From ab103f00f07d4086af15fe3509efd7da894b48ad Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 15 Jul 2026 19:09:59 -0700
Subject: [PATCH] fix: core-cli OAuth2 + S3 backend + admin group

- Link core-cli app to OAuth2 provider (was hardcoded to 0)
- Add core-cli user to authentik_admins for CI access
- Fix terraform init: use 'endpoint' not 'endpoints.s3' for S3 backend
  (Terraform 1.9.4 compatibility, matches state.tf config)
---
 .forgejo/workflows/terraform-apply.yml | 6 ++----
 terraform/authentik-generated.tf       | 4 ++--
 terraform/state.tf                     | 4 +---
 3 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/.forgejo/workflows/terraform-apply.yml b/.forgejo/workflows/terraform-apply.yml
index 089b6e5..32246e1 100644
--- a/.forgejo/workflows/terraform-apply.yml
+++ b/.forgejo/workflows/terraform-apply.yml
@@ -80,8 +80,6 @@ jobs:
       - name: Terraform Init
         working-directory: terraform
         env:
-          # MinIO S3 backend — use internal DNS (storage ns) instead of external hostname
-          # Runner pod blocked from external DNS; internal DNS is routable
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           TF_VAR_kubeconfig_path: /tmp/kubeconfig
@@ -89,8 +87,8 @@ jobs:
           TF_SKIP_REGION_VALIDATION: "true"
           TF_SKIP_REQUESTING_ACCOUNT_ID: "true"
         run: |
-          # Override S3 endpoint to use internal cluster DNS
-          export TF_CLI_ARGS_init="-backend-config=endpoints.s3=http://minio.storage.svc.cluster.local:9000"
+          # Override S3 endpoint to use internal cluster DNS (storage ns)
+          export TF_CLI_ARGS_init="-backend-config=endpoint=http://minio.storage.svc.cluster.local:9000"
           terraform init
 
       - name: Pull Terraform State
diff --git a/terraform/authentik-generated.tf b/terraform/authentik-generated.tf
index 49e4d1a..a13c9b8 100644
--- a/terraform/authentik-generated.tf
+++ b/terraform/authentik-generated.tf
@@ -25,7 +25,7 @@ resource "authentik_group" "authentik_admins" {
   name         = "authentik Admins"
   parent       = null
   roles        = null
-  users        = [5, 4]
+  users        = [5, 4, 38]
 }
 
 # __generated__ by Terraform from "5"
@@ -137,7 +137,7 @@ resource "authentik_application" "core_cli_app" {
   name                  = "core-cli"
   open_in_new_tab       = false
   policy_engine_mode    = "any"
-  protocol_provider     = 0
+  protocol_provider     = authentik_provider_oauth2.core_cli_provider.id
   slug                  = "core-cli"
   uuid                  = "f15c69b4-414b-49da-9e65-eef0a0dbf1ee"
 }
diff --git a/terraform/state.tf b/terraform/state.tf
index b83ef23..510a986 100644
--- a/terraform/state.tf
+++ b/terraform/state.tf
@@ -4,9 +4,7 @@ terraform {
     bucket                      = "terraform-state"
     key                         = "homelab/terraform.tfstate"
     region                      = "us-east-1"
-    endpoints = {
-      s3 = "https://minio-api.riotpiao.homelab.com"
-    }
+    endpoint = "https://minio-api.riotpiao.homelab.com"
     profile                     = "minio"
     skip_credentials_validation = true
     skip_requesting_account_id  = true