7eb8d756d1
Read all 62 source files (Dev: 37, Homelab: 22, Venture: 3, Reference: 0). Entity pages created (17): - Wiki/Reference: lovebug, jenny, sunnie, n8n, ob1, tailscale, authentik, traefik, cloudflare, obsidian, gitea, plant-based-southerner, claude-code, dispatch, docker - Wiki/Homelab: proxmox - Wiki/Dev: pbs-hub, herbydev Synthesis pages created (2): - Wiki/Homelab/homelab-ingress-stack — four-layer ingress model (Cloudflare + Traefik + Authentik + Tailscale); operational lessons from 10+ source files - Wiki/Dev/ai-memory-architecture — three memory layers (wiki + OB1 + Dispatch context); ingest paths; harness-vs-model design decision All 11 index pages rebuilt (Sources/Dev, Venture, Homelab, Reference, Sources root; Wiki/Dev, Venture, Homelab, Reference, Wiki root; vault root index.md). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
47 lines
2.0 KiB
Markdown
47 lines
2.0 KiB
Markdown
---
|
|
type: entity
|
|
path: Wiki/Reference
|
|
tags:
|
|
- authentik
|
|
- homelab
|
|
- automation
|
|
created: 2026-05-08
|
|
updated: 2026-05-08
|
|
---
|
|
|
|
# Authentik
|
|
|
|
## What it is
|
|
|
|
Authentik is the self-hosted identity provider (IdP) and SSO platform for homelab services. It handles OAuth2 and OIDC flows, providing centralized authentication for internal tools without relying on external identity providers. In the homelab stack, Authentik acts as the authorization layer in front of sensitive services, including the MCP server and planned SSH CA integration.
|
|
|
|
## Current state
|
|
|
|
Active. Current integrations:
|
|
- **Homelab MCP server** — Authentik provides OAuth2 for the `mcp.herbylab.dev` Streamable HTTP endpoint; first deployed May 2026
|
|
- **SSH CA (planned)** — step-ca + Authentik OIDC for short-lived SSH certificates, replacing long-lived keys
|
|
- **PBS security hardening (planned)** — Authentik / Authelia as second authentication layer for PBS services alongside Crowdsec
|
|
|
|
## Where it lives
|
|
|
|
- Homelab — running as a Docker container or Proxmox LXC/VM
|
|
- Accessible internally and via Cloudflare Tunnel / Traefik ingress
|
|
- Domain: likely `auth.herbylab.dev` (split-horizon `.herbylab.dev`)
|
|
|
|
## Related projects
|
|
|
|
- [[Sources/Homelab/homelab-mcp-server|homelab-mcp-server]] — OAuth2 for MCP endpoint
|
|
- [[Sources/Homelab/2026-05-06-homelab-mcp-server-stand-up|2026-05-06-homelab-mcp-server-stand-up]] — MCP stand-up session
|
|
- [[Sources/Homelab/ssh-ca-with-step-ca-authentik|ssh-ca-with-step-ca-authentik]] — SSH CA integration
|
|
- [[Sources/Homelab/pbs-security-hardening|pbs-security-hardening]] — layered PBS security
|
|
- [[Wiki/Reference/traefik|traefik]] — ingress layer
|
|
- [[Wiki/Reference/cloudflare|cloudflare]] — tunnel/DNS layer
|
|
- [[Wiki/Homelab/homelab-ingress-stack|homelab-ingress-stack]] — synthesis
|
|
|
|
## History
|
|
|
|
- Ongoing — Core SSO platform for homelab services
|
|
- **2026-05-06** — First MCP server deployed behind Authentik OAuth2
|
|
- **Planned** — step-ca OIDC integration for short-lived SSH certs
|
|
- **Planned** — PBS security hardening layer alongside Crowdsec
|