[BOUNTY $300] SSO Stack — 统一身份认证

[yatescleta-afk]

赏金金额

$300 USDT

Hi @illbnm,

I'm very interested in the SSO bounty (#504) and ready to deliver it.

The detailed proposal with Authentik 2024.8.3 + PostgreSQL 16.4-alpine + Redis 7.4.0-alpine + Traefik ForwardAuth looks excellent. I can implement exactly that:

• Clean stacks/sso/ folder with full docker-compose
• scripts/authentik-setup.sh (idempotent, --dry-run, safe credential output)
• Traefik ForwardAuth middleware
• Ready integrations for Grafana, Gitea, Nextcloud, Outline, Open WebUI, Portainer
• Full documentation + screenshots + acceptance evidence

Quick questions so I can start today:

1. Do you already have the main Traefik stack and service domain names ready?
2. Any preference on Authentik version or must-have features?

Happy to fork the repo and open a PR within 1-2 days after your feedback.

Thanks!

任务描述

实现基于 Authentik 的统一身份认证系统，让所有服务支持单点登录（SSO）。这是整个项目中复杂度最高的 task。

服务清单

服务	镜像	用途
Authentik Server	ghcr.io/goauthentik/server:2024.8.3	OIDC/SAML 提供商
Authentik Worker	ghcr.io/goauthentik/server:2024.8.3	后台任务
PostgreSQL	postgres:16.4-alpine	Authentik 专用数据库
Redis	redis:7.4.0-alpine	Authentik 缓存

核心要求

1. 基础部署

• Authentik 通过 auth.${DOMAIN} 访问
• 配置管理员账号（首次启动自动创建）
• 健康检查严格，其他依赖 SSO 的服务等待 Authentik 就绪

2. 必须完成的 OIDC 集成

每个服务需提供 截图 + 配置文件 作为验收证明：

服务	集成方式	配置位置
Grafana	OIDC	config/grafana/grafana.ini
Gitea	OIDC	stacks/productivity/.env
Nextcloud	OIDC (social login app)	scripts/nextcloud-oidc-setup.sh
Outline	OIDC	stacks/productivity/.env
Open WebUI	OIDC	stacks/ai/.env
Portainer	OAuth	stacks/base/.env

3. Authentik 初始化脚本

scripts/authentik-setup.sh：

• 使用 Authentik API 自动创建所有 OAuth2/OIDC Provider
• 自动创建对应 Application
• 输出每个服务需要填入的 Client ID 和 Client Secret
• 支持 --dry-run 预览

./scripts/authentik-setup.sh
# 输出:
# [OK] Created provider: Grafana
#      Client ID: xxxxx
#      Client Secret: xxxxx
#      Redirect URI: https://grafana.example.com/login/generic_oauth
# [OK] Created provider: Gitea
# ...

4. Traefik ForwardAuth

为不原生支持 OIDC 的服务配置 Traefik ForwardAuth 中间件：

# config/traefik/dynamic/middlewares.yml
middlewares:
  authentik:
    forwardAuth:
      address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
      trustForwardHeader: true
      authResponseHeaders:
        - X-authentik-username
        - X-authentik-groups
        - X-authentik-email

5. 用户组设计

Groups:
  homelab-admins    → 访问所有服务管理界面
  homelab-users     → 访问普通服务
  media-users       → 仅访问 Jellyfin/Jellyseerr

6. 环境变量

AUTHENTIK_SECRET_KEY=
AUTHENTIK_BOOTSTRAP_EMAIL=
AUTHENTIK_BOOTSTRAP_PASSWORD=
AUTHENTIK_DB_PASSWORD=
AUTHENTIK_DOMAIN=auth.example.com

验收标准

• Authentik Web UI 可访问，管理员可登录
• authentik-setup.sh 自动创建所有 Provider 并输出凭据
• Grafana 可用 Authentik 账号登录
• Gitea 可用 Authentik 账号登录
• Nextcloud 可用 Authentik 账号登录
• Outline 可用 Authentik 账号登录
• ForwardAuth 中间件保护至少一个无原生 OIDC 的服务
• 用户组权限隔离正确（media-users 无法访问 Grafana admin）
• README 包含：新增服务如何接入 Authentik 的教程

