feat: initial homelab-gitops declarative structure (Terraform & ArgoCD)
This commit is contained in:
131
terraform/authentik/applications.tf
Normal file
131
terraform/authentik/applications.tf
Normal file
@@ -0,0 +1,131 @@
|
||||
# 1. Argo CD
|
||||
resource "authentik_application" "argocd" {
|
||||
name = "Argo CD"
|
||||
slug = "argo-cd"
|
||||
protocol_provider = authentik_provider_oauth2.argocd.id
|
||||
meta_icon = "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/argo.png"
|
||||
meta_launch_url = "https://argo.snarfnet.net"
|
||||
group = "Infrastructure"
|
||||
open_in_new_tab = true
|
||||
}
|
||||
|
||||
# 2. Gitea
|
||||
resource "authentik_application" "gitea" {
|
||||
name = "Gitea"
|
||||
slug = "gitea"
|
||||
protocol_provider = authentik_provider_oauth2.gitea.id
|
||||
meta_icon = "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/gitea.png"
|
||||
meta_launch_url = "https://git.snarfnet.net"
|
||||
group = "Development"
|
||||
open_in_new_tab = true
|
||||
}
|
||||
|
||||
# 3. AWX
|
||||
resource "authentik_application" "awx" {
|
||||
name = "AWX Automation"
|
||||
slug = "awx"
|
||||
protocol_provider = authentik_provider_oauth2.awx.id
|
||||
meta_icon = "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/ansible.png"
|
||||
meta_launch_url = "https://awx.snarfnet.net"
|
||||
group = "Infrastructure"
|
||||
open_in_new_tab = true
|
||||
}
|
||||
|
||||
# 4. Grafana
|
||||
resource "authentik_application" "grafana" {
|
||||
name = "Grafana"
|
||||
slug = "grafana"
|
||||
protocol_provider = authentik_provider_oauth2.grafana.id
|
||||
meta_icon = "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/grafana.png"
|
||||
meta_launch_url = "https://grafana.snarfnet.net"
|
||||
group = "Observability"
|
||||
open_in_new_tab = true
|
||||
}
|
||||
|
||||
# 5. Zabbix
|
||||
resource "authentik_application" "zabbix" {
|
||||
name = "Zabbix"
|
||||
slug = "zabbix"
|
||||
protocol_provider = authentik_provider_oauth2.zabbix.id
|
||||
meta_icon = "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/zabbix.png"
|
||||
meta_launch_url = "https://zabbix.snarfnet.net"
|
||||
group = "Observability"
|
||||
open_in_new_tab = true
|
||||
}
|
||||
|
||||
# 6. Coder
|
||||
resource "authentik_application" "coder" {
|
||||
name = "Coder"
|
||||
slug = "coder"
|
||||
protocol_provider = authentik_provider_oauth2.coder.id
|
||||
meta_icon = "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/coder.png"
|
||||
meta_launch_url = "https://coder.snarfnet.net"
|
||||
group = "Development"
|
||||
open_in_new_tab = true
|
||||
}
|
||||
|
||||
# 7. Semaphore
|
||||
resource "authentik_application" "semaphore" {
|
||||
name = "Semaphore UI"
|
||||
slug = "semaphore"
|
||||
protocol_provider = authentik_provider_oauth2.semaphore.id
|
||||
meta_icon = "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/ansible.png"
|
||||
meta_launch_url = "https://semaphore.snarfnet.net"
|
||||
group = "Infrastructure"
|
||||
open_in_new_tab = true
|
||||
}
|
||||
|
||||
# 8. Synology DSM
|
||||
resource "authentik_application" "synology" {
|
||||
name = "Synology DSM"
|
||||
slug = "synology"
|
||||
protocol_provider = authentik_provider_oauth2.synology.id
|
||||
meta_icon = "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/synology.png"
|
||||
meta_launch_url = "https://nas.snarfnet.net"
|
||||
group = "Storage"
|
||||
open_in_new_tab = true
|
||||
}
|
||||
|
||||
# 9. Gotify
|
||||
resource "authentik_application" "gotify" {
|
||||
name = "Gotify"
|
||||
slug = "gotify"
|
||||
protocol_provider = authentik_provider_proxy.gotify.id
|
||||
meta_icon = "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/gotify.png"
|
||||
meta_launch_url = "https://gotify.snarfnet.net"
|
||||
group = "Observability"
|
||||
open_in_new_tab = true
|
||||
}
|
||||
|
||||
# 10. Peanut
|
||||
resource "authentik_application" "peanut" {
|
||||
name = "Peanut UPS"
|
||||
slug = "peanut"
|
||||
protocol_provider = authentik_provider_proxy.peanut.id
|
||||
meta_icon = "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/ups.png"
|
||||
