fix(llama-gate): name the authentication flow, as Audiobookshelf does

The gate set only authorization_flow, so authentication fell back to Authentik's default flow and the step-up ran on top of a password prompt instead of replacing it — a clumsy sign-in for a UI meant to be opened often. Audiobookshelf and immich set both halves, and that is the pattern to copy for a user-facing app: authentication_flow: passkey-passwordless-authentication authorization_flow: passkey-stepup-authorization Both are referenced with !Find rather than !KeyOf because they are defined in the passkey-stepup document of this ConfigMap, and !KeyOf resolves only within a single document. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Merge pull request 'feat(llama-server): public WebUI behind an Authentik gate' (#736 ) from llama-authentik-gate into master
2026-09-01 21:52:54 +02:00 · 2026-09-01 19:44:15 +00:00
1 changed files with 11 additions and 0 deletions
@@ -907,6 +907,17 @@ data:
          name: llama-gate
        state: present
        attrs:
+          # Both flows, mirroring the Audiobookshelf provider. Setting only
+          # authorization_flow leaves authentication on Authentik's default
+          # flow, which is what made the first login clumsy — the step-up ran
+          # on top of a password prompt instead of replacing it. With the
+          # passwordless flow named explicitly, signing in is the passkey
+          # itself.
+          #
+          # Referenced by !Find rather than !KeyOf: both flows are defined in
+          # the passkey-stepup document of this ConfigMap, and !KeyOf only
+          # resolves within one document.
+          authentication_flow: !Find [authentik_flows.flow, [slug, passkey-passwordless-authentication]]
          authorization_flow: !Find [authentik_flows.flow, [slug, passkey-stepup-authorization]]
          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
          mode: proxy