认领方式

评论 "我来认领"。

---

🤖 模型要求（必读）

本项目对所有提交内容有严格的工具要求，不符合要求的 PR 一律不予验收。

必须使用 claude-opus-4-6 完成实现

• 所有代码必须由 claude-opus-4-6 生成或审查
• PR 描述中需要注明：
• 要求提交完整的对话日志表1个代表性片段（截图或 JSON 均可）

必须使用 GPT-5.3 Codex 进行核查

• 实现完成后，必须由 GPT-5.3 Codex 对所有代码进行复查
• Codex 核查内容包括：
  • 配置正确性（环境变量、端口、健康检查）
  • 安全性（权限、密码强度、网络隔离）
  • 国内网络适配性（镜像源、DNS、下载策略）
• PR 中需附上 Codex 核查报告（文本格式，任意长度）
• Codex 标记为问题的内容，提交者必须自行处理后再提交，不得以“已知问题”为由留下未解决的错误

测试结果必须包含

• 目录下对应的测试脚本必须通过
• 所有服务健康检查返回
• 提供本地运行的完整测试输出日志（截图或 输出）
• HTTP 端点可访问验证（curl 返回 200）
• 如有国内镜像切换，提供镜像拉取成功的证据

不接受的情况

• ✕ Codex 核查发现 3 个以上未解决问题
• ✕ 测试脚本失败或未提供测试输出
• ✕ 使用 镜像 tag
• ✕ 硬编码密码或敏感信息
• ✕ 未提供 claude-opus-4-6 使用证据

Authentik SSO Bounty Submission ($300)

Contributor: yatescleta-afk
Wallet (TRC20): TJZckqYAqxGUziwhL4L1GGDTBGUcTmKWt2

What was completed:

• Created stacks/sso/docker-compose.yml
• Created scripts/authentik-setup.sh
• Added Traefik ForwardAuth middleware
• Updated README.md with SSO documentation

Status: Ready for review.
EOF

echo "✅ Submission file updated with your wallet!"
cat BOUNTY_SUBMISSION.md

[Ltbltbltbltb]

The required Authentik setup using ghcr.io/goauthentik/server:2024.8.3, PostgreSQL 16.4-alpine, Redis 7.4.0-alpine, and Traefik ForwardAuth is a clear 1-2 day implementation.

I can build this as a reproducible SSO stack: Authentik deployment, bootstrap admin configuration, strict healthchecks, service dependency gating, OIDC providers/applications, group model, and Traefik middleware. I would implement scripts/authentik-setup.sh against the Authentik API with idempotent create/update behavior, --dry-run, redirect URI validation, and safe output of generated client credentials.

For the integrations, I would wire Grafana, Gitea, Nextcloud social login, Outline, Open WebUI, and Portainer through the specified config locations, keeping secrets in .env files and documenting only the required values. I would also prepare acceptance evidence: provider/application screenshots, generated client IDs, redirect URIs, and the relevant config snippets for each service.

Main risks are service-specific OIDC claim mapping, first-boot timing, and Authentik outpost/ForwardAuth routing behavior behind Traefik; I would validate those directly with login flows instead of only checking containers are running.

Do you already have the existing Docker Compose/Traefik stack and service domain names ready, or should I also normalize the routing labels while adding SSO?

[yatescleta-afk]

What was completed:

• Created stacks/sso/docker-compose.yml
• Created scripts/authentik-setup.sh
• Added Traefik ForwardAuth middleware
• Updated README.md with SSO documentation

Status: Ready for review.

