCjD?q`%S!cbEQ}p=Y1n8`sHc#@qexjH?5RAXx z50Tjz4Av@6W0k+GJ1BNv@=YP)P^t_n6tJf-+S)o?vHPBaCohQUnW z&1lfpr0ie{q*orX`lKbwX%c*BxI{J`p7IHWUmdYJW49B!_njD-+y-#y_J1n}#egwJ zuN}s7%d?CigWZiDTWMqSteD<=Uv^9^87_~52vvC3uFI^`QP}nC8@iyM#|3fm zkqk5XnP&U+#HE}lumF`bM70I@5O*z)`S{-dLD%buhuPFhX?xugB(Xji=nJKU%JL~n zuSoh(y8+X;B0A^8cR-w`U--s!II7D~uMabmRXAoV0^W z*k6YJ+alG=)i3q!IVW5Wo0tUxe>**;Tn*a>LfdAUw#v`47*SGGG-=`@_gQJ@nSZGc zMK<@DwcSPU?OCGzSFpBjsD+J9WRd(}25%szN~Gddg)j`r&S1dq(libIv<1t(ccFS1 zCO%!+EQAI1W$$$>N3JGF-GaDL?PA1oYBrSN(AdUdSitiG{l4dwz0lG#CX*Q-`?lW4 zyQzJ`9_P#Tls_!C&Ra9lJnG~b%(q*6N^-WV#~|yN8Gtcyv$m!beZOA_{vD+{5E)>c z+?r1HK`qr)R3eICxJ_f*e-o(JfCIaBOs;0#QSKF76oTrOvlwE5XS&)ep6NC}X?3$1 zsa)n?@Qt*K#VQ_G@hGLPd2b`X+DTNjiYswlHX-Se zZ_8SWztQ3+F?@o|DizZ{q!itsbL^v2+(xd3mZ{Tw3Kp=<-Uk3e#&DkK#qs-Qf1D^& z-ITPhH0Fx#MlLJDMS_MD?PN@69hGk_L~ypJE)pHUfSejac(%vYgJ&X1i^eT{zguys zmOaiE2N<(2-YYyLx9wP&liejrQtGX2M&`YTTI9?l|ICm>ltT$ z8N)l(EAfayW8uY#5?LGS*ya=VB~j(1gN1RDY4=nxWZx+r!w6Y0x!Wx%BLtVU-eb@< z)(CPg{nr+~i&A&|Rs#v{MGFqSRBQNQ@J?!}gQR!;GTRgV)Ja}~5&|EFN;zXGXUpp0 zptBq-<@@~oKim1H)5BBd{K-eNRmB{qxiDC6cy>%<5%2ZICTZ0vAO)S&r9yT5(a;iF z{o)KabAn^iBH168IO)%lZ;`65fd~9vchg6oz|h@XL|c;!vY0}dSf$eygS+)7*3KKX zf%QUD8mDD;PKYfCYY6)4mi_#(eVmhQI=?nNda8Z5r@}BuyUSjWT#Fgk26?%T(*>@5 zorOJ#j(=%RnC>DUQK)Fv<>h|w>C>p!)!a`d%8Y0Fc)$;F?)1K2$!=^e(OCi~ev6Mp zyT* zm;tpV5K*Cuv_CWiQot-Y@c2t!gHrg#N5>4#>fN2MFp12vI7S>K!rdc)-PUGs}B z(LHHH=mh~dQsBSJ#XA1A5LdEel>sstjCn#D)SJgEUlU48knGDj+6fu?MF%?q!_gQ` zb%#e=3*GMDsVt%}y$J|%##U9_Z~U&#VEG0u$fdOCd)@*erF43qR!`@5c|rMMvsW_= zL)-#l#s%$AtBDmbNL+)=lF%*)GdOFogX!o3VCrbK?+OMm;T_0(scXwhkdVZIgdi3S zKai&Y-b|RZL?CZE@tZn=;_`lp-HIsiH*|{sC(h4ueUVU5${+Bu2FBOA7m47bj5l%D zJf3P{NxTnD_%LrOcw5K?_0AU-@kZA)JwnzwST(KxtyI$17SMh|$Ow>~@HvkqTZTu!cxTpjPLhEB0Wh*4Nu`*;MzDFX{YP z-f7#OoiwCjAnh*6Ukl8&iQ`P61`XmTMxmX2%J2~016Lh3E3fA>4779%TD(|411V{M zSWET$%~Hx$?+zC3!QCMw9_TE8Y!Cvz9s64RK{moAq_KD)XGeKjZd@sK(TamO_^ml= zIRMN$9EX4R*LhAbC{1z2!-NnU;EqQ$$AAp-jS#g|Yn!>F_P*i%CY{e2P*;Q6y`@Og zCReKuqp5poQ7^wS$B}$3M>=dN$ELHMO89O5$a;&^${m zvwR-=s*g@}lD=F?5y@l3RJ`3;xn%rbTm%M#T==J)c?f#X(|U_kte7>C$;s}4}= zn`qRiSRqI#Z9q0aN0aT65sQRHOfy)Af^)HxU53Yqt%jc@DGdew%THXEv2m9XMtOa& z-{nW4vaY68hY!0KwcLx)FO31>80#QBNqO^13=@ZQb~x+T@+iEg)t*i^UFNefTwvA0 B8ngfa literal 3349 zcmV+w4eIg$M@dveQdv+`05It^!+`#r-49qxtwjzX7#s?Melv*jU$%-fuUJ#)z{u)t z9joU}zB7^2Ih|zSH|o3FCD;`Nl77Q3|2Kz6C>(2{ooME|s_nIuk2Ex{c3<_N-={0Q zYR92_14$XX$^QC$N8?l!p4|_t*OSG45a~RFC4FHFjc~6 z$giJ0d{111#%y4o(SIeZTGQJ23?CSGKa1Wp)jgE(T&Aqv^Vrl3>WFsV)CQ%Z3cJT9 zPdB<&?Q%Gg9HRC(Q*SgHSYCBzg->CCcQE0>W@7I$QdZMMVPkr3<$R&1gjb1iGq>0S zE|6!cN)QsY2zX*kv|yJgE0$|Bs-|}G@=|@Kxt%&G^jO-qxSf*ur7bL!