feature(Group Internal Apps): added group attr and envs for internal apps

Reviewed-on: coop-cloud/authentik#15
Reviewed-by: decentral1se <decentral1se@noreply.git.coopcloud.tech>

.env.sample

@@ -64,11 +64,22 @@ COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
 # BACKGROUND_BOX_COLOR='#eaeaeacf'
 # THEME_BACKGROUND="url('https://authentik.example.com/static/dist/assets/images/flow_background.jpg'); background-position: center; background-repeat: no-repeat; background-size: cover;"
 
+# Group Name Variables to cluster Applications
+# GROUP_SUPPORT=Support
+# GROUP_HELP=Help
+# GROUP_ORGANISATION=Organisation
+# GROUP_COMMUNICATION=Communication
+# GROUP_COLLABORATION=Collaboration
+# GROUP_DOCUMENTATION=Documentation
+# GROUP_DEVELOPMENT=Development
+# GROUP_INFRASTRUCTURE=Infrastructure
+
 # COMPOSE_FILE="$COMPOSE_FILE:compose.nextcloud.yml"
 # NEXTCLOUD_DOMAIN=nextcloud.example.com
 # SECRET_NEXTCLOUD_ID_VERSION=v1
 # SECRET_NEXTCLOUD_SECRET_VERSION=v1
 # APP_ICONS="nextcloud:~/.abra/recipes/authentik/icons/nextcloud.png"
+# NEXTCLOUD_APPGROUP="$GROUP_ORGANISATION"
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.wordpress.yml"
 # WORDPRESS_DOMAIN=wordpress.example.com
@@ -76,6 +87,7 @@ COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
 # SECRET_WORDPRESS_ID_VERSION=v1
 # SECRET_WORDPRESS_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS wordpress:~/.abra/recipes/authentik/icons/wordpress.png"
+# WORDPRESS_APPGROUP="$GROUP_DEVELOPMENT"
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.matrix.yml"
 # ELEMENT_DOMAIN=element-web.example.com
@@ -83,52 +95,61 @@ COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
 # SECRET_MATRIX_ID_VERSION=v1
 # SECRET_MATRIX_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS matrix:~/.abra/recipes/authentik/icons/matrix.svg"
+# MATRIX_APPGROUP="$GROUP_COMMUNICATION"
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.wekan.yml"
 # WEKAN_DOMAIN=wekan.example.com
 # SECRET_WEKAN_ID_VERSION=v1
 # SECRET_WEKAN_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS wekan:~/.abra/recipes/authentik/icons/wekan.png"
+# WEKAN_APPGROUP="$GROUP_ORGANISATION"
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.vikunja.yml"
 # VIKUNJA_DOMAIN=vikunja.example.com
 # SECRET_VIKUNJA_ID_VERSION=v1
 # SECRET_VIKUNJA_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS vikunja:~/.abra/recipes/authentik/icons/vikunja.svg"
+# VIKUNJA_APPGROUP="$GROUP_ORGANISATION"
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.outline.yml"
 # OUTLINE_DOMAIN=outline.example.com
 # SECRET_OUTLINE_ID_VERSION=v1
 # SECRET_OUTLINE_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS outline:~/.abra/recipes/authentik/icons/outline.png"
+# OUTLINE_APPGROUP="$GROUP_DOCUMENTATION"
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.kimai.yml"
 # KIMAI_DOMAIN=kimai.example.com
 # SECRET_KIMAI_ID_VERSION=v1
 # SECRET_KIMAI_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS kimai:~/.abra/recipes/authentik/icons/kimai_logo.png"
+# KIMAI_APPGROUP="$GROUP_ORGANISATION"
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.zammad.yml"
 # ZAMMAD_DOMAIN=zammad.example.com
 # APP_ICONS="$APP_ICONS zammad:~/.abra/recipes/authentik/icons/zammad.svg"
+# ZAMMAD_APPGROUP="$GROUP_SUPPORT"
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.monitoring.yml"
 # MONITORING_DOMAIN=monitoring.example.com
 # SECRET_MONITORING_ID_VERSION=v1
 # SECRET_MONITORING_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS monitoring:~/.abra/recipes/authentik/icons/monitoring.svg"
+# MONITORING_APPGROUP="$GROUP_INFRASTRUCTURE"
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.rallly.yml"
 # RALLLY_DOMAIN=rallly.example.com
 # SECRET_RALLLY_ID_VERSION=v1
 # SECRET_RALLLY_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS rallly:~/.abra/recipes/authentik/icons/rallly.png"
+# RALLLY_APPGROUP="$GROUP_ORGANISATION"
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.hedgedoc.yml"
 # HEDGEDOC_DOMAIN=hedgedoc.example.com
 # SECRET_HEDGEDOC_ID_VERSION=v1
 # SECRET_HEDGEDOC_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS hedgedoc:~/.abra/recipes/authentik/icons/hedgedoc.png"
+# HEDGEDOC_APPGROUP="$GROUP_DOCUMENTATION"
 
