From 598807fe6dc0df84903ce73d9b50b5e71ae52614 Mon Sep 17 00:00:00 2001
From: Moritz <moritz.m@local-it.org>
Date: Thu, 13 Apr 2023 20:47:54 +0200
Subject: [PATCH] wekan sso blueprint

---
 .env.sample       |   6 ++++++
 abra.sh           |   1 +
 compose.wekan.yml |  26 ++++++++++++++++++++++++++
 icons/wekan.png   | Bin 0 -> 4124 bytes
 wekan.yaml.tmpl   |  43 +++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 76 insertions(+)
 create mode 100644 compose.wekan.yml
 create mode 100644 icons/wekan.png
 create mode 100644 wekan.yaml.tmpl

diff --git a/.env.sample b/.env.sample
index 3b8ba28..3607baa 100644
--- a/.env.sample
+++ b/.env.sample
@@ -56,3 +56,9 @@ COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
 # SECRET_MATRIX_ID_VERSION=v1
 # SECRET_MATRIX_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS matrix:~/.abra/recipes/authentik/icons/matrix.svg"
+
+# COMPOSE_FILE="$COMPOSE_FILE:compose.wekan.yml"
+# WEKAN_DOMAIN=wekan.example.com
+# SECRET_WEKAN_ID_VERSION=v1
+# SECRET_WEKAN_SECRET_VERSION=v1
+# APP_ICONS="$APP_ICONS wekan:~/.abra/recipes/authentik/icons/wekan.png"
diff --git a/abra.sh b/abra.sh
index 4d798e0..5a06e57 100644
--- a/abra.sh
+++ b/abra.sh
@@ -8,6 +8,7 @@ export SYSTEM_TENANT_VERSION=v1
 export NEXTCLOUD_CONFIG_VERSION=v1
 export WORDPRESS_CONFIG_VERSION=v1
 export MATRIX_CONFIG_VERSION=v1
+export WEKAN_CONFIG_VERSION=v1
 
 customize() {
     if [ -z "$1" ]
diff --git a/compose.wekan.yml b/compose.wekan.yml
new file mode 100644
index 0000000..49b506e
--- /dev/null
+++ b/compose.wekan.yml
@@ -0,0 +1,26 @@
+version: "3.8"
+services:
+  worker:
+    secrets:
+      - wekan_id
+      - wekan_secret
+    environment:
+      - WEKAN_DOMAIN
+    configs:
+      - source: wekan
+        target: /blueprints/wekan.yaml
+
+secrets:
+  wekan_id:
+    external: true
+    name: ${STACK_NAME}_wekan_id_${SECRET_WEKAN_ID_VERSION}
+  wekan_secret:
+    external: true
+    name: ${STACK_NAME}_wekan_secret_${SECRET_WEKAN_SECRET_VERSION}
+
+
+configs:
+  wekan:
+    name: ${STACK_NAME}_wekan_${WEKAN_CONFIG_VERSION}
+    file: wekan.yaml.tmpl
+    template_driver: golang
diff --git a/icons/wekan.png b/icons/wekan.png
new file mode 100644
