feat(iam): wire all 9 consumer manifests to Zitadel OIDC

Co-authored-by: rock <[email protected]>
2026-10-26 04:34:51 +00:00
parent f9af686c36
commit a02bee50e2
15 changed files with 108 additions and 134 deletions
@@ -33,8 +33,6 @@ data:
    ingress:
      - hostname: paperless.riotpiao.com
        service: https://paperless.riotpiao.com
-      - hostname: authentik.riotpiao.com
-        service: https://authentik.riotpiao.com
      - hostname: img.riotpiao.com
        service: https://img.riotpiao.com
      - hostname: riotpiao.com
@@ -26,7 +26,7 @@ spec:
          command:
            - sh
            - -c
-            - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/homelab-ca.crt) > /merged/ca-bundle.crt
+            - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/ca.crt) > /merged/ca-bundle.crt
          volumeMounts:
            - name: homelab-ca
              mountPath: /homelab-ca
@@ -29,12 +29,12 @@ replicaCount: 1
 # Chart supports these via top-level env dict (not array)
 env:
  AUTH_PROVIDERS: "oidc,credentials"
-  AUTH_OIDC_ISSUER: "https://authentik.riotpiao.com/application/o/homarr/"
+  AUTH_OIDC_ISSUER: "https://zitadel.riotpiao.com"
  # AUTH_OIDC_URI (authorize endpoint) is REQUIRED in addition to ISSUER — homarr
  # hides the "Sign in with Authentik" button entirely when it's absent (per the
  # authentik Homarr integration + homarr SSO docs). This was the missing var.
-  AUTH_OIDC_URI: "https://authentik.riotpiao.com/application/o/authorize/"
-  AUTH_OIDC_CLIENT_NAME: "Authentik"
+  AUTH_OIDC_URI: "https://zitadel.riotpiao.com/oauth/v2/authorize"
+  AUTH_OIDC_CLIENT_NAME: "Zitadel"
  AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
  AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
  AUTH_OIDC_AUTO_LOGIN: "false"
@@ -49,9 +49,9 @@ spec:
              echo "[init] Fetching JWT token from Authentik for paperless-ai-agent..."
              
              # Get JWT token via client_credentials grant
-              TOKEN_RESPONSE=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+              TOKEN_RESPONSE=$(curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
                -d "grant_type=client_credentials" \
-                -d "client_id=paperless-ai-agent" \
+                -d "client_id=396757803559027071" \
                -d "client_secret=29skAhE0tBzWn0qrPvmPTQMva0joFjcCr7msDQr_VXQ" \
                -d "scope=openid llm:inference" 2>/dev/null)
              
@@ -43,9 +43,9 @@ spec:
              
              # Get JWT token via client_credentials grant
              # Client secret sourced from environment (injected from paperless-ai-config Secret)
-              TOKEN_RESPONSE=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+              TOKEN_RESPONSE=$(curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
                -d "grant_type=client_credentials" \
-                -d "client_id=paperless-ai-agent" \
+                -d "client_id=396757803559027071" \
                -d "client_secret=${LLM_AUTH_CLIENT_SECRET}" \
                -d "scope=openid llm:inference" 2>/dev/null)