paperless-ngx-deployment/authentik-setup.py

from django.db import transaction
from authentik.core.models import Application, Group, User
from authentik.policies.models import PolicyBinding
from authentik.providers.oauth2.models import OAuth2Provider
from authentik.providers.proxy.models import ProxyProvider
from authentik.outposts.models import Outpost

with transaction.atomic():
    template = OAuth2Provider.objects.get(name="Argo CD")
    redirect = template.redirect_uris[0]
    provider, _ = OAuth2Provider.objects.get_or_create(
        name="Paperless-ngx",
        defaults={
            "authorization_flow": template.authorization_flow,
            "invalidation_flow": template.invalidation_flow,
            "client_type": "confidential",
            "grant_types": ["authorization_code", "refresh_token"],
            "client_id": "paperless-ngx",
            "client_secret": CLIENT_SECRET,
            "signing_key": template.signing_key,
        },
    )
    provider.authorization_flow = template.authorization_flow
    provider.invalidation_flow = template.invalidation_flow
    provider.client_type = "confidential"
    provider.grant_types = ["authorization_code", "refresh_token"]
    provider.client_id = "paperless-ngx"
    provider.client_secret = CLIENT_SECRET
    provider.signing_key = template.signing_key
    provider.redirect_uris = [
        type(redirect)(
            matching_mode=redirect.matching_mode,
            url="https://paper.brunner.ninja/accounts/oidc/authentik/login/callback/",
            redirect_uri_type=redirect.redirect_uri_type,
        )
    ]
    provider.save()
    provider.property_mappings.set(
        template.property_mappings.filter(managed__startswith="goauthentik.io/providers/oauth2/scope-")
    )

    app, _ = Application.objects.get_or_create(
        slug="paperless-ngx", defaults={"name": "Paperless-ngx", "provider": provider}
    )
    app.name = "Paperless-ngx"
    app.provider = provider
    app.meta_launch_url = "https://paper.brunner.ninja"
    app.save()

    group, _ = Group.objects.get_or_create(name="Paperless Users")
    admin_group, _ = Group.objects.get_or_create(name="Paperless Admins")
    owner = User.objects.get(username="feedc0de")
    group.users.add(owner)
    admin_group.users.add(owner)
    binding, _ = PolicyBinding.objects.get_or_create(
        target=app, group=group, defaults={"order": 0, "enabled": True}
    )
    if not binding.enabled:
        binding.enabled = True
        binding.save(update_fields=["enabled"])

    proxy_template = ProxyProvider.objects.get(name="Provider for 30-birthday-admin")
    scanner_url = "https://scanner.brunner.ninja"
    scanner_provider, _ = ProxyProvider.objects.get_or_create(
        name="Paperless scanner",
        defaults={
            "authorization_flow": proxy_template.authorization_flow,
            "invalidation_flow": proxy_template.invalidation_flow,
            "mode": "forward_single",
            "external_host": scanner_url + "/",
        },
    )
    scanner_provider.authorization_flow = proxy_template.authorization_flow
    scanner_provider.invalidation_flow = proxy_template.invalidation_flow
    scanner_provider.mode = "forward_single"
    scanner_provider.external_host = scanner_url + "/"
    scanner_provider.client_type = proxy_template.client_type
    scanner_provider.grant_types = proxy_template.grant_types
    callback_template = proxy_template.redirect_uris[0]
    scanner_provider.redirect_uris = [
        type(callback_template)(
            matching_mode=callback_template.matching_mode,
            url=scanner_url + suffix,
            redirect_uri_type=callback_template.redirect_uri_type,
        )
        for suffix in (
            "/outpost.goauthentik.io/callback?X-authentik-auth-callback=true",
            "/?X-authentik-auth-callback=true",
        )
    ]
    scanner_provider.save()
    scanner_provider.property_mappings.set(proxy_template.property_mappings.all())
    scanner_app, _ = Application.objects.get_or_create(
        slug="paperless-scanner",
        defaults={"name": "Paperless scanner", "provider": scanner_provider},
    )
    scanner_app.name = "Paperless scanner"
    scanner_app.provider = scanner_provider
    scanner_app.meta_launch_url = scanner_url + "/"
    scanner_app.save()
    scanner_binding, _ = PolicyBinding.objects.get_or_create(
        target=scanner_app, group=group, defaults={"order": 0, "enabled": True}
    )
    if not scanner_binding.enabled:
        scanner_binding.enabled = True
        scanner_binding.save(update_fields=["enabled"])
    Outpost.objects.get(name="authentik Embedded Outpost").providers.add(scanner_provider)

print("PAPERLESS_AUTHENTIK_AND_SCANNER_READY")