>Juz*<2>iU z2Vf{Zl=7ZWksNY5(f`SaswE|uExTOowPS+q74OGrQKa75^44`Cp7CVMnB_CpIUEa) z3$RLXBbTzNdD%1u{s!6oxq`|Y2p#sOe;Pb zjfM!ia7A0@Eq8;=)i=C>X>&2D)!7HLa%>Abz$-t?P`ws$C>oK8)@l@4x;8nqY&iQ}(YS%&Ao4}9C3heBmv%#W&=vp-B4n0`^)II@H6XN z;#EIl&>grEZ42h2>xd-U;<2Q7$_ow8em!@`ewrMj=mPWRm;I;!kn2I|ew}KJ*hEBO z#MJ}>8;FigAP1SJCYeVR`GwXVMCJOBv)yFz>}acA!nAbdIlIMZl3?H80$F zZ=UymXR;2Q!{OKYyvO*(PVMImi$PCkyg|1Nf}k+-O~MuXQ<5{+39Rvp83~%(<`rr- zY^0=U{%NWRlU^i+m4IWVuw|Aasg~x@J(C>1qm%FD<8JQ^((9}1jHUF4SrD$GCI^ET zu4v*DJ%)zexR3>pCkpzt8)Kb?3A&TQOqZfhbQ5MgHe0>M=t4ZUDQ9BEC1*o-MSN;x z8n>W^dMLIA&4uN!9S%*dH48UXta^sycnzs%$>LgC+#!tuoSweI;`qz1Hn=BVDP%h* zxO6NF@WTze7`C=mXeo~>uq1=Vh1A(W#G4HNWUvHCQyJKzF~;*k`SvY45%9F6aMtU64V_Wf~O#wzR`v$NdFniYoE zN*Z&p_T;TxE&44OV->(zLoF7q?C-+WsFPwWcB%olIOWVqN9EV6ZgX46DV^Y z)8Y{4*tWg|B>ozPNS{~rBvVAx4bOT8g3| zeda0+RaG5o`pEM2zOpQt4)3uc z51o+HnqhjxH2A33{IFNjfb3NI?61<8@u$9cu&|Zw!v+_>IkNe7 zmD^Ap)W4k?0YxSH2nHa ztK=nPfuK^MOcw1~&z_GM^Nl=*(x0MtNEk|w@0U&g^~cU|LjXpr^RZY3czC`e9?NW6 zt~*rrrbl>H41`gwmP04-L&AxDrKcrpV#Sg;X&cwBdIf1Kr?r$9&0Md-nP?e|x$$6r zCBc80ns7=zloJ|4MzEOBZ9YWsNSZ+mGRd`i@YS~0JQ7ld%C)xE=9GV$!K8Yca?`@K z`Hbc#9+HVHL?MT&%W{X&sOoy4+W_}i{B)Cl0*OQMrF+g_QY0Y)>#~`W3&X`kas7R;h|byl0x5mMzVb9mcBxh7w#aJwNe9!9z3bX_VkAh&Yyq&(WxX zP#PL}-jgk`na&!d?I*4qTV4mwhAg)Kl6MElbK zy4wG=l6<7PmdyEfBddo$<-UfebU4$3qepzlSSDmWKs^kEnGS(LA4Fz-rb42u9nIP=c+1 zh>Y;oDl~~EO*h-e5kVclMG^b0z}s&JlXG&)yj?rj8tq+2z4X7o>`$$s$L&j$C07&C z$D#DeXvonOTM8Ph&DU)WJCqt4Fh)?I3Nl^sM5VDwHJMwr^?p27cBNOMlo^rg{*WlL ztdLaA$1@KG>M`;IY_aqpB)vIVNt|UU0SqvuU;P zaRJTmWMlko)?gJ^co;tr_WRQ6G|j8!aNwVPZ799h+aZxF;J)#b!FN^fhdCmB=(jqu zku=*EjD55Ejcol4G2sC4bXl6>|4+1+7j>)WYJ^YL$b<5*a{blT^AWG@B5LA9$}3T* z>JfWs_gi)pviVa*uH#ZMMl^mEJJhUZ#&K$^)ywKkmsNAG)yknUWu@t3f>*bEhaqGH z`~LSdo~&B(Xf{c1s`(AJvuH2^Mqr_pWJOr}1~%ya@W7mq{pUw>&S#%5aFOA=zNU+ou2XI&-Cqs{ z%_lWxe&HLcqB?rW^dxvg*LXQJX)HR8Yb`mLu7t-aqRy}1QyEZzQFv} zyY^sOf!J`AZK!9|9Sc+e^Bz>4YmrS`235$0^1VEw8-x)81oig1DuFM0^T&)x@+iRD zt$GoD^XJi`aBp;Gf&kmcq7DJ4=}(k~wky0$#1AWm_3d(ky}#8;V$7_(Qv8wDhXtXz fx*@#<+ko2m?>-W6|IJtitcC(E^>WfPUw;FlzA~@G diff --git a/k8s/openclaw/silverbullet.secret.yaml b/k8s/openclaw/silverbullet.secret.yaml index 2cd44fafc7e998a9a3be2aa44e3719d7784b1571..3187e7e28bb039cecf1b3a6364094a411bb345c0 100644 GIT binary patch literal 6711 zcmV-78p!1UM@dveQdv+`0Kupmj>6#@`L~YyEWP}+E3pkDp7*RQ!YK5SLnsjPI(IeS zqne#W^(YjY@Car0RWdSqFowE&%{z_BU^;Vknnt3@eENr?wM|PO9y)e32=8+2FU>}J6>{dn48E|ICxTa~2O~|N zlu*JV1Ifk`OZGw`0wUwoNj-++n9t=0IOGJ;uCDF!tf;>}w}WpS((r`#iZ`@Q`EOUp z4?`CfhzY8&8#&s4f!&2g+*k)mvysLWQmbuBpSRF9+gkh>uF1}4v>b<-AJK7EmI2H#k}V7x^nm>Dv6XZ;47 z!9|~zC5SVBLC7W$h@~!(-1Nmq;`CdmzNtUPEA2g&!06+X2vrgDW8`+zwsIH$kgyxm zR9o6xWTLZN%3)M`yLw^Qv@SN4$(a{N-hnxO4nMUSFO-5@-4sJlOGQg&_g=m%Vo$g2 zeN4zB6{qpo!KIa~&GJg#*rydN}#r^EGd+kE1VgTzps{7YY7yMYa}IM|NVKdmKwOdI042pEk4;#bEpU* zp=;pb4~DF_)b#+u_Wn4Di|z+r0_F;+$VR>uZ#~S$ESbEAwm+QvZDd-uO(pG15Bg&Tbv6)!