-# APPLICATIONS='{"Calendar": "https://nextcloud.example.com/apps/calendar/", "BBB": "https://nextcloud.example.com/apps/bbb/"}'
-# EXTRA_ICONS={"Calendar": "~/.abra/recipes/authentik/icons/calendar.svg", "BBB": "~/.abra/recipes/authentik/icons/bbb.png"}
+# APPLICATIONS='{"Calendar": {"url":"https://nextcloud.example.com/apps/calendar/", "group": "$GROUP_ORGANISATION"}, "BBB": {"url":"https://nextcloud.example.com/apps/bbb/", "group":"$GROUP_COMMUNICATION"}, "Pretix": {"url":"https://pretix.example.com/control/", "group":"$GROUP_ORGANISATION"}}'
+# EXTRA_ICONS={"Calendar": "~/.abra/recipes/authentik/icons/calendar.svg", "BBB": "~/.abra/recipes/authentik/icons/bbb.png", "Pretix": "~/.abra/recipes/authentik/icons/pretix.svg"}

README.md

@@ -52,6 +52,16 @@ APP_ICONS="nextcloud:~/.abra/recipes/authentik/icons/nextcloud.png"
 
 Set the nextcloud Icon using `abra app cmd -l -d <app_name> set_icons`
 
+Generate OAuth client id and secret using `abra app secret generate <app_name> -a` (all secrets) or individually:
+- `abra app secret generate <app_name> nextcloud_id`
+- `abra app secret generate <app_name> nextcloud_secret`
+
+Add the id and secret to nextcloud as secrets with:
+- `abra app secret insert <nextcloud_app_name> authentik_id v1 <id>`
+- `abra app secret insert <nextcloud_app_name> authentik_secret v1 <secret>`
+
+Redeploy Authentik to enable the nextcloud client.
+
 The configuration inside Nextcloud can be found in the [nextcloud recipe](https://git.coopcloud.tech/coop-cloud/nextcloud#authentik-integration)
 
 ## Add LDAP outpost
@@ -95,6 +105,25 @@ Run this command after every deploy/upgrade:
 
 `abra app command --local <app-name> customize <assets_path>`
 
+## Custom CSS
+
+Uncomment the following env:
+
+```
+COMPOSE_FILE="$COMPOSE_FILE:compose.css-volume.yml"
+```
+
+Redeploy the app:
+```
+abra app deploy -f <app_name>
+```
+
+Copy the CSS and restart the container:
+```
+abra app cp <app_name> my_custom.css app:/web/dist/assets/custom.css
+abra app restart <app_name> app
+```
+
 ## Email templates
 
 Add custom [email templates](https://goauthentik.io/docs/flow/stages/email/#custom-templates):
@@ -105,15 +134,15 @@ Add custom [email templates](https://goauthentik.io/docs/flow/stages/email/#cust
 
 These blueprints overwrite default blueprint values:
 
-- flow_translation.yaml
-- flow_authentication.yaml
+- `flow_translation.yaml`
+- `flow_authentication.yaml`
 
 The following default blueprints will be overwritten by customizations:
 
