feat: add gitea tofu app

tofu/authentik/main.tf

@@ -54,3 +54,18 @@ module "firezone" {
   app_url             = "https://fz.fukurokuju.dev"
   sub_mode            = "hashed_user_id"
 }
+
+module "gitea" {
+  source              = "../modules/authentik"
+  app_name            = "Gitea"
+  app_slug            = "gitea"
+  client_id           = var.gitea_client_id
+  client_secret       = var.gitea_client_secret
+  app_access_group_id = ""
+  redirect_uris       = ["https://git.roboces.dev/user/oauth2/authentik/callback"]
+  app_icon            = "https://about.gitea.com/gitea.svg"
+  app_description     = "Git with a cup of Tea 🍵"
+  app_publisher       = "Gitea"
+  app_url             = "https://git.roboces.dev/user/oauth2/authentik"
+  sub_mode            = "hashed_user_id"
+}

tofu/authentik/sample.env

@@ -4,3 +4,5 @@
  TF_VAR_argo_workflows_client_secret=
  TF_VAR_firezone_client_id=
  TF_VAR_firezone_client_secret=
+ TF_VAR_gitea_client_id=
+ TF_VAR_gitea_client_secret=

tofu/authentik/vars.tf

@@ -17,3 +17,13 @@ variable "firezone_client_secret" {
   description = "Client secret"
   type        = string
 }
+
+variable "gitea_client_id" {
+  description = "Client ID"
+  type        = string
+}
+
+variable "gitea_client_secret" {
+  description = "Client secret"
+  type        = string
+}

tofu/modules/authentik/main.tf

@@ -42,8 +42,10 @@ resource "authentik_application" "app" {
   meta_publisher = var.app_publisher
   meta_launch_url = var.app_url
 }
+
 resource "authentik_policy_binding" "app_access" {
   target = authentik_application.app.uuid
   group  = var.app_access_group_id
   order  = 0
+  count = var.app_access_group_id != "" ? 1 : 0
 }