=hzh*B~U-jwH3+q{ImueJ_vJ|IJ+Xhb(X zqi*`p&#pVwhkv?I>|cIE(mB>E&&Di5F86pzSYqm+qlr&e4{<)zN2^-poy1!(czI;p?4fX5ntKvBXz2t@51*qA(R>rY3HU%3 zgpy-`&A%I#Ft|TuR>!xkpwXQ0?IlC$Md=Mlr`zN@ny)`)M58ka`DbnVSr`2xUqX%| zCDp0UbC+yUCz~1OY%<8m3$dBDCRGA{0|R0g()+Wv5p=dG#jHel0+>Dqaa zyIUU(t(3+D)m<}=L5KQpf@5JrDh>wXi6HGq;J|CHeucb5uHjavFX8M7VK>^LXy3Fv zG^~C~pR)-U4E{L^fVpT-83J`}4JZbv7Mtq~ObNJ53J>JV?+o_Cn`7$PR4Hsc@DmG- z*^8PtD^UfYHg2(hUgE)nQRv!PuT0ZCF!hlH0Z+Er|X|KlCcjVf1iOw zTH4H^n1G%)V7uaFbXJJ;dbUTQHBL!UG)BPfR6fNfY$Ww_OzRs|0wtDH-Bl>tYK?*X z#1vfH)3tcC&2Cp2=@pXvY+OD|ZnY`(-oV9+IeGt6ZvX@a)WT{1Nez45FX@V&vlN1xLyD+FQ8F6cG?Sg# zKxSSLIaBbcO)vzFt$01#bMbj4Nz#Jao&_6k5>mPH!yWA?-z^dl9%qHGf?;cJKpXT~ zYY>PKJ?c)j7z+a)WAU=k-U!GiaCQgbW69}H7eSC4BtxNw5B(H_R${x<1orQmFSmZ` zZ(W}OA$XE6B5X+J2IKuwZr1lu`-vk7T3yDVk+#f;mKmk#&AMlYl~JFVCHxM2y#96h zH8)N-5_!TuakfIAmI_QrVN^h6%P-RH(_c2kBMo}}3vnXYs&3&JXDG7pTUE5lTbV_Aj|L8WI2JeH+JYUFBrjOHMChl7LTvpm8^9QGv9s3B8NO@mZ!S_4 z8^kRJFgY!R?~V6OF`L*iFHl$E&R)fQ`V_ojw|mz8-LyVwl7% zU1j)JyLrb97drY6hXYOx2- zQK!{EyjNxq4hgMPM&ue1Q|<_i%JSe>0%Xqs!ER7nuBp_=Up-3Kl}oX>nhZB?ebG8c zr^np|ezFqJD{hkNk!#B$pBlN?s8n#i9e5cIe9&L!jOhtB5+n@XBNihA^fFD5X6)*0ptY>XFXUQ8dlSK zKi~_A59Ea!iy=NPYmyl|>BE~PDnkT;kqs8fENjVZM)E)!9 z-NCNB9m!7la>*vAGa)Y`jWo)>RHLU|O$}$+Z0fpy+tVvhkPPuHq}1cmJ@db{Z;{(#RFX3_1p>>P1h#ioDY^QRkLkr{o0pF8H9(L(q?IC#l+_)*B( zAS4#=@3KW6Dc2hi%sx{ejZ@(H!U102YudVwk240DttKWwcxIb@m@M`~sd)HO)NAsh ztHoohOC2snVv)*O-3x2+Ix0vApsJ8ELVNr!#Z*^KQPb&eyAJ`LagUue zJXzuxZBG!BOM*>hF1_8KqUlVY>11;qR=RvH_9i;(MtgpkT#p+Zy?9xv@H7qINS-we z6K9la(O1!fuH#04cmr-Ie7kXrsUWyf++wQ+Tie1cC`KE2$n~&@_ zqnju#5$g6oKwElzoM@j%>!3;#Q!j+!LYPK^d)lbJP7`&h-*LQQVI2di2A;(A+Wq$c ze7M(JF1#Y5XUyEjOYO-NLoe>;qFVpMC+)qmTyVGQz;`9iXt;>kahNBr+w~*l&%0dU zH0$@v%FbtH_i10g2FAMJt>d`@ZGJ+K;4`HKD@XR&7u5&=r9E{ z+ge@ozEr0l;h?LG`;|+bG@>T+jEq&|3en-scfMiqjNVP%YlUmATv$r@>wv{DT`R3x zmDk0V1R`?I{THha$)cL@F!_B`%jVuEd3f<^gu0$gp@FmP=46=qcY-(fT!-ua4nSd%ePccH+11IVZFZd_P?x?U zxWh>r2crj&=UI;)qfS##PXrk#Ss0e7P?gI`VKnSy~XAArpHA_so zSh+OS{i_4mdb zdZm@d>?Dopt%XKOB0-kZg^XZnxS<`x6~T-aX*z<6{SpS~!5mbe_xotKq=!aoL8+WT z0=5xF!FQSoXJgqZ8nb|IwK-;pYE>WBC%{Nd!McPWzhg%c|0TKw`;FpBbFeEovR9d# ziz%#Favab+bUtG?g0T8N@#aMvRv6}Q7vHc7>c6`_WCtBCJw*JM1-(^3SqnB-Pqs`H zU!Y3nW^Zud@TRLPRv$1tfD&j> zCvTkCaP0m<2z=(dck8`7(N*hr=cId@J?