phil/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Retire Authentik now that every app logs in with Pocket ID

Browse Source 
All of Authentik's applications (including Tailscale's tailnet login)
have moved to Pocket ID, and its only recent sign-ins were those
handovers. Drops its stack, the auth. route and DNS record, the auth
subdomain variables, Gotify's leftover hairpin entries, and the dockcheck
exclude; the docs now name Pocket ID as the SSO provider.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Phil
2026-10-31 10:07:39 -06:00
co-authored by Claude Opus 5.5
parent 2512f6cb86
commit 9b9be6a2f0
14 changed files with 23 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+6 -6
View File
@@ -60,7 +60,7 @@ ansible-playbook dns.yml -i hosts.yml
```bash
# Deploy specific services using tags (now properly isolated)
ansible-playbook site.yml -i hosts.yml --tags caddy --vault-password-file vault_pass
ansible-playbook site.yml -i hosts.yml --tags authentik --vault-password-file vault_pass
ansible-playbook site.yml -i hosts.yml --tags pocketid --vault-password-file vault_pass
ansible-playbook site.yml -i hosts.yml --tags gitea --vault-password-file vault_pass
ansible-playbook site.yml -i hosts.yml --tags docker --vault-password-file vault_pass # entire docker role
ansible-playbook site.yml -i hosts.yml --tags services --vault-password-file vault_pass # all services only
@@ -90,7 +90,7 @@ ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file
The docker role is now organized into logical service groups under `roles/docker/tasks/`:
- **infrastructure/**: Core platform components
- Caddy (reverse proxy), Authentik (SSO), Dockge (container management)
- Caddy (reverse proxy), Pocket ID (passkey SSO), Dockge (container management)
- **development/**: Development and collaboration tools
- Gitea, ByteStash
- **media/**: Content creation and consumption
@@ -137,7 +137,7 @@ The `dns.yml` playbook manages AWS Route53 records for both domains. All subdoma
- UFW firewall managed through Docker integration script
### Service Dependencies
Many services depend on Authentik for SSO. When deploying new services, consider:
Most services log in through Pocket ID (OIDC, passkeys) at `{{ subdomains.pocketid }}`. When deploying new services, consider:
- Whether SSO integration is needed
- Caddy routing configuration for subdomain access
- Network connectivity requirements within Docker stack
@@ -151,12 +151,12 @@ Services inside Docker containers cannot reach external domains that resolve to
```yaml
extra_hosts:
- "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
- "{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}"
- "{{ subdomains.cal }}:{{ docker.hairpin_ip }}"
```
Common domains requiring hairpinning fixes:
- `{{ subdomains.auth }}` (Authentik SSO)
- `{{ subdomains.pocketid }}` (Pocket ID SSO)
- `{{ subdomains.cal }}` (Baikal CalDAV)
- Any service domain the container needs to communicate with
@@ -192,5 +192,5 @@ networks:
external: true
name: "{{ docker.network_name }}"
extra_hosts:
- "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
- "{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}"
```