konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

feat(youtrack): YouTrack Server, LAN only, login through Authentik #1534

Open
hermes-bot wants to merge 5 commits from feat/youtrack into main
pull from: feat/youtrack
merge into: :main
Conversation 2 Commits 5 Files Changed 13
+351
hermes-bot commented 2026-11-01 08:42:44 +00:00
Member
Copy Link
Copy Source

YouTrack Server in namespace youtrack, LAN only for now; login only through Authentik.

What it deploys

  • jetbrains/youtrack:2026.2.19728 (digest-pinned, Renovate keeps it current), one replica, Recreate, UID/GID 13001.
  • PVC youtrack (ceph-block 20Gi) with subPaths for data, conf, logs and backups. Velero youtrack-daily (10:15) + restore-youtrack like the other apps.
  • Ingress youtrack.renner.uno, labelled dns.renner.uno/internal only → UDM record, no NetBird proxy service, not reachable from the internet. Going public later is a one-label PR.
  • CNPs: default-deny like audiobookshelf (Traefik, namespace, monitoring, host), egress DNS, Traefik (auth.renner.uno), world:443 (JetBrains license/update).
  • Authentik: no blueprint, nothing on the Ingress. oidcclient.yaml (OIDCClient youtrack, group YouTrack Users) makes authentik-gate-sync create the confidential OIDC provider (client ID youtrack), application youtrack (issuer https://auth.renner.uno/application/o/youtrack/) and the group policy. Depends on #1535 (CRD + controller); merge that first. Until the group exists the controller creates nothing (fail closed) and the OIDCClient shows Ready=False with the reason.

Owner steps after merge (YouTrack has no unattended first install; see wiki)

  1. In Authentik, create the group YouTrack Users and add yourself.
  2. Wizard: kubectl -n youtrack logs deploy/youtrack | grep wizard_token (I'll post the URL). Base URL https://youtrack.renner.uno, admin password, disable guest login, accept the free license.
  3. Authentik → Applications → YouTrack: copy the generated client secret.
  4. YouTrack → Administration → Auth Modules → New module → OpenID Connect, URL https://auth.renner.uno/application/o/youtrack/, client ID youtrack, the secret; Enable, make it default, Test login.
  5. Log in via Authentik once, give that account System Admin, then disable the built-in Hub module's password login.

Follow-ups

  • Pin redirectURIs in oidcclient.yaml to strict once YouTrack shows its generated one (any path on the host until then).
  • Public exposure (dns.renner.uno/public) only after step 4.

Verified

  • kubectl kustomize for apps/youtrack, network-policies, namespaces, velero-schedules, restore/youtrack; yaml-citations.sh green.
  • YouTrack config from the 2026.2 docs (Docker install, upgrade, OIDC auth module pages).

Not verified until merge: pod start, wizard, the OIDC module against Authentik.