-- flow-password-change.yaml
-- flow-default-authentication-flow.yaml
-- flow-default-user-settings-flow.yaml
-- flow-default-source-enrollment.yaml
+- `flow-password-change.yaml`
+- `flow-default-authentication-flow.yaml`
+- `flow-default-user-settings-flow.yaml`
+- `flow-default-source-enrollment.yaml`
 
 The `abra.sh` function `apply_blueprints` needs to be executed to deactivate these blueprints to ensure that the customizations won't be overwritten. It will further execute flow_translation.yaml and flow_authentication.yaml again.
 

abra.sh

@@ -35,6 +35,15 @@ customize() {
     done
 }
 
+shell(){
+    if [ -z "$1" ]
+    then
+            echo "Usage: ... shell <python code>"
+            exit 1
+    fi
+    ak shell -c "$1" 2>&1 | quieten
+}
+
 import_user() {
     if [ -z "$1" ]
     then
@@ -79,6 +88,16 @@ set_admin_pass() {
 password=$(cat /run/secrets/admin_pass)
 token=$(cat /run/secrets/admin_token)
 /manage.py shell -c """
+import time
+i = 0
+while (not User.objects.filter(username='akadmin')):
+    print('Waiting for akadmin to be created...')
+    time.sleep(10)
+    i += 1
+    if i > 6:
+        print('Failed to find admin user!')
+        exit()
+
 akadmin = User.objects.get(username='akadmin')
 akadmin.set_password('$password')
 akadmin.save()
@@ -166,14 +185,17 @@ import os
 if os.environ['APPLICATIONS'] == '':
     exit()
 applications = json.loads(os.environ['APPLICATIONS'])
-for name, url in applications.items():
-    print(f'Add {name}: {url}')
+for name, details in applications.items():
+    url = details['url']
+    group = details['group']
+    print(f'Add {name}: {url} in group: {group}')
     app = Application.objects.filter(name=name).first()
     if not app:
         app = Application()
     app.name = name
     app.slug = name.replace(' ', '-')
     app.meta_launch_url = url
+    app.group = group
     app.open_in_new_tab = True
     app.save()
 """ 2>&1 | quieten

compose.hedgedoc.yml

@@ -6,6 +6,8 @@ services:
       - hedgedoc_secret
     environment:
       - HEDGEDOC_DOMAIN
+      - HEDGEDOC_APPGROUP
+
     configs:
       - source: hedgedoc
         target: /blueprints/hedgedoc.yaml
@@ -18,7 +20,6 @@ secrets:
     external: true
     name: ${STACK_NAME}_hedgedoc_secret_${SECRET_HEDGEDOC_SECRET_VERSION}
 
-
 configs:
   hedgedoc:
     name: ${STACK_NAME}_hedgedoc_${HEDGEDOC_CONFIG_VERSION}

compose.kimai.yml

@@ -3,6 +3,7 @@ services:
   worker:
     environment:
       - KIMAI_DOMAIN
+      - KIMAI_APPGROUP
     configs:
       - source: kimai
         target: /blueprints/kimai.yaml

compose.matrix.yml

@@ -13,6 +13,7 @@ services:
     environment:
       - ELEMENT_DOMAIN
       - MATRIX_DOMAIN
+      - MATRIX_APPGROUP
     configs:
       - source: matrix
         target: /blueprints/matrix.yaml
@@ -25,7 +26,6 @@ secrets:
     external: true
     name: ${STACK_NAME}_matrix_secret_${SECRET_MATRIX_SECRET_VERSION}
 
-
 configs:
   matrix:
     name: ${STACK_NAME}_matrix_${MATRIX_CONFIG_VERSION}

compose.monitoring.yml

@@ -5,7 +5,8 @@ services:
       - monitoring_id
       - monitoring_secret
     environment:
-      - MONITORING_DOMAIN 
+      - MONITORING_DOMAIN
+      - MONITORING_APPGROUP
     configs:
       - source: monitoring
         target: /blueprints/monitoring.yaml
@@ -18,7 +19,6 @@ secrets:
     external: true
     name: ${STACK_NAME}_monitoring_secret_${SECRET_MONITORING_SECRET_VERSION}
 
