52 lines
2.9 KiB
Markdown
52 lines
2.9 KiB
Markdown
# Authentik Local Bootstrap
|
|
|
|
This directory stores local Authentik bootstrap assets for NODE.DC.
|
|
|
|
## Current scope
|
|
|
|
The first infra pass runs Authentik from the official Docker Compose shape for the 2026.2 release line:
|
|
|
|
- PostgreSQL 16;
|
|
- authentik server;
|
|
- authentik worker;
|
|
- no Redis service in the current official compose template;
|
|
- Caddy reverse proxy in front of Authentik and current local apps.
|
|
|
|
## Bootstrap variables
|
|
|
|
For a first local install, put these variables in `infra/.env`:
|
|
|
|
```bash
|
|
AUTHENTIK_BOOTSTRAP_EMAIL=admin@nodedc.local
|
|
AUTHENTIK_BOOTSTRAP_PASSWORD=<local generated password>
|
|
AUTHENTIK_BOOTSTRAP_TOKEN=<local generated token>
|
|
```
|
|
|
|
These are read only on first startup. Do not commit `infra/.env`.
|
|
|
|
## Future blueprint work
|
|
|
|
Later phases should add reproducible configuration for:
|
|
|
|
- NODE.DC Launcher Application/Provider;
|
|
- NODE.DC Task Manager Application/Provider;
|
|
- groups and policies;
|
|
- admin service token scope;
|
|
- exports or blueprints for repeatable setup.
|
|
|
|
## NODE.DC branded login
|
|
|
|
`custom-templates/branding/nodedc-login.css` is mounted into Authentik at `/templates/branding/nodedc-login.css`, but it must not be stored in the native Authentik Brand `branding_custom_css` field.
|
|
|
|
Authentik Brand custom CSS is global. Authentik also passes it into the Admin/User web component runtime, so broad login selectors can break list pages, toolbars, tables, and other Admin interface content. Keep `Brand.branding_custom_css` empty in local bootstrap and Synology deploy scripts.
|
|
|
|
`custom-templates/base/header_js.html` keeps Authentik's native config script and applies the NODE.DC favicon globally. It renders NODE.DC auth-screen CSS/DOM helpers only on `/if/flow/`, `/flows/`, and `/login/` paths, and excludes technical admin hosts such as `auth-admin.nas.nodedc` / `auth-admin.local.nodedc`. On public auth paths only, it also passes `nodedc-login.css` into `window.authentik.brand` so Authentik's Lit web components can style their shadow DOM. Admin and User paths receive an empty runtime brand CSS value.
|
|
|
|
`custom-templates/base/skeleton.html` leaves `<style data-id="brand-css">` empty outside flow/login paths as a second guard. `custom-templates/if/admin.html` tracks Authentik's upstream Admin shell while still including `base/header_js.html`, so module execution sees the sanitized brand config without rewriting Admin markup.
|
|
|
|
OAuth2 providers are assigned Authentik's `default-invalidation-flow` so application logout completes the IdP session and returns through the NODE.DC launcher route instead of showing the default Authentik application logout screen.
|
|
|
|
The bootstrap admin must belong to the `authentik Admins` group, and that group must have `is_superuser=True`. Without this, `/if/admin/` can render the admin shell while model list pages appear empty because their API calls are denied.
|
|
|
|
This is intentionally not an HTML-rewriting proxy. Passwords, MFA, recovery, sessions and audit remain inside Authentik; Launcher and Task Manager stay OIDC clients.
|