BlumeOps Docs

Deploy Authentik Identity Provider

2 min read

Deploy Authentik Identity Provider

Replace Dex with Authentik as the SSO identity provider. Authentik is the source of truth for user identity in BlumeOps. Users are created and managed in Authentik; services authenticate against it via OIDC.

Architecture Decisions

DecisionChoiceRationale
Identity modelAuthentik is source of truthCentral user/group management, not Forgejo-upstream like Dex
Clusterringtail (k3s)IdP independent of main services cluster, same as Dex
DatabaseCNPG blumeops-pg on indriCross-cluster via Caddy L4 (pg.ops.eblu.me), no new operator needed
RedisCo-deployed in authentik namespaceRequired for caching/sessions/task queue
ContainersNix-built (dockerTools.buildLayeredImage)Supply chain control, consistent with Dex/ntfy pattern
ManifestsKustomize (no Helm)Consistent with all other BlumeOps services
NetworkingTailscale Ingress + Caddy reverse proxySame pattern as Dex
IaCAuthentik Blueprints (YAML in ConfigMap)GitOps-native, config stored in repo

Deployment Process

  1. Build a Nix container image — Authentik needs coreutils and bashInteractive alongside the main package; the entrypoint wrapper must symlink built-in blueprint directories so custom blueprints coexist with defaults
  2. Create secrets in 1Password (secret key, DB credentials, OIDC client secrets)
  3. Provision a dedicated database and managed role on the shared CNPG cluster
  4. Deploy server, worker, and Redis as separate deployments
  5. Wire ExternalSecret to pull config from 1Password
  6. Add Tailscale Ingress and Caddy reverse proxy entries
  7. Complete the first-run wizard manually (creates admin account)
  8. Migrate OIDC clients via Blueprints, then decommission the old IdP

URLs

Graph View

Backlinks