index 0000000000000000000000000000000000000000..b3459443814def9c5649e87f86137b56a9582be5
GIT binary patch
literal 4124
zcmV+%5aaKOP)<h;3K|Lk000e1NJLTq005Q%005Q<0ssI2vt#D9000l;Nkl<Zc%1B=
z2~<>9n#bRJwO3J#1r+-xve+t{prE3-BpOXejY-EbM!S>Nlf=YHpXph0I+Mxt^hwW5
za?*2h;$)fDiRn&abR<1)7+fOaf<X|FMPw=VDkz{9YA>kj17)!4)&d3ZU3hqZ$K$cC
z?|rx4{n!2O_TBrK*p7e1NF^_4V_U~PMQ^)nV&;<78eN~f{T{h_%}ylZkgT-TmrDzQ
zbczarAlDoMK1>X!z$%V`W^tFl=RCe1mYPCfQd6#;8v06{llak!{6avEl=e{INd34G
zR0%041XK%Y50a4fFfp70Pde%@Jj~)a1$oU%oR8`CVJRpCR10Yjl92YGp*;n_9onN>
zNPCckv<KP*8}g)76#|-_p$1<Mi)LpKo*)Tn4;oZZ09r4c6ToW>kt3x&upH?lRSD60
zAtE4<gtP}aQVM|UNYMlv6+j(TAV*4jkc6}c(loaNv*Q@?i1<+gC+wJgt}Xcv88s47
zFr2(*oO$9<on8YiJ4h0CDqF*Yqhliy@wpwuhT}46WJ-Kmb7vj2JRt=kT8FLIsxM@w
z<YuJgS*#YabDS-(nJkmVSYB76Giaa%Au`D|=Lel$T~blRU@*CCF0@P`W3^dr!&b<d
z!jsU+$jGq4q=%g8+y>(841(4@QUrCtT=GRwQZf)D*v4S7SOP&1*;&pO%x06>Z1#5r
zHPhUXkcG)MZFy2A3pE;z&@zP#m%}v}3>S-wTbi4pWeQ0`KA*pH*YlSzU8<|Cb=d82
zGMy1(<Kwn%fBM8X#}qvZI5|S<&irK2;^wBN+M1fVtsjPA9c}H`N=ujK<Uq?2(x4(Z
zG+3!rJ|bNlrBacWo<7%>d<lZ#a5x^3ZmQkxAP532`64C@isq&Ov_%vV5J*DWL&18X
zuOmAiokL6fJS;l21mOvikoKS+DFvV&DIy?{gtQ0ksh|S7A6kNTHlZz|GXk5*;4m38
z{Vk>f>>$Kh%O9TG_{y5>X4T-8#<tVd_lxUVEW;x+{iP-aHI9^qr$2po`PRPttR$H<
zNhaNwpQX_14<0-Je--spu?5|c;$;89CY?Bo{xm8FPgma`FP8{$(6N0x)}|!P{z9N-
zTgYM%Yg6K1T9p|l5|C*2+bXwL@h}Mdw_6KHv`-P#1R;+9=3EoW=uR(;2zhZu#tXS=
zPVw{>>$^qQKDbauO1stCuLe@`=1226ETh#Hm?7w=KhXdtL2S=VJ-BY!ss%Bw=|LR!
zyW7^ixFX}g*G0wkt<%iKYy*D>3<3}0umhG5F0<W{ig}!0Kc3h8yVs8I-{GpCYq2hn
zNzc8$YvZCs&)Y+S_%E)^nB-`I&Gb?lwvpN1FD1xtUrB1ng*^5@Kbhb5?!otVY={dM
zJHM{o;W&AxVfFh*fjY+^@Z>P5r;!6|vk&k2>Al~+x_3o7gMs_cF-jr=N@u`e(wNQU
zlmKO2Iw~gE{4@oV%1gjuy;hL(_mAfV3wW;S=W3hZ{PuE9cOQemPbJ3zcNN#mJ?-zz
zUW{Q_e6Zy6y-)r6vAkEmDk^R6@Re_J7`T<ZthL+Wm_qqL9aWIu7UDQQ7H>GUd$C<P
zi{IO^Awul7@1jMee&ws83k?ry-qP3z37-pG(AYZwSj&tFPYr*l%Hqh-i*GzX|E-U@
zHA7x=&yI@#Qc9ZIr}iK|pd<{FWC?K$7xN`UX5AF-T@oexXy>NYNwKbpc8BAGi?`lB
zb;V>G9#34KngHB;uGY&QhTY4T04Z!HLnah>m5@Q;Kwk;Nu#=T!zVTCU9uo1yBpP%=
z=AeQgh_tw+8pEK$q6f|T?N8%4_SO^mZ*R$G5^f!eUY%jj=l@^qtb8u_ZdeFPSX9>x
z80Rn<FXVy}+D7b+eFI*<MqXmHOz1Ystmsg*4ydP6K0Y3{Yp`S8;!R3TcdwSr?H0^+
zi#L&E3Kwt%y&A>s*0O+Zlkm8I`o-2Kmm~q{<?TJ&K0eW-1#1kC#auBz+BL;&8!l-A
zTexi*DWO4pAhD`T>1%|rH7x~5`TS;0AkQ%|CadvQ^R=w`%L$yY+DJPyf>|jqC&`pU
