auto: docs sync 2026-07-12T00:00:23+00:00

Files changed: ", c.get(k))\nPY\n\\\"\n\"" engine/config.yaml engine/lib/lint.py engine/lib/vocab_gen.py engine/lint-report.md engine/sweep.sh vault/.obsidian/workspace.json vault/archive/projects/meshai-native-fire-severity-audit-cc-handoff.md vault/archive/projects/vaultwarden-plan.md vault/docs/matrix/matrix_host.md vault/docs/matrix/synapse.md vault/docs/services/services.md vault/docs/software/authentik.md vault/docs/software/caddy.md vault/docs/software/dns.md vault/docs/software/recon.md vault/docs/software/searxng.md vault/glossary.md vault/notes/echo6-landing-page-data-export.md vault/projects/matrix-synapse-deployment.md vault/projects/meshai.md vault/projects/meshtastic-headscale-runbook.md vault/projects/mmud-project.md vault/runbooks/add-peertube-channel.md vault/runbooks/authentik-access-groups.md vault/runbooks/authentik-create-invitation.md vault/runbooks/authentik-oidc-application.md vault/runbooks/authentik-upgrade.md vault/runbooks/expose-service-contabo.md vault/runbooks/lxc-service-migration.md vault/runbooks/mailcow-create-mailbox.md vault/runbooks/meshtastic-sidecar-node.md vault/runbooks/meshtasticd-sim-nodes-runbook.md vault/runbooks/proxmox-create-ubuntu-vm.md vault/runbooks/recon-operations.md vault/runbooks/recon-service-integration.md vault/runbooks/syncthing-add-node.md

vault/runbooks/authentik-oidc-application.md

@@ -10,15 +10,15 @@ related:
   - [[authentik-upgrade]]
   - [[mailcow-create-mailbox]]
   - [[expose-service-home]]
-updated: 2026-06-18
+updated: 2026-07-11
 ---
 # Add Authentik OIDC to an Application
 
 Fully automated via [[authentik]] API. No web UI interaction required.
 
-**Prerequisite:** [[dns]] must already exist for the service (run expose-service-contabo.md or expose-service-home.md first).
+**Prerequisite:** [[dns]] must already exist for the service (run expose-service-edge2.md or expose-service-home.md first).
 
-**Authentik instance:** https://auth.echo6.co (Contabo, 100.64.0.1)
+**Authentik instance:** https://auth.echo6.co (edge2 CT 105, 100.64.0.36)
 
 ---
 
@@ -54,7 +54,7 @@ These conflict with Authentik's internal OAuth2 endpoints and **cannot be used**
 Create an API token from the Authentik admin account. This only needs to happen once — reuse the token across all OIDC setups.
 
 ```bash
-ssh root@100.64.0.1 "docker exec authentik-server \
+ssh edge2 "sudo pct exec 105 -- docker exec authentik-server \
   ak create_token --user akadmin --identifier oidc-automation --expiring 2>/dev/null \
   || echo 'Token may already exist — check credentials file'"
 ```
@@ -77,7 +77,7 @@ The API requires UUIDs for flows, scope mappings, and signing keys. These are st
 ### Authorization flow
 
 ```bash
-ssh root@100.64.0.1 "curl -s \
+ssh edge2 "sudo pct exec 105 -- curl -s \
   -H 'Authorization: Bearer $AK_TOKEN' \
   '$AK_API/flows/instances/?slug=default-provider-authorization-implicit-consent' \
   | jq -r '.results[0].pk'"
@@ -89,7 +89,7 @@ Store as `AUTH_FLOW_PK`.
 