meta_launch_url = "https://peanut.snarfnet.net"
|
||||
group = "Power & Environment"
|
||||
open_in_new_tab = true
|
||||
}
|
||||
|
||||
# 11. Homebox
|
||||
resource "authentik_application" "homebox" {
|
||||
name = "Homebox"
|
||||
slug = "homebox"
|
||||
protocol_provider = authentik_provider_proxy.homebox.id
|
||||
meta_icon = "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/homebox.png"
|
||||
meta_launch_url = "https://homebox.snarfnet.net"
|
||||
group = "Management"
|
||||
open_in_new_tab = true
|
||||
}
|
||||
|
||||
# 12. NPM
|
||||
resource "authentik_application" "npm" {
|
||||
name = "Nginx Proxy Manager"
|
||||
slug = "nginx-proxy-manager"
|
||||
protocol_provider = authentik_provider_proxy.npm.id
|
||||
meta_icon = "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/nginx-proxy-manager.png"
|
||||
meta_launch_url = "https://nginx.snarfnet.net"
|
||||
group = "Infrastructure"
|
||||
open_in_new_tab = true
|
||||
}
|
||||
140
terraform/authentik/oauth2_providers.tf
Normal file
140
terraform/authentik/oauth2_providers.tf
Normal file
@@ -0,0 +1,140 @@
|
||||
# Scopes
|
||||
data "authentik_property_mapping_provider_scope" "openid" {
|
||||
scope_name = "openid"
|
||||
}
|
||||
|
||||
data "authentik_property_mapping_provider_scope" "email" {
|
||||
scope_name = "email"
|
||||
}
|
||||
|
||||
data "authentik_property_mapping_provider_scope" "profile" {
|
||||
scope_name = "profile"
|
||||
}
|
||||
|
||||
# 1. Argo CD
|
||||
resource "authentik_provider_oauth2" "argocd" {
|
||||
name = "Argo CD"
|
||||
client_id = "argocd-client-id"
|
||||
client_secret = "SnarfNetArgoCDPermanentSecret2026"
|
||||
authorization_flow = var.default_authorization_flow_uuid
|
||||
invalidation_flow = var.default_invalidation_flow_uuid
|
||||
signing_key = var.default_signing_key_uuid
|
||||
redirect_uris = ["https://argo.snarfnet.net/auth/callback"]
|
||||
property_mappings = [
|
||||
data.authentik_property_mapping_provider_scope.openid.id,
|
||||
data.authentik_property_mapping_provider_scope.email.id,
|
||||
data.authentik_property_mapping_provider_scope.profile.id,
|
||||
]
|
||||
}
|
||||
|
||||
# 2. Gitea
|
||||
resource "authentik_provider_oauth2" "gitea" {
|
||||
name = "Gitea"
|
||||
client_id = "gitea-client-id"
|
||||
client_secret = "SnarfNetGiteaPermanentSecret2026"
|
||||
authorization_flow = var.default_authorization_flow_uuid
|
||||
invalidation_flow = var.default_invalidation_flow_uuid
|
||||
signing_key = var.default_signing_key_uuid
|
||||
redirect_uris = ["https://git.snarfnet.net/user/oauth2/authentik/callback"]
|
||||
property_mappings = [
|
||||
data.authentik_property_mapping_provider_scope.openid.id,
|
||||
data.authentik_property_mapping_provider_scope.email.id,
|
||||
data.authentik_property_mapping_provider_scope.profile.id,
|
||||
]
|
||||
}
|
||||
|
||||
# 3. AWX
|
||||
resource "authentik_provider_oauth2" "awx" {
|
||||
name = "AWX Automation"
|
||||
client_id = "awx-client-id"
|
||||
client_secret = "SnarfNetAWXPermanentSecret2026"
|
||||
authorization_flow = var.default_authorization_flow_uuid
|
||||
invalidation_flow = var.default_invalidation_flow_uuid
|
||||
signing_key = var.default_signing_key_uuid
|
||||
redirect_uris = ["https://awx.snarfnet.net/sso/complete/authentik/"]
|
||||
property_mappings = [
|
||||
data.authentik_property_mapping_provider_scope.openid.id,
|
||||
data.authentik_property_mapping_provider_scope.email.id,
|
||||
data.authentik_property_mapping_provider_scope.profile.id,
|
||||
]
|
||||
}
|
||||
|
||||
# 4. Grafana
|
||||
resource "authentik_provider_oauth2" "grafana" {
|
||||
name = "Grafana Monitoring"
|
||||
client_id = "grafana-client-id"
|
||||
client_secret = "SnarfNetGrafanaPermanentSecret2026"
|
||||
authorization_flow = var.default_authorization_flow_uuid
|
||||
invalidation_flow = var.default_invalidation_flow_uuid
|
||||
signing_key = var.default_signing_key_uuid
|
||||
redirect_uris = ["https://grafana.snarfnet.net/login/generic_oauth"]
|
||||
property_mappings = [
|
||||
data.authentik_provider_mapping_provider_scope.openid.id,
|
||||
data.authentik_property_mapping_provider_scope.email.id,
