Post-X-Society/Post-Tyranny-Tech-Infrastructure
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Post-Tyranny-Tech-Infrastru.../ansible/roles/authentik/tasks/main.yml

39 lines
1.2 KiB
YAML
Raw Normal View History

Add Authentik identity provider to architecture Added Authentik as the identity provider for SSO authentication: Why Authentik: - MIT license (truly open source, most permissive) - Simple Docker Compose deployment (no manual wizards) - Lightweight Python-based architecture - Comprehensive protocol support (SAML, OAuth2/OIDC, LDAP, RADIUS) - No Redis required as of v2025.10 (all caching in PostgreSQL) - Active development and strong community Implementation: - Created complete Authentik Ansible role - Docker Compose with server + worker architecture - PostgreSQL 16 database backend - Traefik integration with Let's Encrypt SSL - Bootstrap tasks for initial setup guidance - Health checks and proper service dependencies Architecture decisions updated: - Documented comparison: Authentik vs Zitadel vs Keycloak - Explained Zitadel removal (FirstInstance bugs) - Added deployment example and configuration notes Next steps: - Update documentation (PROJECT_REFERENCE.md, README.md) - Create Authentik agent configuration - Add secrets template - Test deployment on test server 🤖 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-07 11:23:13 +01:00
---
# Main tasks file for Authentik role
- name: Include Docker Compose setup
include_tasks: docker.yml
- name: Include bootstrap setup
include_tasks: bootstrap.yml
when: authentik_bootstrap | default(true)
feat: Complete Authentik SSO integration with automated OIDC setup ## Changes ### Identity Provider (Authentik) - ✅ Deployed Authentik 2025.10.3 as identity provider - ✅ Configured automatic bootstrap with admin account (akadmin) - ✅ Fixed OIDC provider creation with correct redirect_uris format - ✅ Added automated OAuth2/OIDC provider configuration for Nextcloud - ✅ API-driven provider setup eliminates manual configuration ### Nextcloud Configuration - ✅ Fixed reverse proxy header configuration (trusted_proxies) - ✅ Added missing database indices (fs_storage_path_prefix) - ✅ Ran mimetype migrations for proper file type handling - ✅ Verified PHP upload limits (16GB upload_max_filesize) - ✅ Configured OIDC integration with Authentik - ✅ "Login with Authentik" button auto-configured ### Automation Scripts - ✅ Added deploy-client.sh for automated client deployment - ✅ Added rebuild-client.sh for infrastructure rebuild - ✅ Added destroy-client.sh for cleanup - ✅ Full deployment now takes ~10-15 minutes end-to-end ### Documentation - ✅ Updated README with automated deployment instructions - ✅ Added SSO automation workflow documentation - ✅ Added automation status tracking - ✅ Updated project reference with Authentik details ### Technical Fixes - Fixed Authentik API redirect_uris format (requires list of dicts with matching_mode) - Fixed Nextcloud OIDC command (user_oidc:provider not user_oidc:provider:add) - Fixed file lookup in Ansible (changed to slurp for remote files) - Updated Traefik to v3.6 for Docker API 1.44 compatibility - Improved error handling in app installation tasks ## Security - All credentials stored in SOPS-encrypted secrets - Trusted proxy configuration prevents IP spoofing - Bootstrap tokens auto-generated and secured ## Result Fully automated SSO deployment - no manual configuration required! 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-08 16:56:19 +01:00
- name: Include OIDC provider configuration
include_tasks: providers.yml
tags: ['authentik', 'oidc']
feat: Add complete email configuration automation This commit adds comprehensive email configuration for both Authentik and Nextcloud, integrated with Mailgun SMTP credentials. Features Added: - Mailgun role integration in deploy.yml playbook - Authentik email configuration display task - Nextcloud SMTP configuration with admin email setup - Infrastructure prerequisite checking in deploy playbook Changes: - deploy.yml: Added Mailgun role and base infrastructure check - authentik/tasks/email.yml: Display email configuration status - authentik/tasks/main.yml: Include email task when credentials exist - nextcloud/tasks/email.yml: Configure SMTP and admin email - nextcloud/tasks/main.yml: Include email task when credentials exist This ensures: ✓ Mailgun SMTP credentials are created/loaded automatically ✓ Authentik email works via docker-compose environment variables ✓ Nextcloud SMTP is configured via occ commands ✓ Admin email address is set automatically ✓ Email works immediately on new deployments 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-13 10:39:26 +01:00
- name: Include email configuration
include_tasks: email.yml
when: mailgun_smtp_user is defined or (client_secrets.mailgun_smtp_user is defined and client_secrets.mailgun_smtp_user != "" and "PLACEHOLDER" not in client_secrets.mailgun_smtp_user)
tags: ['authentik', 'email']
feat: Add Authentik recovery and invitation flows This commit adds password recovery and user invitation flows for Authentik, enabling users to reset passwords via email and admins to invite users. Features Added: - Recovery flow: Users can request password reset emails - Invitation flow: Admins can send user invitation emails - Python scripts use Authentik API (no hardcoded credentials) - Flows task automatically verifies/creates flows on deployment Changes: - authentik/files/create_recovery_flow.py: Recovery flow script - authentik/files/create_invitation_flow.py: Invitation flow script - authentik/tasks/flows.yml: Flow configuration task - authentik/tasks/main.yml: Include flows task This ensures: ✓ Password recovery emails work automatically ✓ User invitations work automatically ✓ Flows are configured on every deployment ✓ No hardcoded credentials (uses bootstrap token) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-13 10:43:16 +01:00
