Fix compose issues. Add host and end early
This commit is contained in:
parent
eee3e7e47b
commit
a5f2f19898
5 changed files with 259 additions and 223 deletions
|
|
@ -74,115 +74,6 @@ entries:
|
|||
evaluate_on_plan: true
|
||||
re_evaluate_policies: false
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# BRANDING
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
||||
- id: kaboot-brand
|
||||
model: authentik_brands.brand
|
||||
identifiers:
|
||||
domain: !Context auth_domain
|
||||
attrs:
|
||||
domain: !Context auth_domain
|
||||
default: false
|
||||
branding_title: Kaboot
|
||||
branding_logo: /media/branding/logo.svg
|
||||
branding_favicon: /media/branding/logo.svg
|
||||
flow_authentication: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
|
||||
flow_invalidation: !KeyOf kaboot-invalidation-flow
|
||||
flow_user_settings: !Find [authentik_flows.flow, [slug, default-user-settings-flow]]
|
||||
default_application: !Find [authentik_core.application, [slug, kaboot]]
|
||||
attributes:
|
||||
settings:
|
||||
theme:
|
||||
base: light
|
||||
css: |
|
||||
:root {
|
||||
--ak-accent: #2563eb;
|
||||
--ak-primary: #2563eb;
|
||||
--ak-primary-dark: #1e40af;
|
||||
--ak-primary-light: #60a5fa;
|
||||
--ak-error: #ef4444;
|
||||
--ak-success: #22c55e;
|
||||
--pf-global--FontFamily--sans-serif: "Inter", system-ui, -apple-system, sans-serif;
|
||||
}
|
||||
body {
|
||||
background-color: #2563eb !important;
|
||||
}
|
||||
.pf-c-login__main {
|
||||
background-color: #ffffff !important;
|
||||
border-radius: 2rem !important;
|
||||
box-shadow: 0 10px 0 rgba(0,0,0,0.1) !important;
|
||||
padding: 3rem !important;
|
||||
max-width: 500px !important;
|
||||
margin: 0 auto;
|
||||
}
|
||||
.pf-c-form-control {
|
||||
border: 2px solid #e5e7eb !important;
|
||||
border-radius: 1rem !important;
|
||||
padding: 0.75rem 1rem !important;
|
||||
font-weight: 600 !important;
|
||||
color: #333 !important;
|
||||
font-size: 1rem !important;
|
||||
box-shadow: none !important;
|
||||
transition: all 0.2s ease !important;
|
||||
}
|
||||
.pf-c-form-control:focus {
|
||||
border-color: #2563eb !important;
|
||||
outline: none !important;
|
||||
}
|
||||
.pf-c-button.pf-m-primary {
|
||||
background-color: #333333 !important;
|
||||
color: #ffffff !important;
|
||||
border: none !important;
|
||||
border-radius: 1rem !important;
|
||||
padding: 0.75rem 1.5rem !important;
|
||||
font-weight: 800 !important;
|
||||
font-size: 1.1rem !important;
|
||||
box-shadow: 0 6px 0 #000000 !important;
|
||||
transform: translateY(0) !important;
|
||||
transition: all 0.1s ease !important;
|
||||
text-transform: uppercase !important;
|
||||
letter-spacing: 0.05em !important;
|
||||
}
|
||||
.pf-c-button.pf-m-primary:hover {
|
||||
background-color: #1a1a1a !important;
|
||||
}
|
||||
.pf-c-button.pf-m-primary:active {
|
||||
transform: translateY(6px) !important;
|
||||
box-shadow: none !important;
|
||||
}
|
||||
.pf-c-button.pf-m-secondary, .pf-c-button.pf-m-link {
|
||||
color: #2563eb !important;
|
||||
font-weight: 600 !important;
|
||||
}
|
||||
.pf-c-title {
|
||||
font-weight: 900 !important;
|
||||
color: #111827 !important;
|
||||
text-align: center !important;
|
||||
margin-bottom: 1.5rem !important;
|
||||
}
|
||||
.pf-c-brand {
|
||||
filter: drop-shadow(0 4px 6px rgba(0,0,0,0.1));
|
||||
}
|
||||
.pf-c-alert {
|
||||
border-radius: 1rem !important;
|
||||
border: 2px solid transparent !important;
|
||||
box-shadow: 0 4px 0 rgba(0,0,0,0.05) !important;
|
||||
}
|
||||
.pf-c-alert.pf-m-danger {
|
||||
background-color: #fef2f2 !important;
|
||||
border-color: #fca5a5 !important;
|
||||
color: #991b1b !important;
|
||||
}
|
||||
