fix

modules/application/application.tf

@@ -0,0 +1,45 @@
+locals {
+  app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
+  main-group = format("app-%s", local.app-name)
+}
+data "authentik_group" "akadmin" {
+  name = "authentik Admins"
+}
+resource "authentik_group" "groups" {
+  name         = local.main-group
+  attributes   = jsonencode({"${local.app-name}" = true})
+}
+
+resource "authentik_group" "subgroup" {
+  count = length(var.sub-groups)
+  name         = format("%s-%s", local.app-name, var.sub-groups[count.index])
+  parent       = authentik_group.prj_users.id
+}
+
+resource "authentik_application" "prj_app" {
+  name              = "${var.instance}"
+  slug              = "${var.component}-${var.instance}"
+  group             = var.app-group
+  protocol_provider = var.protocol_provider
+  meta_launch_url   = format("https://%s.%s", var.sub-domain, var.domain-name)
+  meta_icon         = format("https://%s.%s/%s", var.sub-domain, var.domain-name, var.icon)
+}
+
+resource "authentik_policy_expression" "policy" {
+  name       = local.main-group
+  expression = <<-EOF
+    attr = request.user.group_attributes()
+    return attr['${local.app-name}'] if '${local.app-name}' in attr else False
+  EOF
+}
+
+resource "authentik_policy_binding" "prj_access_users" {
+  target = authentik_application.prj_app.uuid
+  policy = authentik_policy_expression.policy.id
+  order  = 0
+}
+resource "authentik_policy_binding" "prj_access_vynil" {
+  target = authentik_application.prj_app.uuid
+  group  = data.authentik_group.akadmin.id
+  order  = 1
+}

modules/application/variables.tf

@@ -0,0 +1,25 @@
+variable "component" {
+  type        = string
+}
+variable "instance" {
+  type        = string
+}
+variable "icon" {
+  type        = string
+}
+variable "app-group" {
+  type        = string
+}
+variable "protocol_provider" {
+  type        = number
+}
+variable "sub-domain" {
+  type        = string
+}
+variable "domain-name" {
+  type        = string
+}
+variable "sub-groups" {
+  type        = list(string)
+  default     = []
+}