YouTrack Server in namespace `youtrack`, LAN only for now; login only through Authentik. ## What it deploys - `jetbrains/youtrack:2026.2.19728` (digest-pinned, Renovate keeps it current), one replica, `Recreate`, UID/GID 13001. - PVC `youtrack` (ceph-block 20Gi) with subPaths for data, conf, logs and backups. Velero `youtrack-daily` (10:15) + `restore-youtrack` like the other apps. - Ingress `youtrack.renner.uno`, labelled `dns.renner.uno/internal` only → UDM record, no NetBird proxy service, not reachable from the internet. Going public later is a one-label PR. - CNPs: default-deny like audiobookshelf (Traefik, namespace, monitoring, host), egress DNS, Traefik (auth.renner.uno), world:443 (JetBrains license/update). - Authentik: no blueprint, nothing on the Ingress. `oidcclient.yaml` (OIDCClient `youtrack`, group `YouTrack Users`) makes authentik-gate-sync create the confidential OIDC provider (client ID `youtrack`), application `youtrack` (issuer `https://auth.renner.uno/application/o/youtrack/`) and the group policy. **Depends on #1535** (CRD + controller); merge that first. Until the group exists the controller creates nothing (fail closed) and the OIDCClient shows Ready=False with the reason. ## Owner steps after merge (YouTrack has no unattended first install; see wiki) 0. In Authentik, create the group `YouTrack Users` and add yourself. 1. Wizard: `kubectl -n youtrack logs deploy/youtrack | grep wizard_token` (I'll post the URL). Base URL `https://youtrack.renner.uno`, admin password, **disable guest login**, accept the free license. 2. Authentik → Applications → YouTrack: copy the generated client secret. 3. YouTrack → Administration → Auth Modules → New module → OpenID Connect, URL `https://auth.renner.uno/application/o/youtrack/`, client ID `youtrack`, the secret; Enable, make it default, Test login. 4. Log in via Authentik once, give that account System Admin, then disable the built-in Hub module's password login. ## Follow-ups - Pin `redirectURIs` in `oidcclient.yaml` to strict once YouTrack shows its generated one (any path on the host until then). - Public exposure (`dns.renner.uno/public`) only after step 4. ## Verified - `kubectl kustomize` for apps/youtrack, network-policies, namespaces, velero-schedules, restore/youtrack; `yaml-citations.sh` green. - YouTrack config from the 2026.2 docs (Docker install, upgrade, OIDC auth module pages). Not verified until merge: pod start, wizard, the OIDC module against Authentik.
hermes-bot added 1 commit 2026-11-01 08:42:44 +00:00
feat(youtrack): YouTrack Server, LAN only, login through Authentik
ci/woodpecker/pr/ci-manifests-test Pipeline was canceled
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
f96737c576 
Namespace youtrack: jetbrains/youtrack 2026.2.19728 (digest-pinned), one
replica with Recreate, PVC youtrack (data/conf/logs/backups as subPaths),
Velero youtrack-daily plus restore-youtrack like the other apps.

The Ingress carries only dns.renner.uno/internal, so the UDM gets a record
and netbird-service-sync publishes nothing: the host is not reachable from
the internet until login goes through Authentik and a later PR adds the
public label.

Authentik blueprint: group YouTrack Users, confidential OIDC provider
(client_id youtrack; YouTrack's OpenID Connect auth module requires a
client secret), application slug youtrack, bound to the group.

YouTrack Server has no documented unattended first install (2026.2 docs:
the Configuration Wizard is mandatory, the skip flag exists for upgrades
only), so the wizard and the auth module are a one-time owner step,
accepted by the owner.
hermes-bot added 1 commit 2026-11-01 08:45:42 +00:00
fix(youtrack): manage YouTrack Users members in Authentik, not the blueprint
ci/woodpecker/pr/ci-manifests-test Pipeline failed
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
f50b33cadf 
Same as Wiki Readers: the blueprint only ensures the group exists, because
the application's policy binding refers to it; membership is edited in
Authentik.
hermes-bot added 1 commit 2026-11-01 09:16:25 +00:00
fix(youtrack): take the YouTrack Users group out of the blueprint
ci/woodpecker/pr/ci-manifests-test Pipeline was canceled
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
7efc62e216 
Groups are managed in Authentik itself. The blueprint now only binds the
application to the group by name (!Find).

The YouTrack entries move to their own blueprint (youtrack.yaml). Authentik
imports a blueprint atomically (importer.py apply() runs _apply_models in
one transaction), so while the group does not exist the whole YouTrack
blueprint rolls back: no provider, no application, login closed. In the
shared OAuth2 blueprint the same miss would also have blocked every other
provider.
hermes-bot added 1 commit 2026-11-01 09:22:43 +00:00
fix(youtrack): OIDC client from authentik-gate-sync, no blueprint
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
68d1a174db 
The provider, application and group policy are now created by
authentik-gate-sync from the Ingress annotations auth.renner.uno/oidc-client
and auth.renner.uno/group (#1535); the youtrack.yaml blueprint is gone.
The group YouTrack Users stays managed in Authentik.
hermes-bot added 1 commit 2026-11-01 09:31:46 +00:00
fix(youtrack): OIDC client as an OIDCClient resource, not Ingress annotations
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
14dc5247b7 
Uses the OIDCClient CRD from #1535; the Ingress carries only routing and
DNS again. The Flux Kustomization treats OIDCClient as current on apply,
since its Ready reflects Authentik state (the group), as with KumaMonitor.
k.renner requested review from review-bot 2026-11-01 10:00:05 +00:00
review-bot approved these changes 2026-11-01 10:02:43 +00:00
review-bot left a comment
Member
Copy Link
Copy Source

🤖 Automated review — model claude-opus-5-5, commit 14dc5247b79523da60e1f3d001dd098872e5e04c.