.pf-c-login__main-footer-links-item-link {
|
||||
color: #6b7280 !important;
|
||||
font-weight: 500 !important;
|
||||
}
|
||||
.pf-c-background-image {
|
||||
display: none !important;
|
||||
}
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# FLOW BACKGROUNDS
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
|
@ -299,6 +190,115 @@ entries:
|
|||
negate: false
|
||||
timeout: 30
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# BRANDING (must be after application is created)
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
||||
- id: kaboot-brand
|
||||
model: authentik_brands.brand
|
||||
identifiers:
|
||||
domain: !Context auth_domain
|
||||
attrs:
|
||||
domain: !Context auth_domain
|
||||
default: false
|
||||
branding_title: Kaboot
|
||||
branding_logo: /media/branding/logo.svg
|
||||
branding_favicon: /media/branding/logo.svg
|
||||
flow_authentication: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
|
||||
flow_invalidation: !KeyOf kaboot-invalidation-flow
|
||||
flow_user_settings: !Find [authentik_flows.flow, [slug, default-user-settings-flow]]
|
||||
default_application: !KeyOf kaboot-application
|
||||
attributes:
|
||||
settings:
|
||||
theme:
|
||||
base: light
|
||||
css: |
|
||||
:root {
|
||||
--ak-accent: #2563eb;
|
||||
--ak-primary: #2563eb;
|
||||
--ak-primary-dark: #1e40af;
|
||||
--ak-primary-light: #60a5fa;
|
||||
--ak-error: #ef4444;
|
||||
--ak-success: #22c55e;
|
||||
--pf-global--FontFamily--sans-serif: "Inter", system-ui, -apple-system, sans-serif;
|
||||
}
|
||||
body {
|
||||
background-color: #2563eb !important;
|
||||
}
|
||||
.pf-c-login__main {
|
||||
background-color: #ffffff !important;
|
||||
border-radius: 2rem !important;
|
||||
box-shadow: 0 10px 0 rgba(0,0,0,0.1) !important;
|
||||
padding: 3rem !important;
|
||||
max-width: 500px !important;
|
||||
margin: 0 auto;
|
||||
}
|
||||
.pf-c-form-control {
|
||||
border: 2px solid #e5e7eb !important;
|
||||
border-radius: 1rem !important;
|
||||
padding: 0.75rem 1rem !important;
|
||||
font-weight: 600 !important;
|
||||
color: #333 !important;
|
||||
font-size: 1rem !important;
|
||||
box-shadow: none !important;
|
||||
transition: all 0.2s ease !important;
|
||||
}
|
||||
.pf-c-form-control:focus {
|
||||
border-color: #2563eb !important;
|
||||
outline: none !important;
|
||||
}
|
||||
.pf-c-button.pf-m-primary {
|
||||
background-color: #333333 !important;
|
||||
color: #ffffff !important;
|
||||
border: none !important;
|
||||
border-radius: 1rem !important;
|
||||
padding: 0.75rem 1.5rem !important;
|
||||
font-weight: 800 !important;
|
||||
font-size: 1.1rem !important;
|
||||
box-shadow: 0 6px 0 #000000 !important;
|
||||
transform: translateY(0) !important;
|
||||
transition: all 0.1s ease !important;
|
||||
text-transform: uppercase !important;
|
||||
letter-spacing: 0.05em !important;
|
||||
}
|
||||
.pf-c-button.pf-m-primary:hover {
|
||||
background-color: #1a1a1a !important;
|
||||
}
|
||||
.pf-c-button.pf-m-primary:active {
|
||||
transform: translateY(6px) !important;
|
||||
box-shadow: none !important;
|
||||
}
|
||||
.pf-c-button.pf-m-secondary, .pf-c-button.pf-m-link {
|
||||
color: #2563eb !important;
|
||||
font-weight: 600 !important;
|
||||
}
|
||||
.pf-c-title {
|
||||
font-weight: 900 !important;
|
||||
color: #111827 !important;
|
||||
text-align: center !important;
|
||||
margin-bottom: 1.5rem !important;
|
||||
}
|
||||
.pf-c-brand {
|
||||
filter: drop-shadow(0 4px 6px rgba(0,0,0,0.1));
|
||||
}
|
||||
.pf-c-alert {
|
||||
border-radius: 1rem !important;
|
||||
border: 2px solid transparent !important;
|
||||
box-shadow: 0 4px 0 rgba(0,0,0,0.05) !important;
|
||||
}
|
||||
