From f0b352f6b7b395cdb3a8639a2e81aa12f64ba983 Mon Sep 17 00:00:00 2001 From: Mister Marko Date: Mon, 3 Aug 2026 17:25:10 -0400 Subject: [PATCH] Wire Muninn OIDC to Authentik [readme-ok] Muninn declared AUTH_PROVIDERS=credentials,oidc but had no AUTH_OIDC_* config, so SSO was never actually wired. Point it at the Authentik 'muninn' application (issuer https://auth.emkraan.com/application/o/muninn/), with the client secret supplied via the existing *_FILE bind-mount secret pattern (never committed). --- portainer-stack.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/portainer-stack.yml b/portainer-stack.yml index 7a4cca9..475bb06 100644 --- a/portainer-stack.yml +++ b/portainer-stack.yml @@ -28,6 +28,11 @@ services: - REDIS_DATABASE_INDEX=1 - AUTH_PROVIDERS=credentials,oidc - AUTH_COOKIE_PREFIX=homarr + # OIDC via Authentik (issuer = the Authentik 'muninn' application). + - AUTH_OIDC_CLIENT_ID=RGzAocEnrFcgXESW4jM3mYKexneKKrn0LMCE9G4E + - AUTH_OIDC_ISSUER=https://auth.emkraan.com/application/o/muninn/ + - AUTH_OIDC_CLIENT_NAME=Emkraan SSO + - AUTH_OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret # dns-caching patches dns.lookup() to use c-ares which bypasses /etc/hosts. # Disabled so extra_hosts entries resolve correctly for server-side OIDC calls. - ENABLE_DNS_CACHING=false @@ -45,6 +50,7 @@ services: - /opt/HQ_Muninn/appdata:/appdata - /opt/HQ_Muninn/secrets/secret_encryption_key:/run/secrets/secret_encryption_key:ro - /opt/HQ_Muninn/secrets/db_url:/run/secrets/db_url:ro + - /opt/HQ_Muninn/secrets/oidc_client_secret:/run/secrets/oidc_client_secret:ro networks: - default - backend