-
 configs:
   monitoring:
     name: ${STACK_NAME}_monitoring_${MONITORING_CONFIG_VERSION}

compose.nextcloud.yml

@@ -6,6 +6,7 @@ services:
       - nextcloud_secret
     environment:
       - NEXTCLOUD_DOMAIN
+      - NEXTCLOUD_APPGROUP
     configs:
       - source: nextcloud
         target: /blueprints/nextcloud.yaml
@@ -18,7 +19,6 @@ secrets:
     external: true
     name: ${STACK_NAME}_nextcloud_secret_${SECRET_NEXTCLOUD_SECRET_VERSION}
 
-
 configs:
   nextcloud:
     name: ${STACK_NAME}_nextcloud_${NEXTCLOUD_CONFIG_VERSION}

compose.outline.yml

@@ -6,6 +6,7 @@ services:
       - outline_secret
     environment:
       - OUTLINE_DOMAIN
+      - OUTLINE_APPGROUP
     configs:
       - source: outline
         target: /blueprints/outline.yaml
@@ -18,7 +19,6 @@ secrets:
     external: true
     name: ${STACK_NAME}_outline_secret_${SECRET_OUTLINE_SECRET_VERSION}
 
-
 configs:
   outline:
     name: ${STACK_NAME}_outline_${OUTLINE_CONFIG_VERSION}

compose.outposts.ldap.yml

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   authentik_ldap:
-      image: ghcr.io/goauthentik/ldap:2024.10.5
+      image: ghcr.io/goauthentik/ldap:2025.2.4
       # Optionally specify which networks the container should be
       # might be needed to reach the core authentik server
       networks:

compose.rallly.yml

@@ -6,6 +6,7 @@ services:
       - rallly_secret
     environment:
       - RALLLY_DOMAIN
+      - RALLLY_APPGROUP
     configs:
       - source: rallly
         target: /blueprints/rallly.yaml
@@ -18,7 +19,6 @@ secrets:
     external: true
     name: ${STACK_NAME}_rallly_secret_${SECRET_RALLLY_SECRET_VERSION}
 
-
 configs:
   rallly:
     name: ${STACK_NAME}_rallly_${RALLLY_CONFIG_VERSION}

compose.vikunja.yml

@@ -6,6 +6,7 @@ services:
       - vikunja_secret
     environment:
       - VIKUNJA_DOMAIN
+      - VIKUNJA_APPGROUP
     configs:
       - source: vikunja
         target: /blueprints/vikunja.yaml
@@ -18,7 +19,6 @@ secrets:
     external: true
     name: ${STACK_NAME}_vikunja_secret_${SECRET_VIKUNJA_SECRET_VERSION}
 
-
 configs:
   vikunja:
     name: ${STACK_NAME}_vikunja_${VIKUNJA_CONFIG_VERSION}

compose.wekan.yml

@@ -6,6 +6,7 @@ services:
       - wekan_secret
     environment:
       - WEKAN_DOMAIN
+      - WEKAN_APPGROUP
     configs:
       - source: wekan
         target: /blueprints/wekan.yaml
@@ -18,7 +19,6 @@ secrets:
     external: true
     name: ${STACK_NAME}_wekan_secret_${SECRET_WEKAN_SECRET_VERSION}
 
-
 configs:
   wekan:
     name: ${STACK_NAME}_wekan_${WEKAN_CONFIG_VERSION}

compose.wordpress.yml

@@ -7,6 +7,7 @@ services:
     environment:
       - WORDPRESS_DOMAIN
       - WORDPRESS_GROUP
+      - WORDPRESS_APPGROUP
     configs:
       - source: wordpress
         target: /blueprints/wordpress.yaml
@@ -19,7 +20,6 @@ secrets:
     external: true
     name: ${STACK_NAME}_wordpress_secret_${SECRET_WORDPRESS_SECRET_VERSION}
 