|>zrVe3kCa|6y{Uov1rZIgkUCV~2*mD|z zt|)Vo`^z>FZ~b;$Jxl`Puml+Jh=Y=A+|o}N`R?F=Mo*v)IFhIp4hjK9WPI)MJfajK z^$K*=ZTRNfjQX=($blQcpBh}CkPGglv`I5iHf$kh^{2M76)l{IsokZW2YT3<`sA@j z+6HLb)E3T?WG$6GQIM{SvYhGE0EKcjw&cC-0EP{93RleR)s}>Id1V*=bwNTNIOxV#MDk`-PR$ zAGPT0DS@wu)4)mPSSn-UEzGr*)sd?VpLFpeKxX0n$e$}cW&1f=^`Tc_KZt+J zDg@o)ZErUQzzh2z1iEqVT-(7F!JV5R>g1E~+m8cw1K5;kEZI@kPb0oQV=e5@9xlei zJ!N+Zc_O)%rv~SCJEd}p)Vg4Md3kXC4(jj5#?XG?U1Vj7ruAlET}rL=(gwHuPn2j1 zzmW8JKvWoD_N`aq4b>5U_wG$ao>+slRWJv${Z%9NvIKjyT)!zi<%LT%EIAl+R(!Vs z{WFY2FKFvF7b9Eh>cYu!ZV~m#_0_YP_?b&*LP?h45q#;5eeJX#489uf zcwig5bsVQaO`rxx2FQ)-mqp4|eRkc)X4{`v-5d~N|CnD=_jS^K=WbrJKctaAKo+VD z(*5qOD9{QoD!eq|B)YqQ!L;Zhd9+HV-HYTDJ0Aw5VG)eS$ow?$4gAm4Kq1hVBS-@E zMtHgk0YMl>7|dk8DF%53FuctzYRJ!KC@u;ry85SKFR`;E{TG(jpGBOv;lL?jy$*5;7712?BmRGOARDp>TV zHStTUW_ZT$2eY6g;Bq36Sg-17C}=BKM+=%gP>`y7Jsk-EP;Q}sWQ&6v?gGu&E+q{#&}WSl5TMMkUxs?x7b z14f4qgAJ1zQ3(mGdP~sTupX8-dpAtI$b&@&)xW4d8Sx6WpHD?^t7v~57gBMEb>pJw zbsc^z0&jB9p|}eerut_2x=l=I*?=BY<1nosKwetrOEnF59*CYp!c5@@O*koqCjNK+ za+8s=!EA)Ebhr`8e)+Kr;b-jYaAid3>>S;(6|_|!>ot^5SAnSJbz7Y*_W3LwK&j_# zW+^a_y{BP*S_bz-{H1i`7*!yL`q>3{aMizo`HW8rZ_*9CcL^aNkMNXZWo`+}^mKb- zI6ADV^a231kO@N}H{2c?AksmgI%D5=@yS51iK)E?__9Wu)HNqQ^oK2lj9zTU74a*F z^c5dBnJkoO=J})&dvWa|(-F2Z5-iao8a=wkS~uTW@U5uT6lKsr@)*rEH zErgTc_(eTqFsuBqSj@+)W%x+~p)?(C#C55lGO=gkT@r`NPkl+e=8aptn3irOs8brq zva#hzAgnM?evQYKE0@p4^m|rLBC(S+A6zV}LSMngdxAr>i`}UE8rpMvgBPwsN}ASq zCEiNw;c!<)bXtmQBi5!$RpY>MqEr99#^h(1y=`e(+`Iw-NA&A7bZosZ0}pf$L)6IK*ve971T%In zyUXs)v!cmvrruP~_6h%96d=W~JXssL=l{@FgfYeeAr}v~R02c$7ihm|X>lC#r~@=Q(;uoAdwWqoC*W6Z@*PRI=` zlXi4lRAy*^Zw*pc_S9E~3rGc5bP>i8y6Uf4V}9|3V`R{@5JNr1Alz(0ngkhfMJdx+ zIy_v@56F!P_*r|d7(Cd4?tIHnG2l~QHOnUfVF3f0xhzMdp*m?<=RV#K5EDImZjW>zTuHXhVZ> zn@VhBqj|Pxyulmv3e$Q#)Cpeol7m;2C865(^XhWn<$kHD|J%F!+E4iY2@0@J86|ApRxc>xNj@e;r6pXbwApfzi<)>%%3T+|t zSA;qLgIt?7JtxDToK0#j`!tNG@dPB}8uh`#Dh5|Xx|-V=BBN&5bE_vZDZCAVR&tT- za@yik5zplcSiLFmmz|TVnuu(_H7m8X@I(9Oj|k0Pw`<*g}z|cF{EAd|4wsV4<YAuX||8tq^-Rnl9pz@iC@;nGvgbfRo?N zM!vy;T*{ifuzioAGe^==x!|ZXAr7SCm;}BH(};}-1Lr1SSQHJb>Iz;<8(<|9Q(uvq z|3T-`$4d)6C33hEkMuEit%nD4K`mNvr~p4`HyPXIyh+LlMWbX#4|~=Q*6z$b;&p0O zU+eNuDO)6KjM>c7UwJAyN{g@N&;Xf}Aa)-@H&>bel4g9Xwx_q8x@CsOm5-q7j*BoW#HgA1}^Fo zpUK?~7p2sK*us}WWe_H}3#My+8gCY;K=ASZ_bq*oTZuDkqHw&28fMkJ)8#}I1unTSr z!w$0!`7|$NZ}K2Zo-~#-XijNY&7}`9~GIpYMIWUXlu1DU!I7PtX_} zI)g&6qz>Y^@~1N5P--<9F1{eETC3zVk_Z~hOy_laH+as;#QEd$g}osPX?(q8Kh7f3 z3>$f^(d{;8ud-m%*|ykVJ8E2D z5axJ1HC_d(nEKrZ<|Ok|)H#qC7yQ!iZ3H;es;`CqOe3psKB3#nEB*1Xi5WS+*HdTc zHq|$AJDe3|Z=#nKNMF|08&YpVczTZhN;})RyS{0?c$=)0aCiCAgzV>_y4rtb5VF+Y z$eW2so*&~7lMs-#BM^62zqP#epvZ-IFg&v2*!iQfbe7bkFKwdOXDzV>q|2LqUS^?q zd{}A9z`=ZpAM_67Tq_5fwbaI45OLQ$%@bR=Py{2V54B7ZT2`Zou??*nSu{}Deov9C zy-V9^9bR8>AOx7T4I;*4K~Ct_#uJXKy(BUFb(Ymq)UuN)XQH>2aR0;QVM6-OPcO9M zo~*dbOhw%Iu!_-A#4D?TW29eOLyHf@m? zoD`{M5*X9W^Zrto>Q(j`k!1;r9;M=rD&aKCoVK`y_Pn=4@a?BD*otmf*ABWFxyCh{ zmPl)tZmLpXL68|ZhoHgQT-y&Q*yAVQC_evTA600(6%9%n?