tirbofish/kitgit

# kitgit OIDC application for Authentik (production: tirbo.fish)
# Replace PLACEHOLDER_* values to match deploy/.env.prod before first apply.
version: 1
metadata:
  name: kitgit-oidc
entries:
  - model: authentik_providers_oauth2.oauth2provider
    id: kitgit-provider
    state: present
    identifiers:
      name: kitgit
    attrs:
      name: kitgit
      client_type: confidential
      client_id: kitgit
      client_secret: PLACEHOLDER_OIDC_CLIENT_SECRET
      redirect_uris:
        - matching_mode: strict
          url: https://git.tirbo.fish/auth/callback
      include_claims_in_id_token: true
      sub_mode: user_username
      issuer_mode: per_provider
      access_code_validity: minutes=10
      access_token_validity: hours=1
      refresh_token_validity: days=30
      authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
      signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
      property_mappings:
        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]

  - model: authentik_core.application
    id: kitgit-app
    state: present
    identifiers:
      slug: kitgit
    attrs:
      name: kitgit
      slug: kitgit
      provider: !KeyOf kitgit-provider
      policy_engine_mode: any
      meta_launch_url: https://git.tirbo.fish/

  - model: authentik_core.token
    id: kitgit-api-token
    state: present
    identifiers:
      identifier: kitgit-api
    attrs:
      identifier: kitgit-api
      intent: api
      expiring: false
      description: kitgit service API token for user registration
      user: !Find [authentik_core.user, [username, akadmin]]
      key: PLACEHOLDER_AUTHENTIK_API_TOKEN

  - model: authentik_stages_identification.identificationstage
    id: default-authentication-identification
    state: present
    identifiers:
      name: default-authentication-identification
    attrs:
      name: default-authentication-identification
      user_fields:
        - username
        - email
      captcha_stage: null