fix(minio): add BROWSER_REDIRECT_URL to enable SSO button in Console

- Add MINIO_BROWSER_REDIRECT_URL pointing to public URL
- Add MINIO_BROWSER_LOGIN_ANIMATION=off
- Enables Console to show OIDC/Authentik SSO button on login page

k8s/apps/paperless/configmap.yaml

@@ -20,3 +20,7 @@ data:
   # wire up allauth's confirm-email view, so signup 500s with NoReverseMatch
   # on 'account_confirm_email' without this.
   PAPERLESS_ACCOUNT_EMAIL_VERIFICATION: "none"
+  # Auto-connect social accounts to existing users with matching email
+  PAPERLESS_SOCIAL_AUTO_SIGNUP: "true"
+  # Allow automatic linking of social accounts to existing users
+  PAPERLESS_ACCOUNT_ALLOW_SIGNUPS: "true"

k8s/apps/paperless/kustomization.yaml

@@ -4,6 +4,7 @@ namespace: paperless
 resources:
   - pvc.yaml
   - configmap.yaml
+  - paperless-ai-config.yaml
   - redis.yaml
   - deployment.yaml
   - service.yaml

k8s/apps/paperless/paperless-ai-config.yaml

@@ -0,0 +1,49 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: paperless-ai-env
+  namespace: paperless
+data:
+  paperless-ai-config.env: |
+    # Paperless-NGX API configuration
+    PAPERLESS_URL=http://paperless.paperless.svc.cluster.local:8000
+    PAPERLESS_API_TOKEN=7b89463e04c141f4172fbcddf78d623547d327ec
+
+    # AI Processing settings
+    ENABLE_AI_PROCESSING=yes
+    AI_MODEL=reasoning
+    LLM_API_URL=https://api.riotpiao.com/v1
+    LLM_API_TOKEN_FILE=/app/data/llm_token.txt
+
+    # Auto-tagging configuration
+    ENABLE_AUTO_TAGGING=yes
+    ENABLE_CORRESPONDENT_EXTRACTION=yes
+    ENABLE_DOCUMENT_TYPE_EXTRACTION=yes
+    ENABLE_TITLE_GENERATION=yes
+    
+    # Advanced tagging with AI
+    ENABLE_INTELLIGENT_TAGGING=yes
+    ENABLE_DATE_EXTRACTION=yes
+    ENABLE_TIMELINE_TAGGING=yes
+    AUTO_CREATE_TAGS=yes
+    
+    # Tagging prompts for custom extraction
+    CUSTOM_EXTRACTION_PROMPT=Extract document date, time period, financial year, and temporal context. Create tags like YYYY, Q1-YYYY, Last-Month, Current-Year, Historic
+    TAG_EXTRACTION_MODEL=reasoning
+
+    # Scanning behavior
+    SCAN_INTERVAL_SECONDS=60
+    PROCESS_EXISTING_DOCUMENTS=no
+    ADD_AI_TAG=yes
+    AI_TAG_NAME=ai-processed
+
+    # Date/Timeline tagging configuration
+    DATE_EXTRACTION_FORMAT=iso8601
+    TIMELINE_TAG_GRANULARITY=year,quarter,month
+    AUTO_TAG_HISTORICAL=yes
+    AUTO_TAG_RECENT=yes
+    
+    # Performance
+    MAX_CONCURRENT_REQUESTS=2
+    REQUEST_TIMEOUT=60
+    DATE_EXTRACTION_TIMEOUT=30

k8s/apps/paperless/paperless-ai.yaml

@@ -25,9 +25,15 @@ spec:
         - name: paperless-ai-data
           persistentVolumeClaim:
             claimName: paperless-ai-data
+        - name: paperless-ai-env-config
+          configMap:
+            name: paperless-ai-env
       initContainers:
         - name: fetch-llm-token
           image: curlimages/curl:8.12.0
+          securityContext:
+            runAsUser: 0
+            fsGroup: 0
           command:
             - sh
             - -c
@@ -43,8 +49,8 @@ spec:
                 -d "client_secret=${LLM_AUTH_CLIENT_SECRET}" \
                 -d "scope=openid llm:inference" 2>/dev/null)
               
