fix: core-cli OAuth2 + S3 backend + admin group

- Link core-cli app to OAuth2 provider (was hardcoded to 0)
- Add core-cli user to authentik_admins for CI access
- Fix terraform init: use 'endpoint' not 'endpoints.s3' for S3 backend
  (Terraform 1.9.4 compatibility, matches state.tf config)

.forgejo/workflows/terraform-apply.yml

@@ -80,8 +80,6 @@ jobs:
       - name: Terraform Init
         working-directory: terraform
         env:
-          # MinIO S3 backend — use internal DNS (storage ns) instead of external hostname
-          # Runner pod blocked from external DNS; internal DNS is routable
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           TF_VAR_kubeconfig_path: /tmp/kubeconfig
@@ -89,8 +87,8 @@ jobs:
           TF_SKIP_REGION_VALIDATION: "true"
           TF_SKIP_REQUESTING_ACCOUNT_ID: "true"
         run: |
-          # Override S3 endpoint to use internal cluster DNS
-          export TF_CLI_ARGS_init="-backend-config=endpoints.s3=http://minio.storage.svc.cluster.local:9000"
+          # Override S3 endpoint to use internal cluster DNS (storage ns)
+          export TF_CLI_ARGS_init="-backend-config=endpoint=http://minio.storage.svc.cluster.local:9000"
           terraform init
 
       - name: Pull Terraform State

terraform/authentik-generated.tf

@@ -25,7 +25,7 @@ resource "authentik_group" "authentik_admins" {
   name         = "authentik Admins"
   parent       = null
   roles        = null
-  users        = [5, 4]
+  users        = [5, 4, 38]
 }
 
 # __generated__ by Terraform from "5"
@@ -137,7 +137,7 @@ resource "authentik_application" "core_cli_app" {
   name                  = "core-cli"
   open_in_new_tab       = false
   policy_engine_mode    = "any"
-  protocol_provider     = 0
+  protocol_provider     = authentik_provider_oauth2.core_cli_provider.id
   slug                  = "core-cli"
   uuid                  = "f15c69b4-414b-49da-9e65-eef0a0dbf1ee"
 }

terraform/state.tf

@@ -4,9 +4,7 @@ terraform {
     bucket                      = "terraform-state"
     key                         = "homelab/terraform.tfstate"
     region                      = "us-east-1"
-    endpoints = {
-      s3 = "https://minio-api.riotpiao.homelab.com"
-    }
+    endpoint = "https://minio-api.riotpiao.homelab.com"
     profile                     = "minio"
     skip_credentials_validation = true
     skip_requesting_account_id  = true