Merge pull request 'feat: integrate Writefreely' (#30) from luisb/authentik:feature/writefreely-integration into main

Reviewed-on: #30

.env.sample

@@ -192,5 +192,14 @@ COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
 # MILA_APPDESCRIPTION=Mila
 # MILA_GROUP='mv_admin'
 
+# COMPOSE_FILE="$COMPOSE_FILE:compose.writefreely.yml"
+# WRITEFREELY_DOMAIN=writefreely.example.com
+# SECRET_WRITEFREELY_ID_VERSION=v1
+# SECRET_WRITEFREELY_SECRET_VERSION=v1
+# APP_ICONS="nextcloud:~/.abra/recipes/authentik/icons/writefreely.png"
+# WRITEFREELY_APPGROUP="$GROUP_COMMUNICATION"
+# WRITEFREELY_APPNAME=Blog
+# WRITEFREELY_APPDESCRIPTION=Writefreely
+
 # APPLICATIONS='{"Calendar": {"url":"https://nextcloud.example.com/apps/calendar/", "group": ""}, "BBB": {"url":"https://nextcloud.example.com/apps/bbb/", "group":""}, "Pretix": {"url":"https://pretix.example.com/control/", "group":""}}'
 # EXTRA_ICONS={"Calendar": "~/.abra/recipes/authentik/icons/calendar.svg", "BBB": "~/.abra/recipes/authentik/icons/bbb.png", "Pretix": "~/.abra/recipes/authentik/icons/pretix.svg"}

abra.sh

@@ -16,6 +16,7 @@ export ZAMMAD_VERSION=v5
 export RALLLY_VERSION=v6
 export HEDGEDOC_VERSION=v5
 export MONITORING_VERSION=v7
+export WRITEFREELY_CONFIG_VERSION=v1
 export MILA_VERSION=v3
 export DB_ENTRYPOINT_VERSION=v1
 export PG_BACKUP_VERSION=v2

compose.outposts.ldap.yml

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   authentik_ldap:
-      image: ghcr.io/goauthentik/ldap:2026.8.0
+      image: ghcr.io/goauthentik/ldap:2026.8.3
       # Optionally specify which networks the container should be
       # might be needed to reach the core authentik server
       networks:

compose.writefreely.yml

@@ -0,0 +1,28 @@
+version: "3.8"
+services:
+  worker:
+    secrets:
+      - writefreely_id
+      - writefreely_secret
+    environment:
+      - WRITEFREELY_DOMAIN
+      - WRITEFREELY_APPNAME
+      - WRITEFREELY_APPDESCRIPTION
+    configs:
+      - source: writefreely
+        target: /blueprints/writefreely.yaml
+
+secrets:
+  writefreely_id:
+    external: true
+    name: ${STACK_NAME}_writefreely_id_${SECRET_WRITEFREELY_ID_VERSION}
+  writefreely_secret:
+    external: true
+    name: ${STACK_NAME}_writefreely_secret_${SECRET_WRITEFREELY_SECRET_VERSION}
+
+
+configs:
+  writefreely:
+    name: ${STACK_NAME}_writefreely_${WRITEFREELY_CONFIG_VERSION}
+    file: writefreely.yaml.tmpl
+    template_driver: golang

compose.yml

@@ -35,7 +35,7 @@ x-env: &env
 version: '3.8'
 services:
   app:
-    image: ghcr.io/goauthentik/server:2026.8.0
+    image: ghcr.io/goauthentik/server:2026.8.3
     command: server
     depends_on:
       - db
@@ -72,14 +72,14 @@ services:
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect,${STACK_NAME}-frameOptions,${STACK_NAME}-redirect"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.customFrameOptionsValue=SAMEORIGIN"
         - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.contentSecurityPolicy=frame-ancestors ${X_FRAME_OPTIONS_ALLOW_FROM}"
-        - "coop-cloud.${STACK_NAME}.version=13.0.0+2026.8.0"
+        - "coop-cloud.${STACK_NAME}.version=13.1.0+2026.8.3"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.regex=^https://(${REDIRECTS})/(.*)"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
 
   worker:
-    image: ghcr.io/goauthentik/server:2026.8.0
+    image: ghcr.io/goauthentik/server:2026.8.3
     command: worker
     depends_on:
       - db

writefreely.yaml.tmpl

@@ -0,0 +1,65 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: Writefreely
+
+entries:
+- attrs:
+    description: writefreely
+    expression: 'return { "writefreely_groups": [{"gid": group.name, "displayName":
+      group.name} for group in request.user.ak_groups.all()], }'
+    managed: null
+    scope_name: writefreely
+  conditions: []
+  id: writefreely_group_mapping
+  identifiers:
+    name: writefreely
+  model: authentik_providers_oauth2.scopemapping
+  state: present
+
+- attrs:
+    access_code_validity: minutes=1
+    authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+    authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+    invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+    client_id: {{ secret  "writefreely_id" }}
+    client_secret: {{ secret  "writefreely_secret" }}
+    client_type: confidential
+    include_claims_in_id_token: true
+    issuer_mode: per_provider
+    redirect_uris:
+    - matching_mode: strict
+      url: https://{{ env  "WRITEFREELY_DOMAIN" }}/oauth/callback/generic
+    name: Writefreely
+    property_mappings:
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
+    - !KeyOf writefreely_group_mapping
+    signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+    sub_mode: user_username
+    token_validity: days=30
+    grant_types:
+    - authorization_code
+    - refresh_token
+  conditions: []
+  id: writefreely_provider
+  identifiers:
+    pk: 9987
+  model: authentik_providers_oauth2.oauth2provider
+  state: present
+
+- attrs:
+    meta_description: "{{ env "WRITEFREELY_APPDESCRIPTION" }}"
+    meta_launch_url: https://{{ env "WRITEFREELY_DOMAIN" }}
+    name: "{{ if eq (env "WRITEFREELY_APPNAME") "" }}Writefreely{{ else }}{{ env "WRITEFREELY_APPNAME" }}{{ end }}"
+    open_in_new_tab: true
+    policy_engine_mode: any
+    provider: !KeyOf writefreely_provider
+  conditions: []
+  id: writefreely_application
+  identifiers:
+    slug: writefreely
+  model: authentik_core.application
+  state: present