zZ`KcwI16a9!`di`@cUowPLfH1^b?g0dp|!l<~+e$Rwl-BS#JLST1%(V3SPN?RhH*h
zyxH3A%N1-*Pj>yNHCc|9)l9YN^67K>b*kd3Gkmsy&EibSvKN>d;~-hKF#l5z9(^%3
zlX3RIbDsJgxlz6UtFt3^hgWOsQsaS?@9JBDE0bi>waMURqY}!yyxL5Qk^x`i@Qtb=
zi<N8zA7Hc@j5foROnYG_hxU7yr=>@S0f}GVuKVSeXGZn&!CH^u#CIO^GW%C$8f{)2
zW|_R(tIe15-Kwn7YJ2};V9mh{GLsT+S~MR>DU)~q;)~OMh9p8R8|eD?XoqSQeXc1S
zCSz}IT7#k=xL2vuw+(1LZHl;@-OJoMJ|BKxuF%rvWEINR3qA30q(ZJ+dtkB+@A=}C
zWn{$9S6a0o2I#e3YHV}3d#$H4Qx#f0L4a0nwe@(l{6g*$A(uV=anNA;&x<#wRV;Ah
zgl4i9R(JKfems1ms;O^+hS{@)yWH3Yq#Rh2eY~=MQA8+^?$wLpIQELW7yZrYD{7<P
zBM)X7%%^kyhAdkKi=m^xtx-{DcX-{64OYX?u2;QYkTX69U0BsP;ZL_932X>2HMYCn
zwJbg|H$Lj!^VdD6w#(!_p7wvbB*|6m+Z~F}u2qS7+&HP2#UT2Ij9nVtl;)bePo(kK
z{Ir;iP*FIW$)18yuP_U5A0x|F5J$KqCL=Q;r$T-U{6BBLrAamTcZC-}`q@V3$9iSI
ze+9)nPF75~Ys&q;!A_0N^{zM8<`mVpNZlt_F$^2F+sivZM~dUvJ6l$}rpO00m2bY3
z7AgDe`kk10qRopEl{&-Mx9fgid_$$5^g$gy94V8*T%Ed3u4=y1aobAXQEg;8QoUv9
zht`|nq6jVvEJ0r!x?1tt@$al-3p%5nc)#Q)#xUGlxXbt5ylAvU_)O-)Pp(y_N6UbF
z>lOV5k3s#mw3JNuF7dOO3)7=yN6M;SK2~(->TL|e!bO5#ty^~YH~W@Ef;IysMjAh8
z7`U&zN1}e@w}m72VU0;G<_9nnc<5?H#_tb*SzbHg%4%*x6p(Vsy&*hUkkg|bI$z(C
z8WsXvS=p%sQg9smm(BT}x!6YRZ=Wd{tMm_N(!+#;Pj*gs8cW0z4eG(U_~}D_cgAkF
z6L??&nGMSR-A7MNc-iv!NFe2EbLaTK=kd8Ougd!L+MN-*V?pRV;7U&kcjqilkMdHn
z&ek>ejEyML+^e1E5H?T<oMCs6zkp1eS5Oi-o)haPVY5ozr#Fn-e7zvsfjK_8UddqK
z3BeNJ_R21|BU7Y&-uv6vd(G&4eT(zTm5FXMvE}XF$0XkI^|0hG7t&`>#lr9qG0$xr
zdA+r3+@OHXI=Ck1(A7${(UK4>0lK3O2UgRqa?SnUx2^@&CC0hZ)QMqultj29;h}_s
zM$@auznk>;hZ_Gh+hb?OSsn*^(Hruv@qZsI$mX(`fB60f48uIVXs1T!+E-dRKl+z>
z8D4YInk<cdqs`TU{H5bvr&@(-*?UJDln<J*&5IIWUz1JJW03%?*qLcZj^uceu-o}x
zVIsjlJ(l<1r4=fJ5yP?gV6Zb)r%;XC5pvl_p5KDwqumzI;*bw&FdRz`lO8M>6-i?<
zzf)A2_rVt}&V@r96Y)4lp5LN2O%zZAF?@y|L5LWJrMd^UXib*UapV~Px;bBCvi#fm
z>&}lNF1U`<@MBB{j$?n^wK-WP)myB8d-B5JU0Z-F4HjEMu;ldqXYch69IL4R<IQS~
z$!(_QcTcWX==5J#z&ikcLTDo)pY8Tl?<!RGv00O)G2t)erEmM6ljE+E#Q<A}PW6L8
zkawQQ|5@fj+lc+yBj4U^>;81-6TpnCn8!($NuT)mo7Mp@FPhl=lf->_87u$mPkt6s
z-~;I;2iUaF>$tB{FLUvw-P$1x$N6m5pZ7d<;?BLZqus~{#;>+?0{0qi!x)bL!}{E}
zH?1;SZO{JiU(Vl?kBuK%wz@|PEC`ub+S)ZbLiPBnIk6Fc-t*MnFV9qV^-l00zK(5q
z#1Ad`>_(OAT%~1rguwAb&peLf_^T(1U9Y?$?>_Aw4JF}mKYeb~e>_z%U@&d`_?vU}
zEza~e3NLoKheB~#%<XB(p1CiL3IA}%W7`iG9=}6oKolu3u;m-bwHPxmR%24@EpA1V
zG(S;qFev+ar);)Et<zhqkEJ9yf5b8&|Cx-`<WTA6PmU{e;M(4~hL)8H(Q(oT{hIa3