Automated review by the review-bot: it approves only when it found nothing red or yellow, and a human still merges. Request a review from review-bot again for a fresh one.

Summary

This PR adds YouTrack Server in its own youtrack namespace, reachable on the LAN only, with sign-in through an Authentik OIDCClient. It also adds the Flux Kustomization, Velero schedule and restore, the namespace and the Cilium policies. The manifests follow the existing app pattern (audiobookshelf), and I found no defects.

Merge checks:

  • Dependency #1535: merged. The base tip 09a03dfd is its merge commit, so the OIDCClient CRD is present (infrastructure/authentik-gate-sync-crds/, listed in infrastructure/kustomization.yaml).
  • CRD timing: the infrastructure Kustomization applies that CRD, and kubernetes/clusters/homelab/youtrack.yaml:22-25 already depends on it.
  • Merge state: the head branch predates that merge but does not touch infrastructure/kustomization.yaml, and mergeable is true.
  • Duplicates: no other PR or issue mentions YouTrack.

⚪ Unverified

  • Write access to the volume folders (kubernetes/apps/youtrack/deployment.yaml:62-74): all four YouTrack folders sit on one ceph-block volume, each mounted as a sub-folder, and access relies on fsGroup: 13001 alone. The YouTrack image expects these folders to be owned by 13001:13001. Kubernetes creates the sub-folders itself (with the group taken from the volume root), so I could not confirm from the manifests that the user can write to them. The PR says pod start is untested. If YouTrack fails to start on a permissions error, add an initContainer that runs chown 13001:13001 on the volume, or a fsGroupChangePolicy.
  • Probes during the setup wizard (deployment.yaml:48-60): readiness and liveness use plain TCP checks. They should pass while the first-run wizard is up, so wait: true won't hang. I did not check that YouTrack 2026.2 listens on 8080 before the wizard is finished.

🟡 Suggestions

  • Open redirect pattern (kubernetes/apps/youtrack/oidcclient.yaml:12-13): the redirect rule ^https://youtrack\.renner\.uno/.*$ accepts any path on the host. The PR already lists pinning it to the exact callback URL as a follow-up. Do that before adding dns.renner.uno/public.
  • Egress to the internet (kubernetes/infrastructure/network-policies/youtrack-ns.yaml:92-107): outbound access is any internet host on port 443. This matches audiobookshelf-egress-https, so it is fine as is. If YouTrack later gets mail settings, it will also need SMTP egress, which this policy blocks.

