tenant-converge should set/verify Authentik external_url after provisioning #11

New issue

Closed

opened 2026-08-12 05:02:30 +00:00 by deepnet-bot · 1 comment

deepnet-bot commented

2026-08-12 05:02:30 +00:00

Problem

The authentik.nix module does not set AUTHENTIK_EXTERNAL_URL, so every tenant's Authentik falls back to http://0.0.0.0:9000 for redirect URLs. This breaks all forward_auth flows — apps behind enable-forward-auth redirect to http://0.0.0.0:9000 instead of https://auth.<domain>.

Fix committed in infra-template (authentik.nix now sets the env var). But dito tenant-converge should ALSO set/verify the external_url in Authentik's system settings during the sso or authentik-admin-token phase, as defense-in-depth.

Suggested fix

After provisioning Authentik (authentik-admin-token phase), the converge should:

Set external_url to https://auth.<clientDomain> via the Authentik API or ak-shell
Verify it returns the correct value on subsequent converges
Warn if it's empty or mismatched

This catches the case where the NixOS env var isn't set (e.g., older module versions) or where someone manually cleared it.

infra-template #21 — the env var fix (committed)
Affects ALL tenants (deepnet, ild, gal, sjc)
Operator reported: "this seems to happen a lot across all my apps"

## Problem The `authentik.nix` module does not set `AUTHENTIK_EXTERNAL_URL`, so every tenant's Authentik falls back to `http://0.0.0.0:9000` for redirect URLs. This breaks all forward_auth flows — apps behind `enable-forward-auth` redirect to `http://0.0.0.0:9000` instead of `https://auth.<domain>`. Fix committed in infra-template (authentik.nix now sets the env var). But `dito tenant-converge` should ALSO set/verify the `external_url` in Authentik's system settings during the `sso` or `authentik-admin-token` phase, as defense-in-depth. ## Suggested fix After provisioning Authentik (authentik-admin-token phase), the converge should: 1. Set `external_url` to `https://auth.<clientDomain>` via the Authentik API or `ak-shell` 2. Verify it returns the correct value on subsequent converges 3. Warn if it's empty or mismatched This catches the case where the NixOS env var isn't set (e.g., older module versions) or where someone manually cleared it. ## Related - infra-template #21 — the env var fix (committed) - Affects ALL tenants (deepnet, ild, gal, sjc) - Operator reported: "this seems to happen a lot across all my apps"

jsutter commented

2026-08-14 20:37:47 +00:00

Owner

Fixed in dit-operator PR #266 (merged). The authentik_admin_token phase now probes, converges, and verifies external_url = https://auth..

Fixed in dit-operator PR #266 (merged). The authentik_admin_token phase now probes, converges, and verifies external_url = https://auth.<domain>.

jsutter closed this issue

2026-08-14 20:37:47 +00:00

No labels

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

deepnet/dit-releases#11

No description provided.

Rows
Columns