chore(deps): update terraform authentik to v2024.10.1

.forgejo/workflows/deploy-kaniko.yaml

@@ -13,12 +13,12 @@ jobs:
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v4
       - name: Kaniko build
-        uses: aevea/action-kaniko@v0.13.0
+        uses: aevea/action-kaniko@v0.14.0
         with:
           image: catalin/fukuops
           username: kaniko
           password: ${{ secrets.REGISTRY_PASSWORD }}
           cache: true
           registry: git.roboces.dev
-          tag: nextcloud-30.0.1
+          tag: nextcloud-30.0.2
           path: docker/nextcloud

docker/netbird/docker-compose.yml

@@ -23,7 +23,7 @@ services:
         max-size: "500m"
         max-file: "2"
   signal:
-    image: netbirdio/signal:0.31.0
+    image: netbirdio/signal:0.31.1
     restart: unless-stopped
     volumes:
       - netbird-signal:/var/lib/netbird
@@ -35,7 +35,7 @@ services:
         max-size: "500m"
         max-file: "2"
   relay:
-    image: netbirdio/relay:0.31.0
+    image: netbirdio/relay:0.31.1
     restart: unless-stopped
     environment:
       NB_LOG_LEVEL: ${NB_LOG_LEVEL:-info}
@@ -50,7 +50,7 @@ services:
         max-size: "500m"
         max-file: "2"
   management:
-    image: netbirdio/management:0.31.0
+    image: netbirdio/management:0.31.1
     restart: unless-stopped
     depends_on:
       - dashboard
@@ -91,7 +91,7 @@ services:
         max-file: "2"
 
   peer-1:
-    image: netbirdio/netbird:0.30.3
+    image: netbirdio/netbird:0.31.1
     restart: unless-stopped
     volumes:
       - ${NETBIRD_PEER_VOLUME:-/mnt/nas1/shared/netbird/peer-1}/data:/etc/netbird

docker/nextcloud/Dockerfile

@@ -1,4 +1,4 @@
-FROM nextcloud:30.0.1-apache
+FROM nextcloud:30.0.2-apache
 
 RUN set -ex; \
     \

docker/nextcloud/docker-compose.yml

@@ -14,7 +14,7 @@ services:
       - nextcloud
 
   nextcloud:
-    image: git.roboces.dev/catalin/fukuops:nextcloud-30.0.1
+    image: git.roboces.dev/catalin/fukuops:nextcloud-30.0.2
     volumes:
       - /mnt/nas1/legacy-storage/cloud/cloud/data:/var/www/html/data
       - /mnt/nas1/legacy-storage/cloud/cloud/config:/var/www/html/config
@@ -22,6 +22,8 @@ services:
       - /mnt/nas1/legacy-storage/cloud/cloud/apps:/var/www/html/apps
       - type: tmpfs
         target: /tmp:exec
+      - supervisorlog:/var/log/supervisor:z
+      - supervisorpid:/var/run/supervisord/:z
     environment:
       PHP_MEMORY_LIMIT: ${PHP_MEMORY_LIMIT:-2048M}
       NEXTCLOUD_INIT_HTACCESS: ${NEXTCLOUD_INIT_HTACCESS:-1}
@@ -33,3 +35,6 @@ services:
 
 networks:
   nextcloud: {}
+volumes:
+  supervisorlog: {}
+  supervisorpid: {}

docker/paperless/docker-compose.yml

@@ -14,7 +14,7 @@ services:
 
   webserver:
 
-    image: ghcr.io/paperless-ngx/paperless-ngx:2.13.4
+    image: ghcr.io/paperless-ngx/paperless-ngx:2.13.5
     restart: unless-stopped
     ports:
       - 8002:8000

docker/vaultwarden/docker-compose.yml

@@ -1,7 +1,7 @@
 ---
 services:
   vaultwarden:
-    image: vaultwarden/server:1.32.3-alpine
+    image: vaultwarden/server:1.32.4-alpine
     restart: unless-stopped
     environment:
       DATABASE_URL: ${DATABASE_URL}

k8s/argo-apps/elastic.yaml

@@ -12,7 +12,7 @@ spec:
   sources:
     - chart: elasticsearch
       repoURL: registry-1.docker.io/bitnamicharts
-      targetRevision: 21.3.22
+      targetRevision: 21.3.24
       helm:
         valuesObject:
           service:

