auto: docs sync 2026-07-12T00:00:23+00:00

Files changed: ", c.get(k))\nPY\n\\\"\n\"" engine/config.yaml engine/lib/lint.py engine/lib/vocab_gen.py engine/lint-report.md engine/sweep.sh vault/.obsidian/workspace.json vault/archive/projects/meshai-native-fire-severity-audit-cc-handoff.md vault/archive/projects/vaultwarden-plan.md vault/docs/matrix/matrix_host.md vault/docs/matrix/synapse.md vault/docs/services/services.md vault/docs/software/authentik.md vault/docs/software/caddy.md vault/docs/software/dns.md vault/docs/software/recon.md vault/docs/software/searxng.md vault/glossary.md vault/notes/echo6-landing-page-data-export.md vault/projects/matrix-synapse-deployment.md vault/projects/meshai.md vault/projects/meshtastic-headscale-runbook.md vault/projects/mmud-project.md vault/runbooks/add-peertube-channel.md vault/runbooks/authentik-access-groups.md vault/runbooks/authentik-create-invitation.md vault/runbooks/authentik-oidc-application.md vault/runbooks/authentik-upgrade.md vault/runbooks/expose-service-contabo.md vault/runbooks/lxc-service-migration.md vault/runbooks/mailcow-create-mailbox.md vault/runbooks/meshtastic-sidecar-node.md vault/runbooks/meshtasticd-sim-nodes-runbook.md vault/runbooks/proxmox-create-ubuntu-vm.md vault/runbooks/recon-operations.md vault/runbooks/recon-service-integration.md vault/runbooks/syncthing-add-node.md

vault/docs/software/authentik.md

@@ -10,13 +10,15 @@ related:
   - [[caddy]]
   - [[echo6-landing-page-data-export]]
   - [[authentik-access-groups]]
-updated: 2026-06-18
+updated: 2026-07-11
 ---
 # Authentik SSO Configuration
 
+> Migrated off Contabo → edge2 on 2026-06-18.
+
 ## Location
 
-- **Server:** Contabo (5.189.158.149 / 100.64.0.1)
+- **Server:** edge2 CT 105 (100.64.0.36)
 - **URL:** https://auth.echo6.co
 - **Internal Port:** 9000
 
@@ -108,7 +110,7 @@ Users must be in at least one bound group to access the application.
 ## Create New API Token
 
 ```bash
-ssh root@100.64.0.1 'docker exec -i authentik-server ak shell' <<'PYEOF'
+ssh edge2 'sudo pct exec 105 -- docker exec -i authentik-server ak shell' <<'PYEOF'
 from authentik.core.models import Token, TokenIntents, User
 user = User.objects.get(username="akadmin")
 Token.objects.filter(identifier="token-name").delete()
@@ -331,11 +333,12 @@ Echo6 cyberpunk branding applied to Authentik 2025.12.4 via System → Brands.
 The custom CSS is stored in the Brand model's `branding_custom_css` field. To update:
 
 ```bash
-# Copy CSS to Contabo
-scp /path/to/echo6-authentik.css root@100.64.0.1:/opt/authentik/branding/custom.css
+# Copy CSS to edge2 CT 105 (via edge2 host, then pct push into the CT)
+scp /path/to/echo6-authentik.css edge2:/tmp/echo6-authentik.css
+ssh edge2 'sudo pct push 105 /tmp/echo6-authentik.css /opt/authentik/branding/custom.css'
 
 # Load into Brand model via ak shell
-ssh root@100.64.0.1 'docker exec -i authentik-server ak shell' <<'PYEOF'
+ssh edge2 'sudo pct exec 105 -- docker exec -i authentik-server ak shell' <<'PYEOF'
 from authentik.brands.models import Brand
 b = Brand.objects.get(domain="auth.echo6.co")
 b.branding_custom_css = open("/media/custom/custom.css").read()
@@ -343,7 +346,7 @@ b.save()
 PYEOF
 
 # Restart to apply
-ssh root@100.64.0.1 'cd /opt/authentik && docker compose restart server worker'
+ssh edge2 'sudo pct exec 105 -- bash -c "cd /opt/authentik && docker compose restart server worker"'
 ```
 
 ### SSO Launch URL Pattern