ilia/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
ansible/docs/guides/vikunja-authentik-oidc.md
ilia f17a1a3bcc
Some checks failed
CI / skip-ci-check (pull_request) Successful in 7s
Details
CI / lint-and-test (pull_request) Failing after 10s
Details
CI / secret-scanning (pull_request) Successful in 7s
Details
CI / dependency-scan (pull_request) Successful in 16s
Details
CI / sast-scan (pull_request) Successful in 29s
Details
CI / ansible-validation (pull_request) Failing after 54s
Details
CI / license-check (pull_request) Successful in 14s
Details
CI / vault-check (pull_request) Successful in 12s
Details
CI / container-scan (pull_request) Successful in 7s
Details
CI / sonar-analysis (pull_request) Successful in 7s
Details
CI / playbook-test (pull_request) Successful in 25s
Details
CI / workflow-summary (pull_request) Successful in 5s
Details
Add homelab SSO, maintenance cron, and inventory cleanup. 
Cal Authentik OIDC playbook/role (deferred until license), Vikunja OIDC
docs and vault secrets, SSO matrix, mailcow LAN proxy fix, extended
security audit docs, maintenance_cron role with group_vars split, and
inventory updates (vikunja rename, identity/monitoring/cal host_vars).

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-23 20:23:10 -04:00

2.0 KiB
Raw Blame History

Vikunja ↔ Authentik OIDC

Status: Live at https://todo.levkin.ca (host vikunja, 10.0.10.159).

Authentik

Item Value
Application slug vikunja
Redirect URI (strict) https://todo.levkin.ca/auth/openid/authentik
Subject mode Based on the User's username (user_username)
Access group homelab-users (bind to app; policy engine ANY)
Authentik user Purpose Email
admin Authentik admin UI only admin@levkin.ca
ilia Homelab apps (Vikunja, etc.) idobkin@gmail.com

Do not use the same email on both users — Authentik will pick the wrong account.

homelab-users group = ilia only. Vikunja app binding: group homelab-users (policy engine ANY).

Secrets: vault_vikunja_oidc_client_id, vault_vikunja_oidc_client_secret in Ansible vault.

Vikunja

Config: /opt/vikunja/config.yml (mounted in docker-compose.yml).

  • auth.openid.providers.authentik → authurl: https://auth.levkin.ca/application/o/vikunja/
  • usernamefallback: true + emailfallback: true → SSO links to existing local user ilia when Authentik username is ilia.

Local auth stays enabled for break-glass.

Login

  1. Sign out: https://auth.levkin.ca/if/user/logout/
  2. https://todo.levkin.ca → Login with Authentik
  3. Sign in as ilia (username) or idobkin@gmail.com — not admin

My applications: admin only sees apps allowed for superuser (e.g. Cal). ilia sees Vikunja after login.

Adding users

  1. Directory → Users — create user (username should match Vikunja local username if linking).
  2. Directory → Groups → homelab-users — add user.
  3. New Vikunja users: first OIDC login creates account; existing local users need matching username + fallbacks.

Related