From a5c7381c1128781c596dbf4cf033970578b98746 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 26 Aug 2026 16:42:44 -0700
Subject: [PATCH] feat: add Vault as an Authentik OIDC app for human/CLI login

Confidential client for 'vault login -method=oidc' and the Vault UI's
oidc auth method. homelab-admins gets bound automatically like every
other app in SERVICES. Client secret generated on first provision run
into iam/vault-oidc.
---
 k8s/infra/iam/scripts/authentik-provision.py | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/k8s/infra/iam/scripts/authentik-provision.py b/k8s/infra/iam/scripts/authentik-provision.py
index 702b0b7..7e5c249 100644
--- a/k8s/infra/iam/scripts/authentik-provision.py
+++ b/k8s/infra/iam/scripts/authentik-provision.py
@@ -394,6 +394,22 @@ SERVICES = {
         "launch_url": "https://img.riotpiao.com",
         "display_name": "Immich",
     },
+    "vault": {
+        # Human/CLI login only (`vault login -method=oidc`) - not wired to any
+        # workload. No secret exists yet - generate + store on first run.
+        # localhost:8250/oidc/callback is the vault CLI's documented fixed
+        # callback port for `vault login -method=oidc`; the other is the
+        # browser/UI flow's callback path (mount path "oidc").
+        "client_secret_source": ("iam", "vault-oidc", "CLIENT_SECRET"),
+        "generate_if_missing": True,
+        "extra_secret_literals": {"client-id": "vault"},
+        "redirect_uris": [
+            "https://vault.riotpiao.com/ui/vault/auth/oidc/oidc/callback",
+            "http://localhost:8250/oidc/callback",
+        ],
+        "launch_url": "https://vault.riotpiao.com",
+        "display_name": "Vault",
+    },
 }
 
 app_pks_for_binding = []