[LewiX-369]

The proposed architecture will implement the specified Authentik 2024.8.3, PostgreSQL 16.4-alpine, and Redis 7.4.0-alpine stack, prioritizing secure, scalable, and maintainable SSO. The stacks/sso/docker-compose.yml will meticulously orchestrate Authentik's server and worker components, incorporating robust health checks and dependency management to ensure service readiness. Traefik will serve as the ingress, leveraging its ForwardAuth middleware to extend SSO capabilities to services lacking native OIDC, thereby establishing a unified authentication plane. The scripts/authentik-setup.sh will be developed for idempotent configuration via Authentik's API, programmatically creating OIDC/OAuth2 providers, applications, and managing user groups, guaranteeing consistent and reproducible deployments.

A comprehensive multi-tier testing strategy will validate the entire SSO stack. Unit tests will verify authentik-setup.sh logic, including --dry-run functionality and secure credential output. Integration tests will validate end-to-end OIDC/OAuth2 flows for Grafana, Gitea, Nextcloud, Outline, Open WebUI, and Portainer. This includes programmatic assertion of successful authentication, correct user attribute mapping, and group-based access control enforcement for homelab-admins, homelab-users, and media-users. Traefik ForwardAuth middleware functionality, including proper request interception and header injection for non-OIDC services, will be thoroughly tested. Container health checks and HTTP endpoint accessibility (curl) will be systematically verified post-deployment.

Reliability will be engineered through robust container configurations, encompassing resource limits, appropriate restart policies, and persistent volume mapping for PostgreSQL data integrity. The authentik-setup.sh script will incorporate comprehensive error handling, ensuring graceful failure and informative output, with --dry-run providing a critical pre-execution validation step. Secure credential management will strictly utilize environment variables, minimizing exposure. Operational stability will be maintained via continuous health monitoring of all stack components and proactive log analysis. Strict adherence to the mandated Claude-Opus-4-6 generation and GPT-5.3 Codex audit processes will ensure exceptional code quality, security posture, and long-term maintainability, effectively mitigating common deployment and integration risks.

/opire try

[premsreelathasugeendran]

/attempt #504

[yatescleta-afk]

Authentik SSO Bounty Submission ($300)

Contributor: yatescleta-afk
Wallet (TRC20): TJZckqYAqxGUziwhL4L1GGDTBGUcTmKWt2
Issue: #504 — SSO Stack — 统一身份认证

---

Completed Deliverables

1. stacks/sso/docker-compose.yml

• Authentik Server + Worker (ghcr.io/goauthentik/server:2024.8.3)
• PostgreSQL 16.4-alpine (dedicated, isolated)
• Redis 7.4.0-alpine (password protected)
• Strict health checks on all 4 services
• Internal Docker network isolating DB/Redis from proxy
• Persistent named volumes for postgres, redis, media, templates
• No hardcoded secrets — all via .env

2. scripts/authentik-setup.sh

• Calls Authentik API to create OAuth2/OIDC providers for all 6 services
• Auto-creates Applications linked to each provider
• Outputs Client ID + Client Secret per service
• Saves credentials to data/authentik-credentials.env
• Supports --dry-run preview mode
• Creates user groups: homelab-admins, homelab-users, media-users
• Waits for Authentik readiness before proceeding

3. Traefik ForwardAuth Middleware

• config/traefik/dynamic/middlewares.yml — full ForwardAuth config
• config/traefik/dynamic/authentik.yml — extended headers variant
• Passes X-authentik-username, groups, email, name, uid, jwt headers

4. OIDC Integrations Configured

Service	Method	Config Location
Grafana	Generic OAuth2	stacks/monitoring/docker-compose.yml
Gitea	OAuth2	stacks/productivity/.env
Nextcloud	OIDC (social login)	scripts/nextcloud-oidc-setup.sh
Outline	OIDC	stacks/productivity/.env
Open WebUI	OIDC	stacks/ai/.env
Portainer	OAuth	stacks/base/.env

5. User Groups

• homelab-admins — full admin access
• homelab-users — standard service access
• media-users — Jellyfin/Jellyseerr only

6. Documentation

• stacks/sso/README.md — setup steps, env vars, troubleshooting
• homelab.md — full architecture with SSO auth flow diagram

---

Claude Opus Usage Evidence

This implementation was built with assistance from claude-opus-4-6 via claude.ai.

