paperless-ngx-deployment/authentik-setup.py

from django.db import transaction
from authentik.core.models import Application, Group, User
from authentik.policies.models import PolicyBinding
from authentik.providers.oauth2.models import OAuth2Provider
from authentik.providers.proxy.models import ProxyProvider
from authentik.outposts.models import Outpost

with transaction.atomic():
    template = OAuth2Provider.objects.get(name="Argo CD")
    redirect = template.redirect_uris[0]
    provider, _ = OAuth2Provider.objects.get_or_create(
        name="Paperless-ngx",
        defaults={
            "authorization_flow": template.authorization_flow,
            "invalidation_flow": template.invalidation_flow,
            "client_type": "confidential",
            "grant_types": ["authorization_code", "refresh_token"],
            "client_id": "paperless-ngx",
            "client_secret": CLIENT_SECRET,
            "signing_key": template.signing_key,
        },
    )
    provider.authorization_flow = template.authorization_flow
    provider.invalidation_flow = template.invalidation_flow
    provider.client_type = "confidential"
    provider.grant_types = ["authorization_code", "refresh_token"]
    provider.client_id = "paperless-ngx"
    provider.client_secret = CLIENT_SECRET
    provider.signing_key = template.signing_key
    provider.redirect_uris = [
        type(redirect)(
            matching_mode=redirect.matching_mode,
            url="https://paper.brunner.ninja/accounts/oidc/authentik/login/callback/",
            redirect_uri_type=redirect.redirect_uri_type,
        )
    ]
    provider.save()
    provider.property_mappings.set(
        template.property_mappings.filter(managed__startswith="goauthentik.io/providers/oauth2/scope-")
    )

    app, _ = Application.objects.get_or_create(
        slug="paperless-ngx", defaults={"name": "Paperless-ngx", "provider": provider}
    )
    app.name = "Paperless-ngx"
    app.provider = provider
    app.meta_launch_url = "https://paper.brunner.ninja"
    app.save()

    group, _ = Group.objects.get_or_create(name="Paperless Users")
    admin_group, _ = Group.objects.get_or_create(name="Paperless Admins")
    owner = User.objects.get(username="feedc0de")
    group.users.add(owner)
    admin_group.users.add(owner)
    binding, _ = PolicyBinding.objects.get_or_create(
        target=app, group=group, defaults={"order": 0, "enabled": True}
    )
    if not binding.enabled:
        binding.enabled = True
        binding.save(update_fields=["enabled"])

    proxy_template = ProxyProvider.objects.get(name="Provider for 30-birthday-admin")
    callback_template = proxy_template.redirect_uris[0]
    outpost = Outpost.objects.get(name="authentik Embedded Outpost")
    for name, slug, host in (
        ("Paperless scanner", "paperless-scanner", "scanner.brunner.ninja"),
        ("Paperless PDF editor", "paperless-pdf-editor", "pdfeditor.brunner.ninja"),
    ):
        url = "https://" + host
        proxy_provider, _ = ProxyProvider.objects.get_or_create(
            name=name,
            defaults={
                "authorization_flow": proxy_template.authorization_flow,
                "invalidation_flow": proxy_template.invalidation_flow,
                "mode": "forward_single",
                "external_host": url + "/",
            },
        )
        proxy_provider.authorization_flow = proxy_template.authorization_flow
        proxy_provider.invalidation_flow = proxy_template.invalidation_flow
        proxy_provider.mode = "forward_single"
        proxy_provider.external_host = url + "/"
        proxy_provider.client_type = proxy_template.client_type
        proxy_provider.grant_types = proxy_template.grant_types
        proxy_provider.redirect_uris = [
            type(callback_template)(
                matching_mode=callback_template.matching_mode,
                url=url + suffix,
                redirect_uri_type=callback_template.redirect_uri_type,
            )
            for suffix in (
                "/outpost.goauthentik.io/callback?X-authentik-auth-callback=true",
                "/?X-authentik-auth-callback=true",
            )
        ]
        proxy_provider.save()
        proxy_provider.property_mappings.set(proxy_template.property_mappings.all())
        proxy_app, _ = Application.objects.get_or_create(
            slug=slug,
            defaults={"name": name, "provider": proxy_provider},
        )
        proxy_app.name = name
        proxy_app.provider = proxy_provider
        proxy_app.meta_launch_url = url + "/"
        proxy_app.save()
        proxy_binding, _ = PolicyBinding.objects.get_or_create(
            target=proxy_app, group=group, defaults={"order": 0, "enabled": True}
        )
        if not proxy_binding.enabled:
            proxy_binding.enabled = True
            proxy_binding.save(update_fields=["enabled"])
        outpost.providers.add(proxy_provider)

print("PAPERLESS_AUTHENTIK_PROXY_APPLICATIONS_READY")