|
||||
data.authentik_property_mapping_provider_scope.profile.id,
|
||||
]
|
||||
}
|
||||
|
||||
# 5. Zabbix
|
||||
resource "authentik_provider_oauth2" "zabbix" {
|
||||
name = "Zabbix Monitoring"
|
||||
client_id = "zabbix-client-id"
|
||||
client_secret = "SnarfNetZabbixPermanentSecret2026"
|
||||
authorization_flow = var.default_authorization_flow_uuid
|
||||
invalidation_flow = var.default_invalidation_flow_uuid
|
||||
signing_key = var.default_signing_key_uuid
|
||||
redirect_uris = ["https://zabbix.snarfnet.net/index_sso.php"]
|
||||
property_mappings = [
|
||||
data.authentik_property_mapping_provider_scope.openid.id,
|
||||
data.authentik_property_mapping_provider_scope.email.id,
|
||||
data.authentik_property_mapping_provider_scope.profile.id,
|
||||
]
|
||||
}
|
||||
|
||||
# 6. Coder Workspaces
|
||||
resource "authentik_provider_oauth2" "coder" {
|
||||
name = "Coder Workspaces"
|
||||
client_id = "coder-client-id"
|
||||
client_secret = "SnarfNetCoderPermanentSecret2026"
|
||||
authorization_flow = var.default_authorization_flow_uuid
|
||||
invalidation_flow = var.default_invalidation_flow_uuid
|
||||
signing_key = var.default_signing_key_uuid
|
||||
redirect_uris = ["https://coder.snarfnet.net/api/v2/users/oidc/callback"]
|
||||
property_mappings = [
|
||||
data.authentik_property_mapping_provider_scope.openid.id,
|
||||
data.authentik_property_mapping_provider_scope.email.id,
|
||||
data.authentik_property_mapping_provider_scope.profile.id,
|
||||
]
|
||||
}
|
||||
|
||||
# 7. Semaphore UI
|
||||
resource "authentik_provider_oauth2" "semaphore" {
|
||||
name = "Semaphore UI"
|
||||
client_id = "semaphore-client-id"
|
||||
client_secret = "SnarfNetSemaphorePermanentSecret2026"
|
||||
authorization_flow = var.default_authorization_flow_uuid
|
||||
invalidation_flow = var.default_invalidation_flow_uuid
|
||||
signing_key = var.default_signing_key_uuid
|
||||
redirect_uris = ["https://semaphore.snarfnet.net/api/auth/oidc/authentik/redirect"]
|
||||
property_mappings = [
|
||||
data.authentik_property_mapping_provider_scope.openid.id,
|
||||
data.authentik_property_mapping_provider_scope.email.id,
|
||||
data.authentik_property_mapping_provider_scope.profile.id,
|
||||
]
|
||||
}
|
||||
|
||||
# 8. Synology DSM
|
||||
resource "authentik_provider_oauth2" "synology" {
|
||||
name = "Synology DSM"
|
||||
client_id = "synology-client-id"
|
||||
client_secret = "SnarfNetSynologyPermanentSecret2026"
|
||||
authorization_flow = var.default_authorization_flow_uuid
|
||||
invalidation_flow = var.default_invalidation_flow_uuid
|
||||
signing_key = var.default_signing_key_uuid
|
||||
redirect_uris = ["https://nas.snarfnet.net/entry.cgi", "https://snarfnas.snarfnet.net/entry.cgi"]
|
||||
property_mappings = [
|
||||
data.authentik_property_mapping_provider_scope.openid.id,
|
||||
data.authentik_property_mapping_provider_scope.email.id,
|
||||
data.authentik_property_mapping_provider_scope.profile.id,
|
||||
]
|
||||
}
|
||||
17
terraform/authentik/outputs.tf
Normal file
17
terraform/authentik/outputs.tf
Normal file
@@ -0,0 +1,17 @@
|
||||
output "authentik_applications" {
|
||||
description = "Configured Authentik application slugs"
|
||||
value = [
|
||||
authentik_application.argocd.slug,
|
||||
authentik_application.gitea.slug,
|
||||
authentik_application.awx.slug,
|
||||
authentik_application.grafana.slug,
|
||||
authentik_application.zabbix.slug,
|
||||
authentik_application.coder.slug,
|
||||
authentik_application.semaphore.slug,
|
||||
authentik_application.synology.slug,
|
||||
authentik_application.gotify.slug,
|
||||
authentik_application.peanut.slug,
|
||||
authentik_application.homebox.slug,
|
||||
authentik_application.npm.slug,
|
||||
]
|
||||
}
|
||||
7
terraform/authentik/policies.tf
Normal file
7
terraform/authentik/policies.tf
Normal file
@@ -0,0 +1,7 @@
|
||||
# Conditional MFA & Security Policies
|
||||
resource "authentik_policy_password" "default" {
|
||||
name = "homelab-password-policy"
|
||||
length_min = 12
|
||||
error_message = "Password must be at least 12 characters long."
