konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

feat(youtrack): YouTrack Server, LAN only, login through Authentik #1534

Open
hermes-bot wants to merge 5 commits from feat/youtrack into main
pull from: feat/youtrack
merge into: :main
Conversation 2 Commits 5 Files Changed 13
+351
5 Commits
Author SHA1 Message Date
hermes-bot 14dc5247b7 fix(youtrack): OIDC client as an OIDCClient resource, not Ingress annotations
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details 
Uses the OIDCClient CRD from #1535; the Ingress carries only routing and
DNS again. The Flux Kustomization treats OIDCClient as current on apply,
since its Ready reflects Authentik state (the group), as with KumaMonitor.
 2026-11-01 09:31:45 +00:00
hermes-bot 68d1a174db fix(youtrack): OIDC client from authentik-gate-sync, no blueprint
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details 
The provider, application and group policy are now created by
authentik-gate-sync from the Ingress annotations auth.renner.uno/oidc-client
and auth.renner.uno/group (#1535); the youtrack.yaml blueprint is gone.
The group YouTrack Users stays managed in Authentik.
 2026-11-01 09:22:40 +00:00
hermes-bot 7efc62e216 fix(youtrack): take the YouTrack Users group out of the blueprint
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was canceled
Details 
Groups are managed in Authentik itself. The blueprint now only binds the
application to the group by name (!Find).

The YouTrack entries move to their own blueprint (youtrack.yaml). Authentik
imports a blueprint atomically (importer.py apply() runs _apply_models in
one transaction), so while the group does not exist the whole YouTrack
blueprint rolls back: no provider, no application, login closed. In the
shared OAuth2 blueprint the same miss would also have blocked every other
provider.
 2026-11-01 09:16:22 +00:00
hermes-bot f50b33cadf fix(youtrack): manage YouTrack Users members in Authentik, not the blueprint
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline failed
Details 
Same as Wiki Readers: the blueprint only ensures the group exists, because
the application's policy binding refers to it; membership is edited in
Authentik.
 2026-11-01 08:45:40 +00:00
hermes-bot f96737c576 feat(youtrack): YouTrack Server, LAN only, login through Authentik
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was canceled
Details 
Namespace youtrack: jetbrains/youtrack 2026.2.19728 (digest-pinned), one
replica with Recreate, PVC youtrack (data/conf/logs/backups as subPaths),
Velero youtrack-daily plus restore-youtrack like the other apps.

The Ingress carries only dns.renner.uno/internal, so the UDM gets a record
and netbird-service-sync publishes nothing: the host is not reachable from
the internet until login goes through Authentik and a later PR adds the
public label.

Authentik blueprint: group YouTrack Users, confidential OIDC provider
(client_id youtrack; YouTrack's OpenID Connect auth module requires a
client secret), application slug youtrack, bound to the group.

YouTrack Server has no documented unattended first install (2026.2 docs:
the Configuration Wizard is mandatory, the skip flag exists for upgrades
only), so the wizard and the auth module are a one-time owner step,
accepted by the owner.
 2026-11-01 08:42:43 +00:00