zaoMpEx7vF)96EMap&GwTW3m+1+|P&(i<ds^0p%q`ovLjb{Bf~Dz-B$2mcnK--aK8>
zHt1!!(UTxSP}2MbcWSGF^aydJdDx^ef;%^+32h|AFzjYqcS&<cltdUB#M4`BXX;vh
z{^eOu{hW35=nu8>0d25=Cl&DOmHls>y?XHE1&s*|I?|dfUzFdi=~0CW_%ZWD1da<i
z?3Z%Wm&SyzPmW)+ASP7E|4YsNI%WUlTR+GW(q?wX$(5FlD<5}w$<6~i<~Uk@_h|Xu
z2`_eFSYb_LVNIiu!_J5bi<6EDsWn?FJ9|4dI{&$N2ksV8+Vn^vFl4cowsw|IcY_pc
zV7{k<f?wb)1@fK>dQ6eh3b<QDX)~xm_yS2tdys^*2OZ!=4QR=i=Ab2CL?9puX%89~
zQUDqkA_4+QNPCckv<FE@d(aDi$Ok9zv3E7jt=JjekX|I5voF#Hm?x5Gbdw6vAO%Pg
zHnq2;r!E!?!E@^79y~60#nR>V&5h7<gtThk*RLwQUH0>5c6BMbjb;;^OyR?3vEw3R
zsvBw>TbrO|3NP^DPF+n?TT4_}B%eFk4WzWgYO|Kyx(?He!d<DrFul>xD2Mm+oG}79
zKWX})K?UtW64D-+5o`!b=DDG^g^xPatW-b@1;(*hacl@bghkBR_+z`np*E}KYWavA
z-nsg)N)yL&qw`n<t3%U1Ou?xSvjhUi!-Wy?lK3mF-$Q#$ND@W_MR1v%lD3j5pS(^N
zI<=iyky%M0DGjPAy|OECAoWOt`5`^J?m4fYlP+y%Fduwh0(C&z*~B7P2FK7N(#Nsd
zZEOY$S`Z={7t$WIvxy3z?rcJ}koF)6X%C7cr2rI1iU<fKA?-mD(jK(GkOH6|T0*OX
zXXpVM7a{@yNl1H;gtUidXRy%&xZN343uzCMkoF)6X%7`=b9>uG=jXWUxrd(}mJ}2M
zs)e)%Nl1H;gtP}qNPEyq1vNlC2@%yo+JhvdJt&TpBH(#aR10Yj3PPj+6oiNfh`$B^
a0RR6K>>ITsL>*870000<MNUMnLSTaL75Yv9

literal 0
HcmV?d00001

diff --git a/wekan.yaml.tmpl b/wekan.yaml.tmpl
new file mode 100644
index 0000000..63dab5f
--- /dev/null
+++ b/wekan.yaml.tmpl
@@ -0,0 +1,43 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: wekan
+
+entries:
+
+- attrs:
+    access_code_validity: minutes=1
+    authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+    client_id: {{ secret  "wekan_id" }}
+    client_secret: {{ secret  "wekan_secret" }}
+    client_type: confidential
+    include_claims_in_id_token: true
+    issuer_mode: per_provider
+    name: Wekan
+    property_mappings:
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
+    signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+    sub_mode: user_username
+    token_validity: days=30
+  conditions: []
+  id: wekan_provider
+  identifiers:
+    pk: 9996
+  model: authentik_providers_oauth2.oauth2provider
+  state: present
+
+- attrs:
+    meta_launch_url: https://{{ env  "WEKAN_DOMAIN" }}
+    open_in_new_tab: true
+    policy_engine_mode: any
+    provider: !KeyOf wekan_provider
+    slug: wekan
+  conditions: []
+  id: wekan_application
+  identifiers:
+    name: Wekan
+  model: authentik_core.application
+  state: present