moritz/infrapuzzle
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(security): implement ADR 0005 Authentik boundary and hosting isolation

Browse Source
This commit is contained in:
Moritz Graf
2026-10-11 21:25:12 +02:00
parent fbc04f8892
commit ccfce0fa5d
7 changed files with 340 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/authentik.tf
+30
View File
@@ -359,6 +359,23 @@ resource "authentik_application" "silverbullet" {
protocol_provider = authentik_provider_proxy.silverbullet.id
}
# 10. Hosting Family Dashboards
resource "authentik_provider_proxy" "hosting_family" {
name = "Hosting Family"
external_host = "https://hosting.haumdaucher.de"
mode = "forward_single"
authorization_flow = data.authentik_flow.default_authorization_flow.id
invalidation_flow = data.authentik_flow.default_invalidation_flow.id
intercept_header_auth = true
access_token_validity = "days=30"
}
resource "authentik_application" "hosting_family" {
name = "Hosting Family"
slug = "hosting-family"
protocol_provider = authentik_provider_proxy.hosting_family.id
}
# --- Outpost: Embedded Proxy Outpost ---
resource "authentik_outpost" "embedded" {
@@ -374,6 +391,7 @@ resource "authentik_outpost" "embedded" {
authentik_provider_proxy.openclaw.id,
authentik_provider_proxy.n8n.id,
authentik_provider_proxy.silverbullet.id,
authentik_provider_proxy.hosting_family.id,
]
}
@@ -759,6 +777,18 @@ resource "authentik_policy_binding" "silverbullet_family" {
order = 1
}
resource "authentik_policy_binding" "hosting_family_admin" {
target = authentik_application.hosting_family.uuid
group = authentik_group.infra_admins.id
order = 0
}
resource "authentik_policy_binding" "hosting_family_family" {
target = authentik_application.hosting_family.uuid
group = authentik_group.family.id
order = 1
}
# 2. Shared & Member Applications (Accessible to all authenticated users)
resource "authentik_policy_binding" "grafana_users" {
terraform/terraform.tfstate
+152 -5
View File
@@ -1,7 +1,7 @@
{
"version": 4,
"terraform_version": "1.14.3",
"serial": 417,
"serial": 423,
"lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e",
"outputs": {
"coder_oauth_client_secret": {
@@ -211,7 +211,8 @@
"date_joined": "2026-09-05T14:23:01.528947Z",
"email": "",
"groups": [
"ad33b003-77a4-4571-bec8-8301f6d6552b"
"ad33b003-77a4-4571-bec8-8301f6d6552b",
"5e91f468-a0f2-4433-aa23-a7b6ad69df38"
],
"id": "7",
"is_active": true,
@@ -495,6 +496,41 @@
}
]
},
{
"mode": "managed",
"type": "authentik_application",
"name": "hosting_family",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"backchannel_providers": null,
"group": "",
"id": "hosting-family",
"meta_description": "",
"meta_hide": false,
"meta_icon": "",
"meta_launch_url": "",
"meta_publisher": "",
"name": "Hosting Family",
"open_in_new_tab": false,
"policy_engine_mode": "any",
"protocol_provider": 16,
"slug": "hosting-family",
"uuid": "14ad2eb5-c3b8-4fe6-b980-26f1a91f44a3"
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"authentik_provider_proxy.hosting_family",
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow"
]
}
]
},
{
"mode": "managed",
"type": "authentik_application",
@@ -1007,8 +1043,8 @@
"id": "5e91f468-a0f2-4433-aa23-a7b6ad69df38",
"is_superuser": false,
"name": "family",
"parents": null,
"roles": null,
"parents": [],
"roles": [],
"users": [
7
]
@@ -1118,7 +1154,8 @@
7,
3,
10,
15
15,
16
],
"service_connection": "",
"type": "proxy"
@@ -1130,6 +1167,7 @@
"authentik_provider_proxy.alertmanager",
"authentik_provider_proxy.gitea_phpmyadmin",
"authentik_provider_proxy.hass_coder",
"authentik_provider_proxy.hosting_family",
"authentik_provider_proxy.n8n",
"authentik_provider_proxy.nextcloud_phpmyadmin",
"authentik_provider_proxy.openclaw",
@@ -1393,6 +1431,73 @@
}
]
},
{
"mode": "managed",
"type": "authentik_policy_binding",
"name": "hosting_family_admin",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"enabled": true,
"failure_result": false,
"group": "c0ad76f4-d157-4c9e-882c-9ae5b5fc1690",
"id": "55b2f74f-f650-40a2-9781-a00a5978e1e8",
"negate": false,
"order": 0,
"policy": "",
"target": "14ad2eb5-c3b8-4fe6-b980-26f1a91f44a3",
"timeout": 30,
"user": 0
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"authentik_application.hosting_family",
"authentik_group.infra_admins",
"authentik_provider_proxy.hosting_family",
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow"
]
}
]
},
{
"mode": "managed",
"type": "authentik_policy_binding",
"name": "hosting_family_family",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"enabled": true,
"failure_result": false,
"group": "5e91f468-a0f2-4433-aa23-a7b6ad69df38",
"id": "b598a889-f04b-4955-8a01-6558cfaad60e",
"negate": false,
"order": 1,
"policy": "",
"target": "14ad2eb5-c3b8-4fe6-b980-26f1a91f44a3",
"timeout": 30,
"user": 0
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"authentik_application.hosting_family",
"authentik_group.family",
"authentik_provider_proxy.hosting_family",
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow",
"data.authentik_user.amy"
]
}
]
},
{
"mode": "managed",
"type": "authentik_policy_binding",
@@ -2281,6 +2386,48 @@
}
]
},
{
"mode": "managed",
"type": "authentik_provider_proxy",
"name": "hosting_family",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"access_token_validity": "days=30",
"authentication_flow": "",
"authorization_flow": "68f43818-60ba-4d8e-ae66-cbac29d7be42",
"basic_auth_enabled": false,
"basic_auth_password_attribute": "",
"basic_auth_username_attribute": "",
"client_id": "27XovQEtW8nMAgUN6kANZnQZMMbWVEbi8Mh6VsGP",
"cookie_domain": "",
"external_host": "https://hosting.haumdaucher.de",
"id": "16",
"intercept_header_auth": true,
"internal_host": "",
"internal_host_ssl_validation": true,
"invalidation_flow": "9add9e98-4fe7-48c5-bca8-d68968e0a7ba",
"jwks_sources": null,
"jwt_federation_providers": null,
"jwt_federation_sources": null,
"mode": "forward_single",
"name": "Hosting Family",
"property_mappings": null,
"refresh_token_validity": "days=30",
"skip_path_regex": ""
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow"
]
}
]
},
{
"mode": "managed",
"type": "authentik_provider_proxy",
terraform/terraform.tfstate.backup
+2 -2
View File
@@ -1,7 +1,7 @@
{
"version": 4,
"terraform_version": "1.14.3",
"serial": 415,
"serial": 417,
"lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e",
"outputs": {
"coder_oauth_client_secret": {
@@ -2458,7 +2458,7 @@
{
"schema_version": 0,
"attributes": {
"access_token_validity": "minutes=10",
"access_token_validity": "days=7",
"authentication_flow": "",
"authorization_flow": "68f43818-60ba-4d8e-ae66-cbac29d7be42",
"basic_auth_enabled": false,