feat: add argo workflows

tofu/modules/authentik/main.tf

@@ -0,0 +1,45 @@
+terraform {
+  required_providers {
+    authentik = {
+      source  = "goauthentik/authentik"
+      version = "2024.2.0"
+    }
+  }
+}
+data "authentik_flow" "default-authorization-flow" {
+  slug = "default-provider-authorization-implicit-consent"
+}
+
+data "authentik_scope_mapping" "default-scopes" {
+  managed_list = [
+    "goauthentik.io/providers/oauth2/scope-email",
+    "goauthentik.io/providers/oauth2/scope-openid",
+    "goauthentik.io/providers/oauth2/scope-profile",
+    "goauthentik.io/providers/oauth2/scope-offline_access",
+  ]
+}
+
+
+resource "authentik_provider_oauth2" "provider_oidc" {
+  name               = var.app_name
+  client_id          = var.client_id
+  client_secret      = var.client_secret
+  authorization_flow = data.authentik_flow.default-authorization-flow.id
+  redirect_uris      = var.redirect_uris
+  property_mappings  = data.authentik_scope_mapping.default-scopes.ids
+  sub_mode           = var.sub_mode
+  signing_key        = var.oidc_signing_key
+}
+
+
+resource "authentik_application" "app" {
+  name              = var.app_name
+  slug              = var.app_slug
+  protocol_provider = authentik_provider_oauth2.provider_oidc.id
+
+}
+resource "authentik_policy_binding" "app_access" {
+  target = authentik_application.app.uuid
+  group  = var.app_access_group_id
+  order  = 0
+}

tofu/modules/authentik/vars.tf

@@ -0,0 +1,40 @@
+variable "app_name" {
+  description = "App name"
+  type        = string
+}
+
+variable "app_slug" {
+  description = "App slug, a human-readable URL identifier, e.g.: Google -> google"
+  type        = string
+}
+
+variable "client_id" {
+  description = "Client ID"
+  type        = string
+}
+
+variable "client_secret" {
+  description = "Client secret"
+  type        = string
+}
+
+variable "app_access_group_id" {
+  description = "ID of a group which will have access to the app"
+  type        = string
+}
+
+variable "redirect_uris" {
+  description = "List of URIs allowed to redirect to"
+  type        = list(string)
+}
+
+variable "sub_mode" {
+  type = string
+  default = "user_username"
+}
+
+variable "oidc_signing_key" {
+  type        = string
+  description = "Signing key"
+  default     = "c4ff5edf-3cad-4093-9326-44fea088e670"
+}