k8s/argo-apps/factorio.yaml

@@ -12,7 +12,7 @@ spec:
     sources:
         - chart: factorio-server-charts
           repoURL: https://sqljames.github.io/factorio-server-charts/
-          targetRevision: 2.2.*
+          targetRevision: 2.5.*
           helm:
               valuesObject:
                   rcon:

k8s/argo-apps/forgejo.yaml

@@ -12,7 +12,7 @@ spec:
   sources:
     - chart: forgejo
       repoURL: code.forgejo.org/forgejo-helm
-      targetRevision: 10.0.1
+      targetRevision: 10.1.0
       helm:
         valuesObject:
           replicaCount: 2

k8s/argo-apps/renovate.yaml

@@ -13,7 +13,7 @@ spec:
   sources:
     - chart: renovate
       repoURL: https://docs.renovatebot.com/helm-charts
-      targetRevision: 38.142.*
+      targetRevision: 39.10.*
       helm:
         valuesObject:
           renovate:

k8s/services/miniflux/deployment.yaml

@@ -28,7 +28,7 @@ spec:
     spec:
       containers:
         - name: miniflux
-          image: miniflux/miniflux:2.2.2
+          image: miniflux/miniflux:2.2.3
           imagePullPolicy: Always
           securityContext:
             allowPrivilegeEscalation: false