.pf-c-alert.pf-m-danger {
|
||||
background-color: #fef2f2 !important;
|
||||
border-color: #fca5a5 !important;
|
||||
color: #991b1b !important;
|
||||
}
|
||||
.pf-c-login__main-footer-links-item-link {
|
||||
color: #6b7280 !important;
|
||||
font-weight: 500 !important;
|
||||
}
|
||||
.pf-c-background-image {
|
||||
display: none !important;
|
||||
}
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# PASSWORD POLICY
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
|
|
|||
|
|
@ -26,15 +26,109 @@ metadata:
|
|||
|
||||
entries:
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# BRANDING
|
||||
# GROUPS
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
||||
- id: kaboot-users-group
|
||||
model: authentik_core.group
|
||||
identifiers:
|
||||
name: kaboot-users
|
||||
attrs:
|
||||
name: kaboot-users
|
||||
|
||||
- id: kaboot-ai-access-group
|
||||
model: authentik_core.group
|
||||
identifiers:
|
||||
name: kaboot-ai-access
|
||||
attrs:
|
||||
name: kaboot-ai-access
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# GROUPS SCOPE MAPPING
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
||||
- id: groups-scope-mapping
|
||||
model: authentik_providers_oauth2.scopemapping
|
||||
identifiers:
|
||||
managed: goauthentik.io/providers/oauth2/scope-kaboot-groups
|
||||
attrs:
|
||||
name: "Kaboot Groups Scope"
|
||||
scope_name: groups
|
||||
description: "Include user groups in the token"
|
||||
expression: |
|
||||
return [group.name for group in user.ak_groups.all()]
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# OAUTH2/OIDC PROVIDER
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
||||
- id: kaboot-oauth2-provider
|
||||
model: authentik_providers_oauth2.oauth2provider
|
||||
identifiers:
|
||||
name: Kaboot OAuth2
|
||||
attrs:
|
||||
name: Kaboot OAuth2
|
||||
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
||||
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
||||
signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Internal JWT Certificate]]
|
||||
client_type: public
|
||||
client_id: kaboot-spa
|
||||
redirect_uris:
|
||||
- url: http://localhost:5173/callback
|
||||
matching_mode: strict
|
||||
- url: http://localhost:5173/silent-renew.html
|
||||
matching_mode: strict
|
||||
- url: http://localhost:5173
|
||||
matching_mode: strict
|
||||
access_code_validity: minutes=1
|
||||
access_token_validity: minutes=30
|
||||
refresh_token_validity: days=30
|
||||
sub_mode: hashed_user_id
|
||||
include_claims_in_id_token: true
|
||||
issuer_mode: per_provider
|
||||
property_mappings:
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, offline_access]]
|
||||
- !KeyOf groups-scope-mapping
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# APPLICATION
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
||||
- id: kaboot-application
|
||||
model: authentik_core.application
|
||||
identifiers:
|
||||
slug: kaboot
|
||||
attrs:
|
||||
name: Kaboot
|
||||
slug: kaboot
|
||||
provider: !KeyOf kaboot-oauth2-provider
|
||||
policy_engine_mode: any
|
||||
meta_launch_url: http://localhost:5173
|
||||
|
||||
- id: kaboot-group-policy-binding
|
||||
model: authentik_policies.policybinding
|
||||
identifiers:
|
||||
target: !KeyOf kaboot-application
|
||||
group: !KeyOf kaboot-users-group
|
||||
attrs:
|
||||
order: 0
|
||||
enabled: true
|
||||
negate: false
|
||||
timeout: 30
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# BRANDING (must be after application is created)
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
||||
- id: kaboot-brand
|
||||
model: authentik_brands.brand
|
||||
identifiers:
|
||||
domain: localhost
|
||||
domain: authentik-default
|
||||