-
 configs:
   wordpress:
     name: ${STACK_NAME}_wordpress_${WORDPRESS_CONFIG_VERSION}

compose.yml

@@ -34,7 +34,7 @@ x-env: &env
 version: '3.8'
 services:
   app:
-    image: ghcr.io/goauthentik/server:2024.10.5
+    image: ghcr.io/goauthentik/server:2025.2.4
     command: server
     depends_on:
       - db
@@ -72,11 +72,11 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.customFrameOptionsValue=SAMEORIGIN"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.contentSecurityPolicy=frame-ancestors ${X_FRAME_OPTIONS_ALLOW_FROM}"
-        - "coop-cloud.${STACK_NAME}.version=6.11.1+2024.10.5"
+        - "coop-cloud.${STACK_NAME}.version=7.1.0+2025.2.4"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
 
   worker:
-    image: ghcr.io/goauthentik/server:2024.10.5
+    image: ghcr.io/goauthentik/server:2025.2.4
     command: worker
     depends_on:
       - db
@@ -117,7 +117,7 @@ services:
       start_period: 5m
 
   db:
-    image: postgres:15.8
+    image: postgres:15.12
     secrets:
       - db_password
     configs:
@@ -152,7 +152,7 @@ services:
           backupbot.restore.post-hook: '/pg_backup.sh restore'
 
   redis:
-    image:  redis:7.4.1-alpine
+    image:  redis:7.4.2-alpine
     command: --save 60 1 --loglevel warning
     networks:
       - internal

compose.zammad.yml

@@ -3,6 +3,7 @@ services:
   worker:
     environment:
       - ZAMMAD_DOMAIN
+      - ZAMMAD_APPGROUP
     configs:
       - source: zammad
         target: /blueprints/zammad.yaml

hedgedoc.yaml.tmpl

@@ -40,6 +40,7 @@ entries:
     policy_engine_mode: any
     provider: !KeyOf hedgedoc_provider
     slug: hedgedoc
+    group: {{ env "HEDGEDOC_APPGROUP" }}
   conditions: []
   id: hedgedoc_application
   identifiers:

icons/pretix.svg

@@ -0,0 +1 @@
+<?xml version="1.0" encoding="UTF-8"?><svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128"><defs><style>.cls-1{fill:#3b1c4a;}</style></defs><path class="cls-1" d="m50.67,56.95c-.72.1-1.22.3-1.66.5l2.38,16.91c.41.08.95.13,1.6.04,3.52-.5,4.61-3.64,3.81-9.39-.83-5.87-2.53-8.56-6.12-8.06Z"/><path class="cls-1" d="m116.04,35.05c.71-.17,1.16-.76,1.06-1.48L112.54,1.13c-.1-.72-.77-1.22-1.49-1.12l-37.5,5.27.73,5.22c.16,1.12-.62,2.15-1.74,2.31s-2.15-.62-2.31-1.74l-.73-5.22L1.13,15.46c-.72.1-1.22.77-1.12,1.49l4.56,32.44c.1.72.7,1.17,1.42,1.13,11.25-.92,21.43,7.1,23.03,18.46,1.6,11.36-5.99,21.81-17.07,23.96-.71.17-1.16.76-1.06,1.48l4.56,32.44c.1.72.77,1.22,1.49,1.12l68.37-9.61-.73-5.22c-.16-1.15.59-2.15,1.74-2.31s2.15.62,2.31,1.74l.73,5.22,37.5-5.27c.72-.1,1.22-.77,1.12-1.49l-4.56-32.44c-.1-.72-.7-1.17-1.42-1.13-11.25.92-21.42-7.04-23.02-18.4-1.6-11.36,5.98-21.87,17.06-24.03Zm-59.84,44.75c-1.76.25-3.29.26-4.04.17l1.59,11.29-9.92,1.39-5.3-37.73c2.5-1.62,5.96-3.03,11.38-3.8,8.68-1.22,15.27,2.58,16.66,12.44,1.25,8.88-3.12,15.21-10.36,16.23Zm30.73,20.71c.16,1.12-.62,2.15-1.74,2.31-1.12.16-2.15-.62-2.31-1.74l-1.47-10.44c-.16-1.12.62-2.15,1.74-2.31s2.16.66,2.31,1.74l1.47,10.44Zm-3.17-22.58c.15,1.08-.66,2.16-1.74,2.31s-2.16-.66-2.31-1.74l-1.47-10.44c-.16-1.15.59-2.15,1.74-2.31,1.12-.16,2.15.62,2.31,1.74l1.47,10.44Zm-3.16-22.45c.16,1.12-.62,2.15-1.74,2.31-1.12.16-2.15-.62-2.31-1.74l-1.47-10.44c-.16-1.12.62-2.15,1.74-2.31s2.16.66,2.31,1.74l1.47,10.44Zm-3.17-22.58c.15,1.08-.66,2.16-1.74,2.31s-2.16-.66-2.31-1.74l-1.47-10.44c-.16-1.15.59-2.15,1.74-2.31s2.15.62,2.31,1.74l1.47,10.44Z"/></svg>