 ```bash
 # Get all scope mapping UUIDs at once
-ssh root@100.64.0.1 "curl -s \
+ssh edge2 "sudo pct exec 105 -- curl -s \
   -H 'Authorization: Bearer $AK_TOKEN' \
   '$AK_API/propertymappings/provider/scope/?ordering=scope_name' \
   | jq -r '.results[] | select(.scope_name == \"openid\" or .scope_name == \"email\" or .scope_name == \"profile\" or .scope_name == \"offline_access\") | \"\(.scope_name): \(.pk)\"'"
@@ -100,7 +100,7 @@ Store each UUID: `SCOPE_OPENID_PK`, `SCOPE_EMAIL_PK`, `SCOPE_PROFILE_PK`, `SCOPE
 ### Signing key
 
 ```bash
-ssh root@100.64.0.1 "curl -s \
+ssh edge2 "sudo pct exec 105 -- curl -s \
   -H 'Authorization: Bearer $AK_TOKEN' \
   '$AK_API/crypto/certificatekeypairs/?name=authentik+Self-signed+Certificate&has_key=true' \
   | jq -r '.results[0].pk'"
@@ -131,7 +131,7 @@ fi
 Create the provider:
 
 ```bash
-PROVIDER_RESPONSE=$(ssh root@100.64.0.1 "curl -s \
+PROVIDER_RESPONSE=$(ssh edge2 "sudo pct exec 105 -- curl -s \
   -X POST '$AK_API/providers/oauth2/' \
   -H 'Authorization: Bearer $AK_TOKEN' \
   -H 'Content-Type: application/json' \
@@ -172,7 +172,7 @@ echo "Client Secret:  $CLIENT_SECRET"
 ## Step 4: Create the Application
 
 ```bash
-ssh root@100.64.0.1 "curl -s \
+ssh edge2 "sudo pct exec 105 -- curl -s \
   -X POST '$AK_API/core/applications/' \
   -H 'Authorization: Bearer $AK_TOKEN' \
   -H 'Content-Type: application/json' \
@@ -296,7 +296,7 @@ Check in order:
 Debug via API:
 
 ```bash
-ssh root@100.64.0.1 "curl -s \
+ssh edge2 "sudo pct exec 105 -- curl -s \
   -H 'Authorization: Bearer $AK_TOKEN' \
   '$AK_API/providers/oauth2/?search=$SERVICE_NAME' \
   | jq '.results[0] | {name, client_id, signing_key, access_token_validity, refresh_token_validity, property_mappings}'"
@@ -305,7 +305,7 @@ ssh root@100.64.0.1 "curl -s \
 Or via ak shell:
 
 ```bash
-ssh root@100.64.0.1 "docker exec authentik-server ak shell -c \"
+ssh edge2 "sudo pct exec 105 -- docker exec authentik-server ak shell -c \"
 from authentik.providers.oauth2.models import OAuth2Provider
 p = OAuth2Provider.objects.get(name='$SERVICE_NAME')
 print(f'Access Token: {p.access_token_validity}')
@@ -330,7 +330,7 @@ The redirect URI in the app config must **exactly** match what's in Authentik
 User isn't authorized for the application. By default all authenticated users have access. If you've added group restrictions via policy bindings, verify the user is in the correct group:
 
 ```bash
-ssh root@100.64.0.1 "curl -s \
+ssh edge2 "sudo pct exec 105 -- curl -s \
   -H 'Authorization: Bearer $AK_TOKEN' \
   '$AK_API/core/applications/$SERVICE_SLUG/' \
   | jq '{name, slug, policy_engine_mode}'"
@@ -344,12 +344,12 @@ Missing `offline_access` scope. Without refresh tokens, sessions only last as lo
 
 ```bash
 # Delete application first (it references the provider)
-ssh root@100.64.0.1 "curl -s -X DELETE \
+ssh edge2 "sudo pct exec 105 -- curl -s -X DELETE \
   -H 'Authorization: Bearer $AK_TOKEN' \
   '$AK_API/core/applications/$SERVICE_SLUG/'"
 
 # Then delete provider
-ssh root@100.64.0.1 "curl -s -X DELETE \
+ssh edge2 "sudo pct exec 105 -- curl -s -X DELETE \
   -H 'Authorization: Bearer $AK_TOKEN' \
   '$AK_API/providers/oauth2/$PROVIDER_PK/'"
 ```