first commit

application/application.tf

@@ -0,0 +1,46 @@
+locals {
+  app_name   = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
+  main_group = format("app-%s", local.app_name)
+}
+data "authentik_group" "akadmin" {
+  name = "authentik Admins"
+}
+resource "authentik_group" "groups" {
+  name       = local.main_group
+  attributes = jsonencode({ "${local.app_name}" = true })
+}
+
+resource "authentik_group" "subgroup" {
+  count  = length(var.sub_groups)
+  name   = format("%s-%s", local.app_name, var.sub_groups[count.index])
+  parent = authentik_group.groups.id
+}
+
+resource "authentik_application" "prj_app" {
+  name                  = var.instance
+  slug                  = "${var.component}-${var.instance}"
+  group                 = var.app_group
+  protocol_provider     = var.protocol_provider
+  backchannel_providers = var.backchannel_providers
+  meta_launch_url       = format("https://%s", var.dns_name)
+  meta_icon             = format("https://%s/%s", var.dns_name, var.icon)
+}
+
+resource "authentik_policy_expression" "policy" {
+  name       = local.main_group
+  expression = <<-EOF
+    attr = request.user.group_attributes()
+    return attr['${local.app_name}'] if '${local.app_name}' in attr else False
+  EOF
+}
+
+resource "authentik_policy_binding" "prj_access_users" {
+  target = authentik_application.prj_app.uuid
+  policy = authentik_policy_expression.policy.id
+  order  = 0
+}
+resource "authentik_policy_binding" "prj_access_vynil" {
+  target = authentik_application.prj_app.uuid
+  group  = data.authentik_group.akadmin.id
+  order  = 1
+}

application/outputs.tf

@@ -0,0 +1,7 @@
+output "application-id" {
+  value = authentik_application.prj_app.uuid
+}
+
+output "policy-id" {
+  value = authentik_policy_expression.policy.id
+}

application/providers.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    authentik = {
+      source  = "goauthentik/authentik"
+      version = "~> 2023.5.0"
+    }
+  }
+}

application/variables.tf

@@ -0,0 +1,28 @@
+variable "component" {
+  type = string
+}
+variable "instance" {
+  type = string
+}
+variable "icon" {
+  type = string
+}
+variable "app_group" {
+  type = string
+}
+variable "protocol_provider" {
+  type    = number
+  default = null
+}
+variable "dns_name" {
+  type = string
+}
+variable "sub_groups" {
+  type    = list(string)
+  default = []
+}
+
+variable "backchannel_providers" {
+  type    = list(number)
+  default = null
+}