tofu/authentik/.terraform.lock.hcl

@@ -2,36 +2,36 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.opentofu.org/goauthentik/authentik" {
-  version     = "2024.10.0"
-  constraints = "2024.10.0"
+  version     = "2024.10.1"
+  constraints = "2024.10.1"
   hashes = [
-    "h1:77gvw55XkrmQhkU2oTQ0ZklyYiiASRBGeHwkNZSjoKA=",
-    "h1:7bK5erXZurSqE0kB7hdPw84neEZVaWGHe29g6UxnSog=",
-    "h1:AOCizcvQhcy1PnnP8epdtnB4TJWUU0qfmQV3dEaexLA=",
-    "h1:APn0CY837SrNL6lwzWPcqYZw+HezxwG4tRwbBJsubNk=",
-    "h1:FP2tuqZULFL1AVogOOR3C4EKLWeKox4g8lBKbjkQICY=",
-    "h1:JOpx6j4oo7vt49F1tB78zYs6DVXCFCt7/PW8FEiNVN4=",
-    "h1:MPyY7zw4obErJfdAXONRQv1UpE2Sg0VghQY6QgzYNYg=",
-    "h1:OTiDtXbBX/1GeLwjKtjRdYGKE/dvXPAWHJ5c83IIzus=",
-    "h1:RIEaU9cIFpE/ldxiDQXrKcwAcCgalV5uhn13ZW0AYOM=",
-    "h1:RxOL3LqYRcR5K4/fyAgYoj6cdDC0iqmYtPVc+ry6TbU=",
-    "h1:g6K0VqPAJJLNk/poUrcMLQqRsdp9FDnYFOmeu8ES+Ko=",
-    "h1:j4xktfH9LCWf084FHi1WLW60g4JmCPu/hnEJ5vv3bwY=",
-    "h1:oY+BEgwN4F/iWZDWUCsxSUc1C/OrgOiGxLKr+Frmzrw=",
-    "h1:tvdejhRCu6pz8i4+r6S6UzpdJvqCRjMgC9EnAYgQknE=",
-    "zh:0963745d1add67a8d1cf39d24eb57a92c9690b3a40dfa93e8c0a867ffedb0d30",
-    "zh:3cd24784cd0095bf2e3220c4a88493fcbac6da0c7ed9b38d510d6dfb46516a9e",
-    "zh:485ca7c00ce91f0a7bd02d0c56fa42e5f578feed4a45ba230f1f29eabdde6817",
-    "zh:4dc7a309e3d6d200eb9d8f2779581882dc33b02d1c7cdf05fd3b788dd20f6446",
-    "zh:6518e6dfef428272326f6e384113d1a3b12fad0ed74cf2b203348f83f917d726",
-    "zh:6ba235ad94663718fbc556efbd70f63c62a1c33d3b9f01203105c3a6d1c9b996",
-    "zh:7655ecb8793f18ac07c6de153028acc9f991cb6239e6dc72a47dd18db0b44854",
-    "zh:86c739997af49ff1a4ec3d792af362e4ed6b28b11606117ef70b2019420e9f15",
-    "zh:94e8582824377f704458ed38b0116055fac0a31e2b4ae961d215c3dc1ac7420c",
-    "zh:989b69d8b004ebad6004c2d4d5345f056b1b23315b6017884f5fd859645c79e1",
-    "zh:d8946c1c56864b78533c4e4f88d62765ba6ce75c196812e3224a61686914be29",
-    "zh:de9b2bf9944e743e1d56763b257abbc9450d8752d94ff5e8520a44549594e815",
-    "zh:e109fddbe90f44ccd16593246fcf2be81ae7966bdeabb39ddd52e541f762af0a",
-    "zh:e91aba428fc341577e7d7b2ea1bbb01706ada575a98b51e10b9765275084b702",
+    "h1:/Eo+yQyGAKK67bkgt1plX5X41mkRKu5br66XYnL/UyQ=",
+    "h1:1S06FnDvjDsdOm/2J/M95FypohflaT0a9OUOwl4S87o=",
+    "h1:7c3PvOLtsB0F4KHdGT1bTq2mzeNjx4TaNlVKRX78vAc=",
+    "h1:8NUPNLWr9/klFJckfw6HkOMqsGhTTdePUmlBRLOIJjY=",
+    "h1:Ariy1e/DAbcoXS9Wud/Ad3rEC1cLqQ7HdcHBzfTRiSM=",
+    "h1:Bc9zVu8DyzeveEqEaCitlsvzBEY6CU/F648PEjrFYuk=",
+    "h1:D5mConUujTcrau12WRa+Qg1lvPJLzjc76ClIYevJtVw=",
+    "h1:FFYDaQDN8nbfsjwp8kw7YO6xsFCJlhtKSXx9gdLLbok=",
+    "h1:Qfd127te/m5E0LAJvJ9kGWKdCXQdFXlz3ve+nV3HsWM=",
+    "h1:RpNxc5WPT5H3WoKP8t7yKLO7MUAuHgfjm/rifaKpYM8=",
+    "h1:XifS+/OiEMhGI7MQnQtF3ACScqWB/N2Sr/bIrvSKOag=",
+    "h1:YMreOu0B0U2v8azRZ/iVJPhoDedlATNHCam1iztTUks=",
+    "h1:eIMjryDbwEUWlBOFPtGWPf9NdNVWeGLeniVzafoPXZU=",
+    "h1:v6XQwr4PDKtgHtdgCq03iYme4VaJAG8kSH4aKJL0OSw=",
+    "zh:149c76107f75ea5b530409d81cd3b63abc5478831c1f794df1fc12acd5f7ac78",
+    "zh:60bf7a62ec4bb742121f708b1e964b6bc816988e14c9e831723f0788a5c22471",
+    "zh:625f1eecf87e1d741bc99b69aa0aac3c82a4040bb9e704e2c20b09e562517c20",
+    "zh:690f247fd428dd7659aad3189a86288c784fdedbeb8cd75295aa417338d126b2",
+    "zh:6be8c0c70b18da79b5c7cb19ca445a1607404b7e1caff9bdb8e2330c22a591c6",
+    "zh:77bd031a28ec92a215cc5c12381791239ad43087c37f73ab1538f909e15ceae5",
+    "zh:78ffd4fe7b65220db2d33430240507395a71ef8e1dd1c22d82fd547855113df5",
+    "zh:7c0414978a45481bbeb8fc1aed1806409a2499967bd30edfcf9c34d1005d0faa",
+    "zh:7df2c43de2555c11b761a938e2414f25165845d932ca95d562ccabfe3a78a209",
+    "zh:819baedab497151fabcc9c887bcb07382a371708e3f9632ae1a58563ba79104f",
+    "zh:891208df7e634c2de7cb164d1ed88d492e7852abd32293b727b5b82f32efd7e7",
+    "zh:b6385a881b7098f6a6260f7b298eb26ef06eeed02a90ffdff9d2d7cf72fdaa27",
+    "zh:ce642bbd35babd93339a80549552823ec743397e456f18dbcffdf5af3fec612e",
+    "zh:ffd96ddda256a49097b21e6e672ef63d532a960bbc5455958102900ce79a4a10",
   ]
 }

tofu/authentik/main.tf

@@ -8,7 +8,7 @@ terraform {
   required_providers {
     authentik = {
       source  = "goauthentik/authentik"
-      version = "2024.10.0"
+      version = "2024.10.1"
     }
   }
 }
@@ -33,21 +33,6 @@ resource "authentik_group" "vpn" {
 }
 
