2 commits

Author	SHA1	Message	Date
Pieter	8c3553d89f	feat: Add Authentik recovery and invitation flows ... This commit adds password recovery and user invitation flows for Authentik, enabling users to reset passwords via email and admins to invite users. Features Added: - Recovery flow: Users can request password reset emails - Invitation flow: Admins can send user invitation emails - Python scripts use Authentik API (no hardcoded credentials) - Flows task automatically verifies/creates flows on deployment Changes: - authentik/files/create_recovery_flow.py: Recovery flow script - authentik/files/create_invitation_flow.py: Invitation flow script - authentik/tasks/flows.yml: Flow configuration task - authentik/tasks/main.yml: Include flows task This ensures: ✓ Password recovery emails work automatically ✓ User invitations work automatically ✓ Flows are configured on every deployment ✓ No hardcoded credentials (uses bootstrap token) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2026-01-13 10:43:16 +01:00
Pieter	a5fe631717	feat: Complete Authentik SSO integration with automated OIDC setup ... ## Changes ### Identity Provider (Authentik) - ✅ Deployed Authentik 2025.10.3 as identity provider - ✅ Configured automatic bootstrap with admin account (akadmin) - ✅ Fixed OIDC provider creation with correct redirect_uris format - ✅ Added automated OAuth2/OIDC provider configuration for Nextcloud - ✅ API-driven provider setup eliminates manual configuration ### Nextcloud Configuration - ✅ Fixed reverse proxy header configuration (trusted_proxies) - ✅ Added missing database indices (fs_storage_path_prefix) - ✅ Ran mimetype migrations for proper file type handling - ✅ Verified PHP upload limits (16GB upload_max_filesize) - ✅ Configured OIDC integration with Authentik - ✅ "Login with Authentik" button auto-configured ### Automation Scripts - ✅ Added deploy-client.sh for automated client deployment - ✅ Added rebuild-client.sh for infrastructure rebuild - ✅ Added destroy-client.sh for cleanup - ✅ Full deployment now takes ~10-15 minutes end-to-end ### Documentation - ✅ Updated README with automated deployment instructions - ✅ Added SSO automation workflow documentation - ✅ Added automation status tracking - ✅ Updated project reference with Authentik details ### Technical Fixes - Fixed Authentik API redirect_uris format (requires list of dicts with matching_mode) - Fixed Nextcloud OIDC command (user_oidc:provider not user_oidc:provider:add) - Fixed file lookup in Ansible (changed to slurp for remote files) - Updated Traefik to v3.6 for Docker API 1.44 compatibility - Improved error handling in app installation tasks ## Security - All credentials stored in SOPS-encrypted secrets - Trusted proxy configuration prevents IP spoofing - Bootstrap tokens auto-generated and secured ## Result Fully automated SSO deployment - no manual configuration required! 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2026-01-08 16:56:19 +01:00