|
||||
check_have_i_been_pwned = false
|
||||
}
|
||||
21
terraform/authentik/providers.tf
Normal file
21
terraform/authentik/providers.tf
Normal file
@@ -0,0 +1,21 @@
|
||||
terraform {
|
||||
required_version = ">= 1.5.0"
|
||||
required_providers {
|
||||
authentik = {
|
||||
source = "goauthentik/authentik"
|
||||
version = "~> 2024.10"
|
||||
}
|
||||
}
|
||||
|
||||
backend "http" {
|
||||
address = "https://git.snarfnet.net/api/packages/snarf/terraform/state/authentik"
|
||||
lock_address = "https://git.snarfnet.net/api/packages/snarf/terraform/state/authentik/lock"
|
||||
unlock_address = "https://git.snarfnet.net/api/packages/snarf/terraform/state/authentik/lock"
|
||||
username = "snarf"
|
||||
}
|
||||
}
|
||||
|
||||
provider "authentik" {
|
||||
url = var.authentik_url
|
||||
token = var.authentik_token
|
||||
}
|
||||
35
terraform/authentik/proxy_providers.tf
Normal file
35
terraform/authentik/proxy_providers.tf
Normal file
@@ -0,0 +1,35 @@
|
||||
# 1. Gotify Web UI ForwardAuth
|
||||
resource "authentik_provider_proxy" "gotify" {
|
||||
name = "Gotify ForwardAuth"
|
||||
authorization_flow = var.default_authorization_flow_uuid
|
||||
invalidation_flow = var.default_invalidation_flow_uuid
|
||||
external_host = "https://gotify.snarfnet.net"
|
||||
mode = "forward_single"
|
||||
}
|
||||
|
||||
# 2. Peanut UPS Dashboard ForwardAuth
|
||||
resource "authentik_provider_proxy" "peanut" {
|
||||
name = "Peanut ForwardAuth"
|
||||
authorization_flow = var.default_authorization_flow_uuid
|
||||
invalidation_flow = var.default_invalidation_flow_uuid
|
||||
external_host = "https://peanut.snarfnet.net"
|
||||
mode = "forward_single"
|
||||
}
|
||||
|
||||
# 3. Homebox Inventory ForwardAuth
|
||||
resource "authentik_provider_proxy" "homebox" {
|
||||
name = "Homebox ForwardAuth"
|
||||
authorization_flow = var.default_authorization_flow_uuid
|
||||
invalidation_flow = var.default_invalidation_flow_uuid
|
||||
external_host = "https://homebox.snarfnet.net"
|
||||
mode = "forward_single"
|
||||
}
|
||||
|
||||
# 4. Nginx Proxy Manager Admin ForwardAuth
|
||||
resource "authentik_provider_proxy" "npm" {
|
||||
name = "NPM Admin ForwardAuth"
|
||||
authorization_flow = var.default_authorization_flow_uuid
|
||||
invalidation_flow = var.default_invalidation_flow_uuid
|
||||
external_host = "https://nginx.snarfnet.net"
|
||||
mode = "forward_single"
|
||||
}
|
||||
30
terraform/authentik/variables.tf
Normal file
30
terraform/authentik/variables.tf
Normal file
@@ -0,0 +1,30 @@
|
||||
variable "authentik_url" {
|
||||
type = string
|
||||
description = "Base URL for the Authentik instance"
|
||||
default = "https://authentik.snarfnet.net"
|
||||
}
|
||||
|
||||
variable "authentik_token" {
|
||||
type = string
|
||||
description = "API Token for Authentik automation"
|
||||
default = "SnarfNetPermanentAutomationToken2026"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "default_authorization_flow_uuid" {
|
||||
type = string
|
||||
description = "Default OAuth authorization flow UUID"
|
||||
default = "38a86ef3-f43a-4756-8f54-ca008a8eef6e"
|
||||
}
|
||||
|
||||
variable "default_invalidation_flow_uuid" {
|
||||
type = string
|
||||
description = "Default OAuth invalidation flow UUID"
|
||||
default = "7a8145b8-2476-4636-9901-825f826df805"
|
||||
}
|
||||
|
||||
variable "default_signing_key_uuid" {
|
||||
type = string
|
||||
description = "Default RSA signing key certificate UUID"
|
||||
default = "6d48ba88-4b51-428f-903c-93334988a941"
|
||||
}
|
||||
Reference in New Issue
Block a user