kimai.yaml.tmpl

@@ -42,6 +42,7 @@ entries:
     policy_engine_mode: any
     provider: !KeyOf kimai_provider
     slug: kimai
+    group: {{ env "KIMAI_APPGROUP" }}
   conditions: []
   id: kimai_application
   identifiers:

matrix.yaml.tmpl

@@ -40,6 +40,7 @@ entries:
     policy_engine_mode: any
     provider: !KeyOf matrix_provider
     name: Element
+    group: {{ env "MATRIX_APPGROUP" }}
   conditions: []
   id: matrix_application
   identifiers:

monitoring.yaml.tmpl

@@ -39,7 +39,8 @@ entries:
     open_in_new_tab: true
     policy_engine_mode: any
     provider: !KeyOf monitoring_provider
-    slug: monitoring 
+    slug: monitoring
+    group: {{ env "MONITORING_APPGROUP" }}
   conditions: []
   id: monitoring_application
   identifiers:

nextcloud.yaml.tmpl

@@ -53,6 +53,7 @@ entries:
     policy_engine_mode: any
     provider: !KeyOf nextcloud_provider
     slug: nextcloud
+    group: {{ env "NEXTCLOUD_APPGROUP" }}
   conditions: []
   id: nextcloud_application
   identifiers:

outline.yaml.tmpl

@@ -40,6 +40,7 @@ entries:
     policy_engine_mode: any
     provider: !KeyOf outline_provider
     slug: outline
+    group: {{ env "OUTLINE_APPGROUP" }}
   conditions: []
   id: outline_application
   identifiers:

rallly.yaml.tmpl

@@ -40,6 +40,7 @@ entries:
     policy_engine_mode: any
     provider: !KeyOf rallly_provider
     slug: rallly
+    group: {{ env "RALLLY_APPGROUP" }}
   conditions: []
   id: rallly_application
   identifiers:

vikunja.yaml.tmpl

@@ -40,6 +40,7 @@ entries:
     policy_engine_mode: any
     provider: !KeyOf vikunja_provider
     slug: vikunja
+    group: {{ env "VIKUNJA_APPGROUP" }}
   conditions: []
   id: vikunja_application
   identifiers:

wekan.yaml.tmpl

@@ -58,6 +58,7 @@ entries:
     policy_engine_mode: any
     provider: !KeyOf wekan_provider
     slug: wekan
+    group: {{ env "WEKAN_APPGROUP" }}
   conditions: []
   id: wekan_application
   identifiers:

wordpress.yaml.tmpl

@@ -40,6 +40,7 @@ entries:
     policy_engine_mode: any
     provider: !KeyOf wordpress_provider
     slug: wordpress
+    group: {{ env "WORDPRESS_APPGROUP" }}
   conditions: []
   id: wordpress_application
   identifiers:

zammad.yaml.tmpl

@@ -61,6 +61,7 @@ entries:
     policy_engine_mode: any
     provider: !KeyOf zammad_provider
     slug: zammad
+    group: {{ env "ZAMMAD_APPGROUP" }}
   conditions: []
   id: zammad_application
   identifiers: