feat(iam): wire all 9 consumer manifests to Zitadel OIDC #71

2026-10-26T04:10:57Z

rock commented

2026-10-26 04:10:57 +00:00

Summary

Replace Authentik OIDC endpoints with Zitadel in 9 consumer manifests
Write Zitadel client IDs/secrets into plain manifests and SOPS secrets
Adopt homarr-oidc into SOPS
Fix cloudflared init container CA mount path (homelab-ca.crt -> ca.crt)
Remove Authentik ingress and cloudflared tunnel entry

Verification

structural-check: 0 errors, 8 warnings (pre-existing unpinned images)
Zitadel discovery: 200 after tunnel fix
All 12 OIDC clients live

## Summary - Replace Authentik OIDC endpoints with Zitadel in 9 consumer manifests - Write Zitadel client IDs/secrets into plain manifests and SOPS secrets - Adopt homarr-oidc into SOPS - Fix cloudflared init container CA mount path (homelab-ca.crt -> ca.crt) - Remove Authentik ingress and cloudflared tunnel entry ## Verification - structural-check: 0 errors, 8 warnings (pre-existing unpinned images) - Zitadel discovery: 200 after tunnel fix - All 12 OIDC clients live

rock added 1 commit 2026-10-26 04:10:58 +00:00

feat(iam): wire all 9 consumer manifests to Zitadel OIDC 990e312825

- Replace Authentik issuer/auth/token/userinfo URLs with Zitadel endpoints
  in grafana, minio, paperless-ai, paperless-ai-new, homarr, argocd, blackbox
- Write Zitadel client IDs/secrets into plain manifests and SOPS secrets
  (grafana, minio, paperless, homarr)
- Adopt homarr-oidc into SOPS (homarr-auth-oidc.enc.yaml)
- Add homarr to SECRET_MAP and remove from MANUAL_ONLY in zitadel-provision.py
- Make client-id regex idempotent for repeated runs (minio, paperless)
- Fix cloudflared init container CA mount path (homelab-ca.crt -> ca.crt)
- Remove Authentik ingress and cloudflared tunnel entry

rock merged commit a02bee50e2 into main

2026-10-26 04:34:57 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#71