attrs:
|
||||
domain: localhost
|
||||
domain: authentik-default
|
||||
default: true
|
||||
branding_title: Kaboot
|
||||
branding_logo: /media/branding/logo.svg
|
||||
|
|
@ -42,7 +136,7 @@ entries:
|
|||
flow_authentication: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
|
||||
flow_invalidation: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
|
||||
flow_user_settings: !Find [authentik_flows.flow, [slug, default-user-settings-flow]]
|
||||
default_application: !Find [authentik_core.application, [slug, kaboot]]
|
||||
default_application: !KeyOf kaboot-application
|
||||
attributes:
|
||||
settings:
|
||||
theme:
|
||||
|
|
@ -186,100 +280,6 @@ entries:
|
|||
attrs:
|
||||
background: /media/branding/background.svg
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# GROUPS
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
||||
- id: kaboot-users-group
|
||||
model: authentik_core.group
|
||||
identifiers:
|
||||
name: kaboot-users
|
||||
attrs:
|
||||
name: kaboot-users
|
||||
|
||||
- id: kaboot-ai-access-group
|
||||
model: authentik_core.group
|
||||
identifiers:
|
||||
name: kaboot-ai-access
|
||||
attrs:
|
||||
name: kaboot-ai-access
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# GROUPS SCOPE MAPPING
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
||||
- id: groups-scope-mapping
|
||||
model: authentik_providers_oauth2.scopemapping
|
||||
identifiers:
|
||||
managed: goauthentik.io/providers/oauth2/scope-kaboot-groups
|
||||
attrs:
|
||||
name: "Kaboot Groups Scope"
|
||||
scope_name: groups
|
||||
description: "Include user groups in the token"
|
||||
expression: |
|
||||
return [group.name for group in user.ak_groups.all()]
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# OAUTH2/OIDC PROVIDER
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
||||
- id: kaboot-oauth2-provider
|
||||
model: authentik_providers_oauth2.oauth2provider
|
||||
identifiers:
|
||||
name: Kaboot OAuth2
|
||||
attrs:
|
||||
name: Kaboot OAuth2
|
||||
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
||||
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
||||
signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Internal JWT Certificate]]
|
||||
client_type: public
|
||||
client_id: kaboot-spa
|
||||
redirect_uris:
|
||||
- url: http://localhost:5173/callback
|
||||
matching_mode: strict
|
||||
- url: http://localhost:5173/silent-renew.html
|
||||
matching_mode: strict
|
||||
- url: http://localhost:5173
|
||||
matching_mode: strict
|
||||
access_code_validity: minutes=1
|
||||
access_token_validity: minutes=30
|
||||
refresh_token_validity: days=30
|
||||
sub_mode: hashed_user_id
|
||||
include_claims_in_id_token: true
|
||||
issuer_mode: per_provider
|
||||
property_mappings:
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, offline_access]]
|
||||
- !KeyOf groups-scope-mapping
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# APPLICATION
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
||||
- id: kaboot-application
|
||||
model: authentik_core.application
|
||||
identifiers:
|
||||
slug: kaboot
|
||||
attrs:
|
||||
name: Kaboot
|
||||
slug: kaboot
|
||||
provider: !KeyOf kaboot-oauth2-provider
|
||||
policy_engine_mode: any
|
||||
meta_launch_url: http://localhost:5173
|
||||
|
||||
- id: kaboot-group-policy-binding
|
||||
model: authentik_policies.policybinding
|
||||
identifiers:
|
||||
target: !KeyOf kaboot-application
|
||||
group: !KeyOf kaboot-users-group
|
||||
attrs:
|
||||
order: 0
|
||||
enabled: true
|
||||
negate: false
|
||||
timeout: 30
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# PASSWORD POLICY
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue