Move every OIDC client from Keycloak back to Authelia #452

New issue

Open

opened 2026-10-10 12:39:24 +02:00 by dominik.polakovics · 2 comments

dominik.polakovics commented

2026-10-10 12:39:24 +02:00

Owner

Switch the fleet's OIDC consumers back from Keycloak (sso.cloonar.com) to Authelia (auth.cloonar.com): Grafana, Immich, Nextcloud, Matrix (MAS), Warpgate, OneCLI, Paperless in Nix; Forgejo and FreeScout by hand in their admin UIs. Authelia needs the three clients that only ever existed in Keycloak (onecli, warpgate, paperless), a paperless authorization policy, and FreeScout's regenerated callback /oauth-login/callback/ljux42f7k. Keycloak stays running as the rollback path; its removal is a follow-up.

Switch the fleet's OIDC consumers back from Keycloak (`sso.cloonar.com`) to Authelia (`auth.cloonar.com`): Grafana, Immich, Nextcloud, Matrix (MAS), Warpgate, OneCLI, Paperless in Nix; Forgejo and FreeScout by hand in their admin UIs. Authelia needs the three clients that only ever existed in Keycloak (onecli, warpgate, paperless), a `paperless` authorization policy, and FreeScout's regenerated callback `/oauth-login/callback/ljux42f7k`. Keycloak stays running as the rollback path; its removal is a follow-up.

dominik.polakovics commented

2026-10-10 12:39:52 +02:00

Author

Owner

Fix is pushed on branch fix/freescout-oidc-callback (ea21168c): the freescout client's redirect URI updated in both cloonar-realm.json (Keycloak, live) and authelia.nix (ready for a later switch back). Dry-build of web-arm passed. This run cannot open PRs (labctl pr create route not registered, no claimed issue), so open it from: https://git.cloonar.com/Cloonar/nixos/compare/main...fix/freescout-oidc-callback

Fix is pushed on branch `fix/freescout-oidc-callback` (ea21168c): the `freescout` client's redirect URI updated in both `cloonar-realm.json` (Keycloak, live) and `authelia.nix` (ready for a later switch back). Dry-build of web-arm passed. This run cannot open PRs (`labctl pr create` route not registered, no claimed issue), so open it from: https://git.cloonar.com/Cloonar/nixos/compare/main...fix/freescout-oidc-callback

dominik.polakovics changed title from ~~FreeScout OIDC callback regenerated: register /oauth-login/callback/ljux42f7k on both IdPs~~ to Move every OIDC client from Keycloak back to Authelia

2026-10-10 12:56:50 +02:00

dominik.polakovics commented

2026-10-10 12:57:55 +02:00

Author

Owner

Branch feat/oidc-back-to-authelia (cde71e41) is pushed with the full switch; fix/freescout-oidc-callback is superseded and deleted. This run cannot open PRs (labctl pr create route not registered), so open it from https://git.cloonar.com/Cloonar/nixos/compare/main...feat/oidc-back-to-authelia with Closes #452. Three new client secrets must land in hosts/web-arm/secrets.sops.yaml and hosts/fw/secrets.sops.yaml before deploy; values are in the session transcript, not here.

Branch `feat/oidc-back-to-authelia` (cde71e41) is pushed with the full switch; `fix/freescout-oidc-callback` is superseded and deleted. This run cannot open PRs (`labctl pr create` route not registered), so open it from https://git.cloonar.com/Cloonar/nixos/compare/main...feat/oidc-back-to-authelia with `Closes #452`. Three new client secrets must land in `hosts/web-arm/secrets.sops.yaml` and `hosts/fw/secrets.sops.yaml` before deploy; values are in the session transcript, not here.

dominik.polakovics referenced this issue from a commit

2026-10-26 12:34:03 +01:00

fix(fw,web-arm): make the Warpgate and OneCLI SSO logins work against Authelia

dominik.polakovics referenced this issue

2026-10-26 12:34:24 +01:00

fix(fw,web-arm): make the Warpgate and OneCLI SSO logins work against Authelia #548

dominik.polakovics referenced this issue from a commit

2026-10-26 13:22:17 +01:00

fix(web-arm): hash the deployed OIDC secrets for the onecli, warpgate and paperless clients

dominik.polakovics referenced this issue

2026-10-26 13:22:53 +01:00

fix(web-arm): hash the deployed OIDC secrets for the onecli, warpgate and paperless clients #553