gitea and authentik

ansible/playbooks/roles/authentik/templates/env.j2

@@ -9,3 +9,5 @@ PROXMOX_OIDC_CLIENT_ID={{ vault_proxmox_oidc_client_id }}
 PROXMOX_OIDC_CLIENT_SECRET={{ vault_proxmox_oidc_client_secret }}
 STEPCA_OIDC_CLIENT_ID={{ vault_stepca_oidc_client_id }}
 STEPCA_OIDC_CLIENT_SECRET={{ vault_stepca_oidc_client_secret }}
+GITEA_OIDC_CLIENT_ID={{ vault_gitea_oidc_client_id }}
+GITEA_OIDC_CLIENT_SECRET={{ vault_gitea_oidc_client_secret }}

ansible/playbooks/roles/gitea/defaults/main.yml

@@ -7,7 +7,7 @@
 gitea_compose_dir: /opt/gitea
 
 # Gitea application settings
-gitea_domain: git.mk-labs.cloud
+gitea_domain: gitea.mk-labs.cloud
 gitea_root_url: "https://{{ gitea_domain }}"
 gitea_http_port: 3000
 gitea_ssh_port: 2221
@@ -26,6 +26,14 @@ gitea_db_user: gitea
 traefik_dynamic_config_dir: /opt/traefik/dynamic
 
 # DNS
-gitea_cname_name: git
+gitea_cname_name: gitea
 gitea_cname_domain: mk-labs.cloud
 gitea_cname_target: mad-tea-party.local.mk-labs.cloud
+
+# OIDC / Authentik SSO
+gitea_oidc_enabled: true
+gitea_oidc_client_id: "{{ vault_gitea_oidc_client_id }}"
+gitea_oidc_client_secret: "{{ vault_gitea_oidc_client_secret }}"
+gitea_oidc_discovery_url: "https://authentik.local.mk-labs.cloud/application/o/gitea/.well-known/openid-configuration"
+gitea_oidc_admin_group: "mk-labs-admins"
+gitea_admin_api_token: "{{ vault_gitea_admin_api_token }}"

ansible/playbooks/roles/gitea/tasks/configure_oidc.yml

@@ -0,0 +1,27 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/roles/gitea/tasks/configure_oidc.yml
+# DESCRIPTION: Registers Authentik as an OAuth2 source in Gitea via the admin
+#              API. Idempotent — skips creation if source already exists.
+# ------------------------------------------------------------------------------
+
+- name: Check if authentik auth source already exists
+  ansible.builtin.command:
+    cmd: docker exec -u git gitea-gitea-1 gitea admin auth list
+  register: _auth_list
+  changed_when: false
+
+- name: Create Authentik OAuth2 auth source
+  ansible.builtin.command:
+    cmd: >
+      docker exec -u git gitea-gitea-1 gitea admin auth add-oauth
+      --name authentik
+      --provider openidConnect
+      --key {{ gitea_oidc_client_id }}
+      --secret {{ gitea_oidc_client_secret }}
+      --auto-discover-url {{ gitea_oidc_discovery_url }}
+      --scopes "email profile"
+      --group-claim-name groups
+      --admin-group {{ gitea_oidc_admin_group }}
+      --skip-local-2fa false
+  when: "'authentik' not in _auth_list.stdout"

ansible/playbooks/roles/gitea/tasks/main.yml

@@ -61,3 +61,7 @@
 #     service_name: "{{ gitea_cname_name }}"
 #     service_domain: "{{ gitea_cname_domain }}"
 #     target_host: "{{ gitea_cname_target }}"
+- name: Configure Authentik OIDC source
+  ansible.builtin.import_tasks: configure_oidc.yml
+  when: gitea_oidc_enabled | bool
+  tags: oidc

ansible/playbooks/roles/gitea/templates/env.j2

@@ -5,3 +5,8 @@
 # ------------------------------------------------------------------------------
 
 DATABASE_PASSWORD={{ gitea_db_password }}
+
+# OIDC auto-registration (Gitea reads these at runtime)
+GITEA__oauth2__ENABLE_AUTO_REGISTRATION=true
+GITEA__oauth2__UPDATE_AVATAR=true
+GITEA__oauth2__ACCOUNT_LINKING=login