feat(wiki): isolate silverbullet pvc, add pre-commit wall, family group, and audit alert

terraform/authentik.tf

@@ -46,6 +46,17 @@ resource "authentik_group" "verein_mitglieder" {
   is_superuser = false
 }
 
+data "authentik_user" "amy" {
+  username = "Amy"
+}
+
+resource "authentik_group" "family" {
+  name         = "family"
+  is_superuser = false
+  users        = [data.authentik_user.amy.pk]
+}
+
+
 # --- Flows: Authorization, Invalidation & Custom Invitation Flow ---
 
 data "authentik_flow" "default_authorization_flow" {
@@ -740,6 +751,13 @@ resource "authentik_policy_binding" "silverbullet_admin_only" {
   order  = 0
 }
 
+resource "authentik_policy_binding" "silverbullet_family" {
+  target = authentik_application.silverbullet.uuid
+  group  = authentik_group.family.id
+  order  = 1
+}
+
+
 # 2. Shared & Member Applications (Accessible to all authenticated users)
 resource "authentik_policy_binding" "grafana_users" {
   target = authentik_application.grafana.uuid

terraform/terraform.tfstate

@@ -1,7 +1,7 @@
 {
   "version": 4,
   "terraform_version": "1.14.3",
-  "serial": 410,
+  "serial": 413,
   "lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e",
   "outputs": {
     "coder_oauth_client_secret": {
@@ -197,6 +197,39 @@
         }
       ]
     },
+    {
+      "mode": "data",
+      "type": "authentik_user",
+      "name": "amy",
+      "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "attributes": "{\"settings\":{\"locale\":\"\"}}",
+            "avatar": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NHB4IiBoZWlnaHQ9IjY0cHgiIHZpZXdCb3g9IjAgMCA2NCA2NCIgdmVyc2lvbj0iMS4xIj48cmVjdCBmaWxsPSIjODgzNzllIiBjeD0iMzIiIGN5PSIzMiIgd2lkdGg9IjY0IiBoZWlnaHQ9IjY0IiByPSIzMiIvPjx0ZXh0IHg9IjUwJSIgeT0iNTAlIiBzdHlsZT0iY29sb3I6ICNmZmY7IGxpbmUtaGVpZ2h0OiAxOyBmb250LWZhbWlseTogJ1JlZEhhdFRleHQnLCdPdmVycGFzcycsb3ZlcnBhc3MsaGVsdmV0aWNhLGFyaWFsLHNhbnMtc2VyaWY7ICIgZmlsbD0iI2ZmZiIgYWxpZ25tZW50LWJhc2VsaW5lPSJtaWRkbGUiIGRvbWluYW50LWJhc2VsaW5lPSJtaWRkbGUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIGZvbnQtc2l6ZT0iMjgiIGZvbnQtd2VpZ2h0PSI0MDAiIGR5PSIuMWVtIj5BRzwvdGV4dD48L3N2Zz4=",
+            "date_joined": "2026-09-05T14:23:01.528947Z",
+            "email": "",
+            "groups": [
+              "ad33b003-77a4-4571-bec8-8301f6d6552b"
+            ],
+            "id": "7",
+            "is_active": true,
+            "is_superuser": false,
+            "last_login": "2026-09-05T14:23:02.674777Z",
+            "name": "Amelie Graf",
+            "path": "users",
+            "pk": 7,
+            "type": "internal",
+            "uid": "771cd00470626adede1ffc8b70a4589a6778daf6de3280dfeaeaf11ae2aef8cf",
+            "username": "Amy",
+            "uuid": "bf49987e-864e-4b22-925b-e08bb8dc6cc9"
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0
+        }
+      ]
+    },
     {
       "mode": "managed",
       "type": "authentik_application",
@@ -692,7 +725,7 @@
         {
           "schema_version": 0,
           "attributes": {
-            "backchannel_providers": null,
+            "backchannel_providers": [],
             "group": "",
             "id": "silverbullet",
             "meta_description": "",
@@ -961,6 +994,34 @@
         }
       ]
     },
+    {
+      "mode": "managed",
+      "type": "authentik_group",
+      "name": "family",
+      "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "attributes": "{}",
+            "id": "5e91f468-a0f2-4433-aa23-a7b6ad69df38",
+            "is_superuser": false,
+            "name": "family",
+            "parents": null,
+            "roles": null,
+            "users": [
+              7
+            ]
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "bnVsbA==",
+          "dependencies": [
+            "data.authentik_user.amy"
+          ]
+        }
+      ]
+    },
     {
       "mode": "managed",
       "type": "authentik_group",
@@ -1574,6 +1635,40 @@
         }
       ]
     },
+    {
+      "mode": "managed",
+      "type": "authentik_policy_binding",
+      "name": "silverbullet_family",
+      "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "enabled": true,
+            "failure_result": false,
+            "group": "5e91f468-a0f2-4433-aa23-a7b6ad69df38",
+            "id": "210387b6-770a-4ef6-8996-96aa9428e46b",
+            "negate": false,
+            "order": 1,
+            "policy": "",
+            "target": "7bae1695-db74-48e9-9d1e-be81025701be",
+            "timeout": 30,
+            "user": 0
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "bnVsbA==",
+          "dependencies": [
+            "authentik_application.silverbullet",
+            "authentik_group.family",
+            "authentik_provider_proxy.silverbullet",
+            "data.authentik_flow.default_authorization_flow",
+            "data.authentik_flow.default_invalidation_flow",
+            "data.authentik_user.amy"
+          ]
+        }
+      ]
+    },
     {
       "mode": "managed",
       "type": "authentik_policy_binding",
@@ -2378,8 +2473,8 @@
             "internal_host_ssl_validation": true,
             "invalidation_flow": "9add9e98-4fe7-48c5-bca8-d68968e0a7ba",
             "jwks_sources": null,
-            "jwt_federation_providers": null,
+            "jwt_federation_providers": [],
-            "jwt_federation_sources": null,
+            "jwt_federation_sources": [],
             "mode": "forward_single",
             "name": "SilverBullet",
             "property_mappings": null,

