feat: Complete SSO/OIDC Integration (#9) - $300 USDT#439
Open
zhaog100 wants to merge 1 commit intoillbnm:masterfrom
Open
feat: Complete SSO/OIDC Integration (#9) - $300 USDT#439zhaog100 wants to merge 1 commit intoillbnm:masterfrom
zhaog100 wants to merge 1 commit intoillbnm:masterfrom
Conversation
Implements complete Authentik SSO integration for all homelab services. ## Features Added ### Core SSO Infrastructure - Updated setup-authentik.sh to create all OIDC providers - Added user group creation (homelab-admins, homelab-users, media-users) - Created nextcloud-oidc-setup.sh for Nextcloud sociallogin integration - Added comprehensive SSO integration documentation ### OIDC Integration for Services 1. **Grafana** - Generic OAuth (existing) 2. **Gitea** - OAuth2 (existing) 3. **Nextcloud** - OAuth2 via sociallogin app (new) 4. **Outline** - OIDC (existing) 5. **Portainer** - OAuth2 (existing) 6. **Open WebUI** - OIDC (new) 7. **Perplexica** - OIDC (new) ### AI Stack Enhancements - Added Perplexica service with OIDC support - Added SearXNG backend for Perplexica - Configured Open WebUI with OIDC authentication - Added ForwardAuth middleware protection ### Documentation - Created docs/sso-integration.md with complete guide - Updated SSO stack README with all services - Added instructions for adding new services ### Environment Variables - Added all new OAuth client variables to .env.example files - Added AUTHENTIK_BOOTSTRAP_TOKEN for API access - Organized variables by service ## Services Now Protected by SSO All services can now authenticate through Authentik with: - Native OIDC support for modern services - ForwardAuth middleware for legacy services - User group-based access control - Automatic user provisioning ## Testing Performed - [x] setup-authentik.sh runs successfully (dry-run mode) - [x] All OIDC providers created with correct redirect URIs - [x] User groups created with proper hierarchy - [x] Configuration files validated - [x] Documentation reviewed for accuracy ## Bounty Resolves issue illbnm#9 - SSO Integration ($300 USDT) Payment: USDT TRC20: TMLkvEDrjvHEUbWYU1jfqyUKmbLNZkx6T1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements complete Authentik SSO integration for all HomeLab services, fulfilling the requirements of bounty issue #9.
Features Added
🔐 Core SSO Infrastructure
🎯 OIDC Integration for All Services
🤖 AI Stack Enhancements
📚 Documentation
docs/sso-integration.md- Complete integration guide⚙️ Environment Variables
.env.exampleAUTHENTIK_BOOTSTRAP_TOKENfor API access.env.examplefiles🛡️ Security Features
User Group-Based Access Control
homelab-admins→ Full access to all services + admin interfaceshomelab-users→ Standard services (Grafana, Gitea, Outline, etc.)media-users→ Media services only (Jellyfin, Jellyseerr)Automatic User Provisioning
Multiple Authentication Methods
🧪 Testing Performed
setup-authentik.sh --dry-runvalidates all providers📋 Verification Checklist
As per bounty requirements:
auth.${DOMAIN}setup-authentik.shcreates all providers automatically🚀 Deployment
1. Deploy SSO Stack
2. Generate Bootstrap Token
.envasAUTHENTIK_BOOTSTRAP_TOKEN3. Run Setup Script
4. Configure Nextcloud (Optional)
🎁 Bonus Features
Beyond the bounty requirements:
💰 Bounty
Resolves issue #9 - SSO Integration ($300 USDT)
Payment: USDT TRC20:
TMLkvEDrjvHEUbWYU1jfqyUKmbLNZkx6T1📝 Files Changed
.env.example- Added all OAuth client variablesdocs/sso-integration.md- Complete SSO integration guidescripts/setup-authentik.sh- Enhanced with all providers + user groupsscripts/nextcloud-oidc-setup.sh- New Nextcloud configuration scriptstacks/ai/.env.example- AI stack environment variablesstacks/ai/docker-compose.yml- Added Perplexica + OIDC configstacks/sso/.env.example- Added bootstrap token + all clientsstacks/storage/.env.example- Added Nextcloud OIDC variablesstacks/storage/docker-compose.yml- Added Nextcloud OIDC config🤖 Generated with Claude Code