feat(security): deploy OpenCanary honeypot on VLAN 50 with Gotify and Discord alerting

scripts/update_ha_authentik_uris.py

@@ -0,0 +1,52 @@
+import urllib.request
+import ssl
+import json
+import sys
+
+sys.stdout.reconfigure(encoding='utf-8')
+
+ctx = ssl.create_default_context()
+ctx.check_hostname = False
+ctx.verify_mode = ssl.CERT_NONE
+
+AK_BASE = "https://authentik.snarfnet.net"
+AK_TOKEN = "SnarfNetPermanentAutomationToken2026"
+
+headers = {
+    "Authorization": f"Bearer {AK_TOKEN}",
+    "Content-Type": "application/json",
+    "Accept": "application/json"
+}
+
+# 1. Fetch current provider 15
+req = urllib.request.Request(f"{AK_BASE}/api/v3/providers/oauth2/15/", headers=headers)
+with urllib.request.urlopen(req, timeout=10, context=ctx) as r:
+    prov = json.loads(r.read().decode())
+
+print("Current redirect URIs:")
+for u in prov.get("redirect_uris", []):
+    print(" -", u)
+
+new_uris = [
+    {"matching_mode": "strict", "url": "https://snarfhome.snarfnet.net/auth/external/callback"},
+    {"matching_mode": "strict", "url": "https://snarfhome.snarfnet.net/auth/oidc/callback"},
+    {"matching_mode": "strict", "url": "https://snarfhome.snarfnet.net/"},
+    {"matching_mode": "regex", "url": r"https://snarfhome\.snarfnet\.net.*"},
+    {"matching_mode": "strict", "url": "https://4qwu1vav8er84pjh1r9x7qt1ajwq9siw.ui.nabu.casa/auth/external/callback"},
+    {"matching_mode": "strict", "url": "https://4qwu1vav8er84pjh1r9x7qt1ajwq9siw.ui.nabu.casa/auth/oidc/callback"},
+    {"matching_mode": "strict", "url": "https://4qwu1vav8er84pjh1r9x7qt1ajwq9siw.ui.nabu.casa/"},
+    {"matching_mode": "regex", "url": r"https://4qwu1vav8er84pjh1r9x7qt1ajwq9siw\.ui\.nabu\.casa.*"},
+    {"matching_mode": "regex", "url": r".*nabu\.casa.*"},
+    {"matching_mode": "regex", "url": r"http://14\.4\.4\.20:8123.*"},
+]
+
+# 2. Patch provider 15
+patch_data = json.dumps({"redirect_uris": new_uris}).encode('utf-8')
+patch_req = urllib.request.Request(f"{AK_BASE}/api/v3/providers/oauth2/15/", data=patch_data, headers=headers, method="PATCH")
+with urllib.request.urlopen(patch_req, timeout=10, context=ctx) as r:
+    updated = json.loads(r.read().decode())
+
+print("\nSuccessfully updated Authentik Provider 15 redirect URIs:")
+for u in updated.get("redirect_uris", []):
+    print(" +", u)
+