 
-module "firezone" {
-  source              = "../modules/authentik-oidc"
-  app_name            = "Firezone"
-  app_slug            = "firezone"
-  client_id           = var.firezone_client_id
-  client_secret       = var.firezone_client_secret
-  app_access_group_id = authentik_group.admins.id
-  redirect_uris       = ["https://fz.fukurokuju.dev/auth/oidc/authentik/callback/"]
-  app_icon            = "https://www.firezone.dev/icon.svg"
-  app_description     = "VPN"
-  app_publisher       = "Firezone"
-  app_url             = "https://fz.fukurokuju.dev"
-  sub_mode            = "hashed_user_id"
-}
-
 module "gitea" {
   source              = "../modules/authentik-oidc"
   app_name            = "Gitea"
@@ -159,5 +144,6 @@ module "netbird" {
   extra_property_mappings = [
     "goauthentik.io/providers/oauth2/scope-authentik_api"
   ]
-  app_icon = "https://vpn.fukurokuju.dev/apple-icon.png"
+  app_icon              = "https://vpn.fukurokuju.dev/apple-icon.png"
+  access_token_validity = "days=10"
 }

tofu/modules/authentik-oidc/main.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     authentik = {
       source  = "goauthentik/authentik"
-      version = "2024.10.0"
+      version = "2024.10.1"
     }
   }
 }
@@ -26,20 +26,25 @@ data "authentik_property_mapping_provider_scope" "default-scopes" {
   ], var.extra_property_mappings)
 }
 
+data "authentik_flow" "default-provider-invalidation-flow" {
+  slug = "default-provider-invalidation-flow "
+}
 
 resource "authentik_provider_oauth2" "provider_oidc" {
-  name                  = var.app_name
-  client_id             = var.client_id
-  client_secret         = var.client_secret
-  client_type           = var.client_type
-  authorization_flow    = data.authentik_flow.default-authorization-flow.id
-  authentication_flow   = data.authentik_flow.default-authentication-flow.id
-  redirect_uris         = var.redirect_uris
-  property_mappings     = data.authentik_property_mapping_provider_scope.default-scopes.ids
-  sub_mode              = var.sub_mode
-  signing_key           = var.oidc_signing_key
-  access_code_validity  = var.access_code_validity
-  access_token_validity = var.access_token_validity
+  name                   = var.app_name
+  client_id              = var.client_id
+  client_secret          = var.client_secret
+  client_type            = var.client_type
+  authorization_flow     = data.authentik_flow.default-authorization-flow.id
+  authentication_flow    = data.authentik_flow.default-authentication-flow.id
+  redirect_uris          = var.redirect_uris
+  property_mappings      = data.authentik_property_mapping_provider_scope.default-scopes.ids
+  sub_mode               = var.sub_mode
+  signing_key            = var.oidc_signing_key
+  access_code_validity   = var.access_code_validity
+  access_token_validity  = var.access_token_validity
+  refresh_token_validity = var.refresh_token_validity
+  invalidation_flow      = data.authentik_flow.default-provider-invalidation-flow.id
 }
 
 

tofu/modules/authentik-oidc/vars.tf

@@ -90,6 +90,11 @@ variable "access_token_validity" {
   default = "minutes=10"
 }
 
+variable "refresh_token_validity" {
+  type    = string
+  default = "days=30"
+}
+
 variable "extra_property_mappings" {
   type    = list(string)
   default = []

tofu/modules/authentik-proxy/main.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     authentik = {
       source  = "goauthentik/authentik"
-      version = "2024.10.0"
+      version = "2024.10.1"
     }
   }
 }
@@ -16,6 +16,9 @@ data "authentik_flow" "default-authentication-flow" {
   slug = "default-authentication-flow"
 }
 
+data "authentik_flow" "default-provider-invalidation-flow" {
+  slug = "default-provider-invalidation-flow "
+}
 
 resource "authentik_provider_proxy" "provider_proxy" {
   authorization_flow           = data.authentik_flow.default-authorization-flow.id
@@ -24,6 +27,7 @@ resource "authentik_provider_proxy" "provider_proxy" {
   internal_host                = var.internal_host
   name                         = var.app_name
   internal_host_ssl_validation = var.internal_host_ssl_validation
+  invalidation_flow            = data.authentik_flow.default-provider-invalidation-flow.id
 }