Remove automated recovery flow configuration Automated recovery flow setup via blueprints was too complex and unreliable. Recovery flows (password reset via email) must now be configured manually in Authentik admin UI. Changes: - Removed recovery-flow.yaml blueprint - Removed configure_recovery_flow.py script - Removed update-recovery-flow.yml playbook - Updated flows.yml to remove recovery references - Updated custom-flows.yaml to remove brand recovery flow config - Updated comments to reflect manual recovery flow requirement Automated configuration still includes: - Enrollment flow with invitation support - 2FA/MFA enforcement - OIDC provider for Nextcloud - Email configuration via SMTP 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-17 09:57:07 +01:00
- name: Include flows configuration (invitation, 2FA)
feat: Add Authentik recovery and invitation flows This commit adds password recovery and user invitation flows for Authentik, enabling users to reset passwords via email and admins to invite users. Features Added: - Recovery flow: Users can request password reset emails - Invitation flow: Admins can send user invitation emails - Python scripts use Authentik API (no hardcoded credentials) - Flows task automatically verifies/creates flows on deployment Changes: - authentik/files/create_recovery_flow.py: Recovery flow script - authentik/files/create_invitation_flow.py: Invitation flow script - authentik/tasks/flows.yml: Flow configuration task - authentik/tasks/main.yml: Include flows task This ensures: ✓ Password recovery emails work automatically ✓ User invitations work automatically ✓ Flows are configured on every deployment ✓ No hardcoded credentials (uses bootstrap token) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-13 10:43:16 +01:00
include_tasks: flows.yml
when: authentik_bootstrap | default(true)
tags: ['authentik', 'flows']
feat: Add automated 2FA/MFA enforcement for Authentik Implements automatic configuration of 2FA enforcement via Authentik API: **Features:** - Forces users to configure TOTP authenticator on first login - Supports multiple 2FA methods: TOTP, WebAuthn, Static backup codes - Idempotent: detects existing configuration and skips update - Fully automated via Ansible deployment **Implementation:** - New task file: ansible/roles/authentik/tasks/mfa.yml - Updates default-authentication-mfa-validation stage via API - Sets not_configured_action to "configure" - Links default-authenticator-totp-setup as configuration stage **Configuration:** ```yaml not_configured_action: configure device_classes: [totp, webauthn, static] configuration_stages: [default-authenticator-totp-setup] ``` **Testing:** ✅ Deployed to dev server successfully ✅ MFA enforcement verified via API ✅ Status: "Already configured" (idempotent check works) Users will now be required to set up 2FA on their next login. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-14 16:11:08 +01:00
- name: Include MFA/2FA enforcement configuration
include_tasks: mfa.yml
when: authentik_bootstrap | default(true)
tags: ['authentik', 'mfa', '2fa']
feat: Add automated invitation stage configuration for Authentik Implements automatic invitation stage creation and enrollment flow binding: **Features:** - Creates invitation stage via YAML blueprint - Binds stage to enrollment flow (designation: enrollment) - Allows enrollment to proceed without invitation token - Fully automated via Ansible deployment **Implementation:** - New blueprint: ansible/roles/authentik/files/invitation-flow.yaml - New task file: ansible/roles/authentik/tasks/invitation.yml - Blueprint creates invitationstage model - Binds stage to enrollment flow at order=0 **Blueprint Configuration:** ```yaml model: authentik_stages_invitation.invitationstage name: default-enrollment-invitation continue_flow_without_invitation: true ``` **Testing:** ✅ Deployed to dev server successfully ✅ Invitation stage created and verified ✅ Stage bound to default-source-enrollment flow ✅ Verification: {"found": true, "count": 1} Resolves Authentik warning: "No invitation stage is bound to any flow" 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-14 16:17:44 +01:00
- name: Include invitation stage configuration
include_tasks: invitation.yml
when: authentik_bootstrap | default(true)
tags: ['authentik', 'invitation']
feat: Enable automated password recovery flow configuration Add recovery.yml task include to main.yml to enable automated password recovery flow setup. This calls the recovery.yml tasks which use create_recovery_flow.py to configure: - Password complexity policy (12+ chars, mixed case, digit, symbol) - Recovery identification stage (username/email) - Recovery email stage (30-minute token expiry) - Integration with default authentication flow - "Forgot password?" link on login page This restores automated recovery flow setup that was previously removed when the blueprint-based approach was abandoned. The new approach uses direct API calls via Python script which is more reliable than blueprints. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-20 18:22:02 +01:00
- name: Include password recovery flow configuration
include_tasks: recovery.yml
when: authentik_bootstrap | default(true)
tags: ['authentik', 'recovery']
Reference in a new issue Copy permalink