fix

apps/code-server/forward.tf

@@ -8,7 +8,7 @@ locals {
   forward-outpost-pk = jsondecode(data.http.get_forward_outpost.response_body).results[0].pk
   app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
   app-icon = "_static/src/browser/media/favicon-dark-support.svg"
-  main-group = format("%s-users", local.app-name)
+  main-group = format("app-%s", local.app-name)
   sub-groups = []
   external-url = format("https://%s", local.dns-names[0])
   access-token-validity = "hours=10" // ;minutes=10
@@ -68,6 +68,7 @@ resource "authentik_application" "prj_application" {
 
 resource "authentik_group" "prj_users" {
   name         = local.main-group
+  attributes   = jsonencode({local.app-name = true})
 }
 
 resource "authentik_group" "subgroup" {
@@ -76,6 +77,14 @@ resource "authentik_group" "subgroup" {
   parent       = authentik_group.prj_users.id
 }
 
+resource "authentik_policy_expression" "policy" {
+  name       = local.main-group
+  expression = <<-EOF
+    attr = request.user.group_attributes()
+    return attr['${local.app-name}'] if '${local.app-name}' in attr else False
+  EOF
+}
+
 data "authentik_group" "vynil-admin" {
   depends_on = [authentik_group.prj_users] # fake dependency so it is not evaluated at plan stage
   name = "vynil-forward-admins"
@@ -83,7 +92,7 @@ data "authentik_group" "vynil-admin" {
 
 resource "authentik_policy_binding" "prj_access_users" {
   target = authentik_application.prj_application.uuid
-  group  = authentik_group.prj_users.id
+  policy = authentik_policy_expression.policy.id
   order  = 0
 }
 resource "authentik_policy_binding" "prj_access_vynil" {

apps/code-server/index.yaml

@@ -6,21 +6,11 @@ metadata:
   name: code-server
   description: null
 options:
-  ingress-class:
-    default: traefik
+  no-editor:
+    default: false
     examples:
-    - traefik
-    type: string
-  domain-name:
-    default: your_company.com
-    examples:
-    - your_company.com
-    type: string
-  timezone:
-    default: Europe/Paris
-    examples:
-    - Europe/Paris
-    type: string
+    - false
+    type: boolean
   storage:
     default:
       accessMode: ReadWriteOnce
@@ -45,9 +35,19 @@ options:
         default: Filesystem
         enum:
         - Filesystem
-        - block
+        - Block
         type: string
     type: object
+  timezone:
+    default: Europe/Paris
+    examples:
+    - Europe/Paris
+    type: string
+  ingress-class:
+    default: traefik
+    examples:
+    - traefik
+    type: string
   domain:
     default: your-company
     examples:
@@ -107,25 +107,28 @@ options:
             type: number
         type: object
     type: object
-  no-editor:
-    default: false
+  domain-name:
+    default: your_company.com
     examples:
-    - false
-    type: boolean
-  issuer:
-    default: letsencrypt-prod
-    examples:
-    - letsencrypt-prod
+    - your_company.com
     type: string
   sub-domain:
     default: code
     examples:
     - code
     type: string
+  issuer:
+    default: letsencrypt-prod
+    examples:
+    - letsencrypt-prod
+    type: string
 dependencies:
 - dist: null
   category: share
   component: authentik-forward
+- dist: null
+  category: core
+  component: secret-generator
 providers:
   kubernetes: true
   authentik: true

apps/traefik-ui/forward.tf

@@ -8,7 +8,7 @@ locals {
   forward-outpost-pk = jsondecode(data.http.get_forward_outpost.response_body).results[0].pk
   app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
   app-icon = "dashboard/statics/icons/favicon-96x96.png"
-  main-group = format("%s-users", local.app-name)
+  main-group = format("app-%s", local.app-name)
   sub-groups = []
   access-token-validity = "minutes=10"
   rules-icons = [ for v in local.dns-names : {
@@ -67,6 +67,7 @@ resource "authentik_application" "prj_application" {
 
 resource "authentik_group" "prj_users" {
   name         = local.main-group
+  attributes   = jsonencode({local.app-name = true})
 }
 
 resource "authentik_group" "subgroup" {
@@ -75,6 +76,14 @@ resource "authentik_group" "subgroup" {
   parent       = authentik_group.prj_users.id
 }
 
+resource "authentik_policy_expression" "policy" {
+  name       = local.main-group
+  expression = <<-EOF
+    attr = request.user.group_attributes()
+    return attr['${local.app-name}'] if '${local.app-name}' in attr else False
+  EOF
+}
+
 data "authentik_group" "vynil-admin" {
   depends_on = [authentik_group.prj_users] # fake dependency so it is not evaluated at plan stage
   name = "vynil-forward-admins"
@@ -82,7 +91,7 @@ data "authentik_group" "vynil-admin" {
 
 resource "authentik_policy_binding" "prj_access_users" {
   target = authentik_application.prj_application.uuid
-  group  = authentik_group.prj_users.id
+  policy = authentik_policy_expression.policy.id
   order  = 0
 }
 resource "authentik_policy_binding" "prj_access_vynil" {

apps/traefik-ui/index.yaml

@@ -6,31 +6,31 @@ metadata:
   name: traefik-ui
   description: Access to the Traefik UI
 options:
-  ingress-class:
-    default: traefik
+  issuer:
+    default: letsencrypt-prod
     examples:
-    - traefik
-    type: string
-  sub-domain:
-    default: traefik
-    examples:
-    - traefik
+    - letsencrypt-prod
     type: string
   domain-name:
     default: your_company.com
     examples:
     - your_company.com
     type: string
-  issuer:
-    default: letsencrypt-prod
+  ingress-class:
+    default: traefik
     examples:
-    - letsencrypt-prod
+    - traefik
     type: string
   domain:
     default: your-company
     examples:
     - your-company
     type: string
+  sub-domain:
+    default: traefik
+    examples:
+    - traefik
+    type: string
 dependencies:
 - dist: null
   category: share