|z2JZGJj7Bp34tlM)uB zp&vU3jK}7-D7_bQFvxPL(tcE}&%M1}zdkqmEVuYe6~KA!0fJ%57~1tqU|`Y>qJ_&! z7D6&Wbw^Z@?GMPGXGGYg)#ZG86cVF>!Et2Dp>wrlN zE2M$fyy*AaHodep{yJ{d3!ai30268sR+CM zTOjo-Id)k*AKoe(sOkteE`1ES4QNfeQHKS>9142({Kf)8n-+)>=$R1azyIW;ic671 zoS1JSDDu`Bwa+MM{$kp+Q2_j$^UQEUEhMLFVw~eG$Ab%fwnB49g)mVk*&o5~c@ zx-bX~LI+0{bmy8BERQ#mLR#XHJ}b#DEj{lbpnL9oNLS#`zz;MI_*NYV(00SAAm0egkH5j;~Nb=&NGF_H{FJxb9zpm@H}QP zEGHH;?*|N8t4>!BkRU4OEfGfcIqLOD#qZ4BDJ>4Gzc9m=yW4Tb6%T|g#WL*{%nCp^ zeRRWq2a3ygVBE1fV>r%`CZk>_!cI1qiSiP8tszP`G>%%xhhM`0r*Q@?%E zKL2srE|c`;I&`memohDgUfK=~=M7WKyf@;&zOc;8Lcrn+?X+QI-NxF7~RBIWFT%EFWO zD1Sy1SX9SP>x?2;A)Px^9|EDZ!v2OL`Lh*vm;oRI)gKSj__`x!=z&bGyDq&6ofKSa zDL8G0di;8jQ9L$QYUWc)eo_-~QM|^%Bvdw^fx20FW_JPRthc~%{^|Mqm!$QNT8}6&UTunc3W`OrA zFNKxPWA8%csUM#&|5t@tC2gBZYxX^{do&H=KU4jyeo3aLJpo{`T}3F;hgN!KQ3c`@ z@uT=w-^rOx4!mJMOhN4y!d?PK;zi<=iuc?f+?%{JIGvpFG?&OgC&)r}+z5-n-=lYU zCZ!CfZ^&2wqlfnn z=|3iK`z=E3Y^AUuD33O0o$<{^r@2m8+o1)^t0r4tvJG1kg7?2sL{pp>MOc|8{rQl! z|6Ikl3_B2M@%Lv4obShGwb%`&Z@^`#<$;&~S>Yz*r1P7s;rhRyE_KrRTXB%&IpO09 ztREtdsJM;!J0(-cNvZRBa+P0syp5RmOnXM7VrH3C5IUNI#W$cFDEPHfqa(Bvi#unK zsS10=c_Ci`_axl>2XcIy!x>P7Yj`5njB~@|M>7g|Ra`mvGO|O82&vWho-$gmoIv=C z;VPkf?e~D5YsCrK1|S*8<+&w-`cyMpvMrRm1}%AWuEx~t57z{?(bfJ?FQ@Gd6r_^TE#ODh2 zBUTy{4S&YQ=)<6;=Ao&^#bI0s!9 zB>3^TsTOZ=Cn-~qF^^BNwt)4c4U)jklR$XbCW+Yd2VSs;jT7YaW%QL$fyv zB|UH%NQ;Fpy(6e*P*YamU&0m<+sWU~Cgbj?(xc=|70q268J+k-Cn7KEe6UD<7od4e zyERbSKoVTAiLFWkU>nr-zaA!Zni&U!sWOdTbaKoZtfDykb;&sJG+FyMxGoXS14r*Z4|0H z8r@oGpY@b5gIu<}2YISbQ^89-ZYDbebLC4Q%Z%G(y zDM@!y+MkQ^H^PWP5q36CJ(&tqrLy6_BXkLsH8I)oQXRXo5-nva$wNv4)1Xr&tjD3E zh}9?wXMOVJmjJ)gn4e=1X8@y}_=1vy75ZeStDwRy zInh7U>3EKe`>=#DT!RAwL$WNE1qkk27Z@6!EDmTDv<;0&6>}yZaDiOV)47x}H8M1$ zy#4~bOYQ&8>_W&-ZaK?!2{=}(uzc&dh^$$*l7N;XKu?9d>}?>>e%DfF91$9tqPez4 zpA7oRODP)a$@*?yLx=;hsuX2@F;3@&IxidyBqdCF+Vuq0he*ze*ZUp;l<4<2eeGTYsG2 Gw?K3!!tR^^ diff --git a/knowledge-wiki b/knowledge-wiki index 4af9e15..073cb8f 160000 --- a/knowledge-wiki +++ b/knowledge-wiki @@ -1 +1 @@ -Subproject commit 4af9e1502acc00c0935e783ab31c3473279a9e40 +Subproject commit 073cb8fcb9efce32c2a4b16085732cc16c10933d diff --git a/terraform/authentik.tf b/terraform/authentik.tf index a7a935a..33e08d0 100644 --- a/terraform/authentik.tf +++ b/terraform/authentik.tf @@ -46,6 +46,17 @@ resource "authentik_group" "verein_mitglieder" { is_superuser = false } +data "authentik_user" "amy" { + username = "Amy" +} + +resource "authentik_group" "family" { + name = "family" + is_superuser = false + users = [data.authentik_user.amy.pk] +} + + # --- Flows: Authorization, Invalidation & Custom Invitation Flow --- data "authentik_flow" "default_authorization_flow" { @@ -740,6 +751,13 @@ resource "authentik_policy_binding" "silverbullet_admin_only" { order = 0 } +resource "authentik_policy_binding" "silverbullet_family" { + target = authentik_application.silverbullet.uuid + group = authentik_group.family.id + order = 1 +} + + # 2. Shared & Member Applications (Accessible to all authenticated users) resource "authentik_policy_binding" "grafana_users" { target = authentik_application.grafana.uuid diff --git a/terraform/terraform.tfstate b/terraform/terraform.tfstate index d732b0e..ad9cb66 100644 --- a/terraform/terraform.tfstate +++ b/terraform/terraform.tfstate @@ -1,7 +1,7 @@ { "version": 4, "terraform_version": "1.14.3", - "serial": 410, + "serial": 413, "lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e", "outputs": { "coder_oauth_client_secret": { @@ -197,6 +197,39 @@ } ] }, + { + "mode": "data", + "type": "authentik_user", + "name": "amy", + "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "attributes": "{\"settings\":{\"locale\":\"\"}}", + "avatar": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NHB4IiBoZWlnaHQ9IjY0cHgiIHZpZXdCb3g9IjAgMCA2NCA2NCIgdmVyc2lvbj0iMS4xIj48cmVjdCBmaWxsPSIjODgzNzllIiBjeD0iMzIiIGN5PSIzMiIgd2lkdGg9IjY0IiBoZWlnaHQ9IjY0IiByPSIzMiIvPjx0ZXh0IHg9IjUwJSIgeT0iNTAlIiBzdHlsZT0iY29sb3I6ICNmZmY7IGxpbmUtaGVpZ2h0OiAxOyBmb250LWZhbWlseTogJ1JlZEhhdFRleHQnLCdPdmVycGFzcycsb3ZlcnBhc3MsaGVsdmV0aWNhLGFyaWFsLHNhbnMtc2VyaWY7ICIgZmlsbD0iI2ZmZiIgYWxpZ25tZW50LWJhc2VsaW5lPSJtaWRkbGUiIGRvbWluYW50LWJhc2VsaW5lPSJtaWRkbGUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIGZvbnQtc2l6ZT0iMjgiIGZvbnQtd2VpZ2h0PSI0MDAiIGR5PSIuMWVtIj5BRzwvdGV4dD48L3N2Zz4=", + "date_joined": "2026-09-05T14:23:01.528947Z", + "email": "", + "groups": [ + "ad33b003-77a4-4571-bec8-8301f6d6552b" + ], + "id": "7", + "is_active": true, + "is_superuser": false, + "last_login": "2026-09-05T14:23:02.674777Z", + "name": "Amelie Graf", + "path": "users", + "pk": 7, + "type": "internal", + "uid": "771cd00470626adede1ffc8b70a4589a6778daf6de3280dfeaeaf11ae2aef8cf", + "username": "Amy", + "uuid": "bf49987e-864e-4b22-925b-e08bb8dc6cc9" + }, + "sensitive_attributes": [], + "identity_schema_version": 0 + } + ] + }, { "mode": "managed", "type": "authentik_application", @@ -692,7 +725,7 @@ { "schema_version": 0, "attributes": { - "backchannel_providers": null, + "backchannel_providers": [], "group": "", "id": "silverbullet", "meta_description": "", @@ -961,6 +994,34 @@ } ] }, + { + "mode": "managed", + "type": "authentik_group", + "name": "family", + "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "attributes": "{}", + "id": "5e91f468-a0f2-4433-aa23-a7b6ad69df38", + "is_superuser": false, + "name": "family", + "parents": null, + "roles": null, + "users": [ + 7 + ] + }, + "sensitive_attributes": [], + "identity_schema_version": 0, + "private": "bnVsbA==", + "dependencies": [ + "data.authentik_user.amy" + ] + } + ] + }, { "mode": "managed", "type": "authentik_group", @@ -1574,6 +1635,40 @@ } ] }, + { + "mode": "managed", + "type": "authentik_policy_binding", + "name": "silverbullet_family", + "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "enabled": true, + "failure_result": false, + "group": "5e91f468-a0f2-4433-aa23-a7b6ad69df38", + "id": "210387b6-770a-4ef6-8996-96aa9428e46b", + "negate": false, + "order": 1, + "policy": "", + "target": "7bae1695-db74-48e9-9d1e-be81025701be", + "timeout": 30, + "user": 0 + }, + "sensitive_attributes": [], + "identity_schema_version": 0, + "private": "bnVsbA==", + "dependencies": [ + "authentik_application.silverbullet", + "authentik_group.family", + "authentik_provider_proxy.silverbullet", + "data.authentik_flow.default_authorization_flow", + "data.authentik_flow.default_invalidation_flow", + "data.authentik_user.amy" + ] + } + ] + }, { "mode": "managed", "type": "authentik_policy_binding", @@ -2378,8 +2473,8 @@ "internal_host_ssl_validation": true, "invalidation_flow": "9add9e98-4fe7-48c5-bca8-d68968e0a7ba", "jwks_sources": null, - "jwt_federation_providers": null, - "jwt_federation_sources": null, + "jwt_federation_providers": [], + "jwt_federation_sources": [], "mode": "forward_single", "name": "SilverBullet", "property_mappings": null, diff --git a/terraform/terraform.tfstate.backup b/terraform/terraform.tfstate.backup index b96e49c..d732b0e 100644 --- a/terraform/terraform.tfstate.backup +++ b/terraform/terraform.tfstate.backup @@ -1,7 +1,7 @@ { "version": 4, "terraform_version": "1.14.3", - "serial": 405, + "serial": 410, "lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e", "outputs": { "coder_oauth_client_secret": { @@ -683,6 +683,41 @@ } ] }, + { + "mode": "managed", + "type": "authentik_application", + "name": "silverbullet", + "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "backchannel_providers": null, + "group": "", + "id": "silverbullet", + "meta_description": "", + "meta_hide": false, + "meta_icon": "", + "meta_launch_url": "", + "meta_publisher": "", + "name": "SilverBullet", + "open_in_new_tab": false, + "policy_engine_mode": "any", + "protocol_provider": 15, + "slug": "silverbullet", + "uuid": "7bae1695-db74-48e9-9d1e-be81025701be" + }, + "sensitive_attributes": [], + "identity_schema_version": 0, + "private": "bnVsbA==", + "dependencies": [ + "authentik_provider_proxy.silverbullet", + "data.authentik_flow.default_authorization_flow", + "data.authentik_flow.default_invalidation_flow" + ] + } + ] + }, { "mode": "managed", "type": "authentik_application", @@ -1021,7 +1056,8 @@ 2, 7, 3, - 10 + 10, + 15 ], "service_connection": "", "type": "proxy" @@ -1037,6 +1073,7 @@ "authentik_provider_proxy.nextcloud_phpmyadmin", "authentik_provider_proxy.openclaw", "authentik_provider_proxy.prometheus", + "authentik_provider_proxy.silverbullet", "authentik_provider_proxy.zigbee2mqtt", "data.authentik_flow.default_authorization_flow", "data.authentik_flow.default_invalidation_flow" @@ -1504,6 +1541,39 @@ } ] }, + { + "mode": "managed", + "type": "authentik_policy_binding", + "name": "silverbullet_admin_only", + "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "enabled": true, + "failure_result": false, + "group": "c0ad76f4-d157-4c9e-882c-9ae5b5fc1690", + "id": "b1c88c71-4abc-4fbe-8a0b-d9822b4c2984", + "negate": false, + "order": 0, + "policy": "", + "target": "7bae1695-db74-48e9-9d1e-be81025701be", + "timeout": 30, + "user": 0 + }, + "sensitive_attributes": [], + "identity_schema_version": 0, + "private": "bnVsbA==", + "dependencies": [ + "authentik_application.silverbullet", + "authentik_group.infra_admins", + "authentik_provider_proxy.silverbullet", + "data.authentik_flow.default_authorization_flow", + "data.authentik_flow.default_invalidation_flow" + ] + } + ] + }, { "mode": "managed", "type": "authentik_policy_binding", @@ -2284,6 +2354,48 @@ } ] }, + { + "mode": "managed", + "type": "authentik_provider_proxy", + "name": "silverbullet", + "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "access_token_validity": "minutes=10", + "authentication_flow": "", + "authorization_flow": "68f43818-60ba-4d8e-ae66-cbac29d7be42", + "basic_auth_enabled": false, + "basic_auth_password_attribute": "", + "basic_auth_username_attribute": "", + "client_id": "XKhBpWI0UUv7YnGsec2EzUzIsNy4nnDnxRUbBHV1", + "cookie_domain": "", + "external_host": "https://wiki.moritzgraf.de", + "id": "15", + "intercept_header_auth": true, + "internal_host": "", + "internal_host_ssl_validation": true, + "invalidation_flow": "9add9e98-4fe7-48c5-bca8-d68968e0a7ba", + "jwks_sources": null, + "jwt_federation_providers": null, + "jwt_federation_sources": null, + "mode": "forward_single", + "name": "SilverBullet", + "property_mappings": null, + "refresh_token_validity": "days=30", + "skip_path_regex": "" + }, + "sensitive_attributes": [], + "identity_schema_version": 0, + "private": "bnVsbA==", + "dependencies": [ + "data.authentik_flow.default_authorization_flow", + "data.authentik_flow.default_invalidation_flow" + ] + } + ] + }, { "mode": "managed", "type": "authentik_provider_proxy",