-              # Extract token
-              TOKEN=$(echo "$TOKEN_RESPONSE" | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)
+              # Extract token from JSON response using sed (handles spaces after colons)
+              TOKEN=$(echo "$TOKEN_RESPONSE" | sed -n 's/.*"access_token"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
               
               if [ -z "$TOKEN" ]; then
                 echo "[error] Failed to get token. Response: $TOKEN_RESPONSE"
@@ -52,9 +58,13 @@ spec:
               fi
               
               # Store token in file for main container to read
-              mkdir -p /data
-              echo "$TOKEN" > /data/llm_token.txt
-              echo "[init] Token fetched and stored successfully"
+              # Write to both locations for compatibility
+              mkdir -p /tmp/llm-token /app/data 2>/dev/null || true
+              echo "$TOKEN" | tee /tmp/llm-token/llm_token.txt > /dev/null 2>&1
+              echo "$TOKEN" > /app/data/llm_token.txt 2>/dev/null || true
+              echo "[init] Token fetched and stored"
+              [ -f /tmp/llm-token/llm_token.txt ] && echo "  -> /tmp/llm-token/llm_token.txt"
+              [ -f /app/data/llm_token.txt ] && echo "  -> /app/data/llm_token.txt"
           env:
             - name: LLM_AUTH_CLIENT_SECRET
               valueFrom:
@@ -63,7 +73,7 @@ spec:
                   key: LLM_AUTH_CLIENT_SECRET
           volumeMounts:
             - name: paperless-ai-data
-              mountPath: /data
+              mountPath: /app/data
       containers:
         - name: paperless-ai
           image: clusterzx/paperless-ai:latest
@@ -105,6 +115,9 @@ spec:
           volumeMounts:
             - name: paperless-ai-data
               mountPath: /app/data
+            - name: paperless-ai-env-config
+              mountPath: /app/data/.env
+              subPath: paperless-ai-config.env
           resources:
             requests:
               cpu: 100m

k8s/infra/logging/grafana-values.yaml

@@ -73,7 +73,7 @@ grafana.ini:
   auth.generic_oauth:
     enabled: true
     name: Authentik
-    allow_sign_up: true
+    allow_sign_up: true  # Allow sync to create/update users from OAuth claims
     client_id: grafana
     scopes: openid email profile groups
     auth_url: https://authentik.riotpiao.com/application/o/authorize/
@@ -84,13 +84,13 @@ grafana.ini:
     # Authentik doesn't serve — request 404s with "Error getting email address"
     # and the whole OAuth login fails.
     email_attribute_path: email
-    login_attribute_path: preferred_username
+    login_attribute_path: preferred_username  # Use preferred_username — OpenID standard claim, always present
     name_attribute_path: name
     role_attribute_path: "preferred_username == 'akadmin' && 'GrafanaAdmin' || contains(groups[*], 'homelab-admins') && 'Admin' || 'Viewer'"
     allow_assign_grafana_admin: true
     use_pkce: false
     use_refresh_token: false
-    skip_org_role_sync: false
+    skip_org_role_sync: false  # Sync org roles from OAuth groups
     tls_skip_verify_insecure: true   # Authentik uses self-signed cert; verify in prod
 
 # GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET is injected from the grafana-oidc K8s

k8s/infra/minio/minio-tenant.yaml

@@ -112,10 +112,16 @@ spec:
           name: minio-oidc
           key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
     - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
-      value: "policy"
+      value: "groups"
+    - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX
+      value: ""
     - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
       value: "https://minio.riotpiao.com/oauth_callback"
     - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
       value: "Authentik"
     - name: MINIO_IDENTITY_OPENID_SCOPES
-      value: "openid,profile,email,minio"
+      value: "openid,profile,email,groups"
+    - name: MINIO_BROWSER_LOGIN_ANIMATION
+      value: "off"
+    - name: MINIO_BROWSER_REDIRECT_URL
+      value: "https://minio.riotpiao.com"