SILVER
/
NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
NODEDC_PLATFORM/infra/authentik/README.md

2.9 KiB
Raw Blame History

Authentik Local Bootstrap

This directory stores local Authentik bootstrap assets for NODE.DC.

Current scope

The first infra pass runs Authentik from the official Docker Compose shape for the 2026.2 release line:

  • PostgreSQL 16;
  • authentik server;
  • authentik worker;
  • no Redis service in the current official compose template;
  • Caddy reverse proxy in front of Authentik and current local apps.

Bootstrap variables

For a first local install, put these variables in infra/.env:

AUTHENTIK_BOOTSTRAP_EMAIL=admin@nodedc.local
AUTHENTIK_BOOTSTRAP_PASSWORD=<local generated password>
AUTHENTIK_BOOTSTRAP_TOKEN=<local generated token>

These are read only on first startup. Do not commit infra/.env.

Future blueprint work

Later phases should add reproducible configuration for:

  • NODE.DC Launcher Application/Provider;
  • NODE.DC Task Manager Application/Provider;
  • groups and policies;
  • admin service token scope;
  • exports or blueprints for repeatable setup.

NODE.DC branded login

custom-templates/branding/nodedc-login.css is mounted into Authentik at /templates/branding/nodedc-login.css, but it must not be stored in the native Authentik Brand branding_custom_css field.

Authentik Brand custom CSS is global. Authentik also passes it into the Admin/User web component runtime, so broad login selectors can break list pages, toolbars, tables, and other Admin interface content. Keep Brand.branding_custom_css empty in local bootstrap and Synology deploy scripts.

custom-templates/base/header_js.html keeps Authentik's native config script and applies the NODE.DC favicon globally. It renders NODE.DC auth-screen CSS/DOM helpers only on /if/flow/, /flows/, and /login/ paths, and excludes technical admin hosts such as auth-admin.nas.nodedc / auth-admin.local.nodedc. On public auth paths only, it also passes nodedc-login.css into window.authentik.brand so Authentik's Lit web components can style their shadow DOM. Admin and User paths receive an empty runtime brand CSS value.

custom-templates/base/skeleton.html leaves <style data-id="brand-css"> empty outside flow/login paths as a second guard. custom-templates/if/admin.html tracks Authentik's upstream Admin shell while still including base/header_js.html, so module execution sees the sanitized brand config without rewriting Admin markup.

OAuth2 providers are assigned Authentik's default-invalidation-flow so application logout completes the IdP session and returns through the NODE.DC launcher route instead of showing the default Authentik application logout screen.

The bootstrap admin must belong to the authentik Admins group, and that group must have is_superuser=True. Without this, /if/admin/ can render the admin shell while model list pages appear empty because their API calls are denied.

This is intentionally not an HTML-rewriting proxy. Passwords, MFA, recovery, sessions and audit remain inside Authentik; Launcher and Task Manager stay OIDC clients.