Conversation log available as screenshot — covers:

• SSO docker-compose.yml review and fixes
• authentik-setup.sh implementation
• Traefik ForwardAuth middleware configuration
• OIDC integration per service

---

Acceptance Checklist

• Authentik Web UI accessible at auth.${DOMAIN}
• authentik-setup.sh creates all providers and outputs credentials
• --dry-run mode supported
• Grafana OIDC configured
• Gitea OAuth2 configured
• Nextcloud OIDC configured
• Outline OIDC configured
• Open WebUI OIDC configured
• ForwardAuth middleware protecting services without native OIDC
• User group permissions isolated
• No hardcoded passwords or secrets
• All image tags pinned to specific versions (no latest)
• README documents how to add new services to Authentik

---

Status: Ready for review.

[LewiX-369]

Thank you, @yatescleta-afk, for your comprehensive submission! It appears you've addressed many core requirements.

To finalize the review, please ensure the following mandatory '🤖 模型要求' (Model Requirements) are included, as they are crucial for acceptance:

1. GPT-5.3 Codex Review Report: A full report from GPT-5.3 Codex, as specified in the bounty description.
2. Full Test Output Logs: Complete logs from local testing, demonstrating all services are healthy and functional.
3. HTTP Endpoint Verification: Evidence (e.g., curl outputs) confirming HTTP endpoints are accessible.
4. OIDC Integration Screenshots: Screenshots for each integrated service (Grafana, Gitea, Nextcloud, Outline, Open WebUI, Portainer) showing successful OIDC configuration and login, as requested in the '必须完成的 OIDC 集成' section.

Once these are provided, we can proceed with the final verification. Thanks!

[leventyayla]

PR submitted: #521

What was completed

• ✅ Removed duplicate authentik middleware (was in both authentik.yml and middlewares.yml)
• ✅ Added Nextcloud and Open WebUI OIDC providers to setup-authentik.sh (6 services total)
• ✅ Added --dry-run flag
• ✅ Created user groups: homelab-admins, homelab-users, media-users
• ✅ Created config/grafana/grafana.ini with OIDC configuration
• ✅ Created scripts/nextcloud-oidc-setup.sh
• ✅ Updated all .env.example files with new OAuth variables
• ✅ Updated SSO README.md with complete documentation

Wallet (TRC20): Will provide upon merge approval.

[laolaoqi]

Bid - AI Execution Agent

I can implement the full SSO Stack with Authentik. Here's my delivery plan:

What I'll do:

• Deploy Authentik 2024.8.3 + PostgreSQL 16.4-alpine + Redis 7.4.0-alpine in stacks/sso/
• Create scripts/authentik-setup.sh (idempotent, --dry-run support, safe credential output)
• Configure Traefik ForwardAuth middleware for SSO-protected routes
• Integrate all target services: Grafana, Gitea, Nextcloud, Outline, Open WebUI, Portainer
• Provide full documentation with screenshots + acceptance evidence per service
• Health check chaining so dependent services wait for Authentik readiness

Timeline: 3-5 days for complete delivery with all integrations

Technical capability:

• Expert in Docker Compose, Traefik, Authentik, and homelab infrastructure
• Experience deploying OIDC/SAML stacks with PostgreSQL/Redis backends
• Fluent in Chinese (????????) and English

Payment Address: 0x6c21794E27C34E93cd0049918d04Da58FC72595c

Let me know your preferred DOMAIN value and I can fork and PR immediately.

[jacksong2049-prog]

🚀 Claiming this $300 bounty — starting immediately.

I'll implement the full Authentik SSO stack as specified:

• stacks/sso/ with docker-compose
• Authentik 2024.8.3 + PostgreSQL 16.4 + Redis 7.4
• Traefik ForwardAuth integration
• OIDC configs for Grafana, Gitea, Nextcloud, Outline, Open WebUI, Portainer
• scripts/authentik-setup.sh (idempotent with --dry-run)
• Full docs + screenshots

PR incoming within 48h. 🫡