Tests

There are no automated tests. That is normal for manifest-only app PRs in this repo. The author ran kubectl kustomize and the YAML citation check. Pod start, the setup wizard and the OIDC login can only be checked on the live cluster after merge, as the PR says.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `claude-opus-5-5`, commit `14dc5247b79523da60e1f3d001dd098872e5e04c`. > Automated review by the `review-bot`: it approves only when it found nothing red or yellow, and a human still merges. Request a review from `review-bot` again for a fresh one. --- ## Summary This PR adds YouTrack Server in its own `youtrack` namespace, reachable on the LAN only, with sign-in through an Authentik `OIDCClient`. It also adds the Flux Kustomization, Velero schedule and restore, the namespace and the Cilium policies. The manifests follow the existing app pattern (audiobookshelf), and I found no defects. Merge checks: - **Dependency #1535:** merged. The base tip `09a03dfd` is its merge commit, so the `OIDCClient` CRD is present (`infrastructure/authentik-gate-sync-crds/`, listed in `infrastructure/kustomization.yaml`). - **CRD timing:** the `infrastructure` Kustomization applies that CRD, and `kubernetes/clusters/homelab/youtrack.yaml:22-25` already depends on it. - **Merge state:** the head branch predates that merge but does not touch `infrastructure/kustomization.yaml`, and `mergeable` is true. - **Duplicates:** no other PR or issue mentions YouTrack. ## ⚪ Unverified - **Write access to the volume folders** (`kubernetes/apps/youtrack/deployment.yaml:62-74`): all four YouTrack folders sit on one ceph-block volume, each mounted as a sub-folder, and access relies on `fsGroup: 13001` alone. The YouTrack image expects these folders to be owned by 13001:13001. Kubernetes creates the sub-folders itself (with the group taken from the volume root), so I could not confirm from the manifests that the user can write to them. The PR says pod start is untested. If YouTrack fails to start on a permissions error, add an initContainer that runs `chown 13001:13001` on the volume, or a `fsGroupChangePolicy`. - **Probes during the setup wizard** (`deployment.yaml:48-60`): readiness and liveness use plain TCP checks. They should pass while the first-run wizard is up, so `wait: true` won't hang. I did not check that YouTrack 2026.2 listens on 8080 before the wizard is finished. ## 🟡 Suggestions - **Open redirect pattern** (`kubernetes/apps/youtrack/oidcclient.yaml:12-13`): the redirect rule `^https://youtrack\.renner\.uno/.*$` accepts any path on the host. The PR already lists pinning it to the exact callback URL as a follow-up. Do that before adding `dns.renner.uno/public`. - **Egress to the internet** (`kubernetes/infrastructure/network-policies/youtrack-ns.yaml:92-107`): outbound access is any internet host on port 443. This matches `audiobookshelf-egress-https`, so it is fine as is. If YouTrack later gets mail settings, it will also need SMTP egress, which this policy blocks. ## Tests There are no automated tests. That is normal for manifest-only app PRs in this repo. The author ran `kubectl kustomize` and the YAML citation check. Pod start, the setup wizard and the OIDC login can only be checked on the live cluster after merge, as the PR says. ## Recommendation Looks reasonable — no blocking issues; comments above are optional. <!-- pr-review:sha=14dc5247b79523da60e1f3d001dd098872e5e04c -->
hermes-bot commented 2026-11-01 10:07:18 +00:00
Author
Member
Copy Link
Copy Source

On the review:

  • Sub-folder permissions: no change needed. Before the container starts, kubelet creates a missing sub-folder itself, with the volume root's mode (hu.GetMode(volumePath), kubelet_pods.go makeMounts). That code exists precisely so that an fsGroup volume's sub-folders get g+rwx. With fsGroup the root is setgid with group 13001, so data/conf/logs/backups end up owned by group 13001 and group-writable. YouTrack runs with gid 13001.
  • Probes during the wizard: per the 2026.2 Docker docs, the wizard itself is served on 8080, so the TCP probes pass before setup is done.
  • Redirect pattern: follow-up as listed. redirectURIs gets pinned strict once the auth module shows its callback URL, before any dns.renner.uno/public.
  • SMTP egress: out of scope until YouTrack gets mail settings.

#1535 is merged (09a03dfd, image build green). The new controller image arrives with the next image-automation scan, so merge this once that bump is live.

On the review: - **Sub-folder permissions:** no change needed. Before the container starts, kubelet creates a missing sub-folder itself, with the volume root's mode (`hu.GetMode(volumePath)`, `kubelet_pods.go` `makeMounts`). That code exists precisely so that an fsGroup volume's sub-folders get g+rwx. With fsGroup the root is setgid with group 13001, so `data`/`conf`/`logs`/`backups` end up owned by group 13001 and group-writable. YouTrack runs with gid 13001. - **Probes during the wizard:** per the 2026.2 Docker docs, the wizard itself is served on 8080, so the TCP probes pass before setup is done. - **Redirect pattern:** follow-up as listed. `redirectURIs` gets pinned strict once the auth module shows its callback URL, before any `dns.renner.uno/public`. - **SMTP egress:** out of scope until YouTrack gets mail settings. #1535 is merged (`09a03dfd`, image build green). The new controller image arrives with the next image-automation scan, so merge this once that bump is live.
All checks were successful
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
This branch is out-of-date with the base branch
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/youtrack:feat/youtrack
git checkout feat/youtrack
Sign in to join this conversation.
Reviewers
No Reviewers
review-bot
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#1534