terraform/terraform.tfstate.backup

@@ -1,7 +1,7 @@
 {
   "version": 4,
   "terraform_version": "1.14.3",
-  "serial": 405,
+  "serial": 410,
   "lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e",
   "outputs": {
     "coder_oauth_client_secret": {
@@ -683,6 +683,41 @@
         }
       ]
     },
+    {
+      "mode": "managed",
+      "type": "authentik_application",
+      "name": "silverbullet",
+      "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "backchannel_providers": null,
+            "group": "",
+            "id": "silverbullet",
+            "meta_description": "",
+            "meta_hide": false,
+            "meta_icon": "",
+            "meta_launch_url": "",
+            "meta_publisher": "",
+            "name": "SilverBullet",
+            "open_in_new_tab": false,
+            "policy_engine_mode": "any",
+            "protocol_provider": 15,
+            "slug": "silverbullet",
+            "uuid": "7bae1695-db74-48e9-9d1e-be81025701be"
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "bnVsbA==",
+          "dependencies": [
+            "authentik_provider_proxy.silverbullet",
+            "data.authentik_flow.default_authorization_flow",
+            "data.authentik_flow.default_invalidation_flow"
+          ]
+        }
+      ]
+    },
     {
       "mode": "managed",
       "type": "authentik_application",
@@ -1021,7 +1056,8 @@
               2,
               7,
               3,
-              10
+              10,
+              15
             ],
             "service_connection": "",
             "type": "proxy"
@@ -1037,6 +1073,7 @@
             "authentik_provider_proxy.nextcloud_phpmyadmin",
             "authentik_provider_proxy.openclaw",
             "authentik_provider_proxy.prometheus",
+            "authentik_provider_proxy.silverbullet",
             "authentik_provider_proxy.zigbee2mqtt",
             "data.authentik_flow.default_authorization_flow",
             "data.authentik_flow.default_invalidation_flow"
@@ -1504,6 +1541,39 @@
         }
       ]
     },
+    {
+      "mode": "managed",
+      "type": "authentik_policy_binding",
+      "name": "silverbullet_admin_only",
+      "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "enabled": true,
+            "failure_result": false,
+            "group": "c0ad76f4-d157-4c9e-882c-9ae5b5fc1690",
+            "id": "b1c88c71-4abc-4fbe-8a0b-d9822b4c2984",
+            "negate": false,
+            "order": 0,
+            "policy": "",
+            "target": "7bae1695-db74-48e9-9d1e-be81025701be",
+            "timeout": 30,
+            "user": 0
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "bnVsbA==",
+          "dependencies": [
+            "authentik_application.silverbullet",
+            "authentik_group.infra_admins",
+            "authentik_provider_proxy.silverbullet",
+            "data.authentik_flow.default_authorization_flow",
+            "data.authentik_flow.default_invalidation_flow"
+          ]
+        }
+      ]
+    },
     {
       "mode": "managed",
       "type": "authentik_policy_binding",
@@ -2284,6 +2354,48 @@
         }
       ]
     },
+    {
+      "mode": "managed",
+      "type": "authentik_provider_proxy",
+      "name": "silverbullet",
+      "provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_token_validity": "minutes=10",
+            "authentication_flow": "",
+            "authorization_flow": "68f43818-60ba-4d8e-ae66-cbac29d7be42",
+            "basic_auth_enabled": false,
+            "basic_auth_password_attribute": "",
+            "basic_auth_username_attribute": "",
+            "client_id": "XKhBpWI0UUv7YnGsec2EzUzIsNy4nnDnxRUbBHV1",
+            "cookie_domain": "",
+            "external_host": "https://wiki.moritzgraf.de",
+            "id": "15",
+            "intercept_header_auth": true,
+            "internal_host": "",
+            "internal_host_ssl_validation": true,
+            "invalidation_flow": "9add9e98-4fe7-48c5-bca8-d68968e0a7ba",
+            "jwks_sources": null,
+            "jwt_federation_providers": null,
+            "jwt_federation_sources": null,
+            "mode": "forward_single",
+            "name": "SilverBullet",
+            "property_mappings": null,
+            "refresh_token_validity": "days=30",
+            "skip_path_regex": ""
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "bnVsbA==",
+          "dependencies": [
+            "data.authentik_flow.default_authorization_flow",
+            "data.authentik_flow.default_invalidation_flow"
+          ]
+        }
+      ]
+    },
     {
       "mode": "managed",
       "type": "authentik_provider_proxy",