rays/ipodderx-rs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: the ipodderx tile in Authentik's library

Browse Source 
A bookmark application with no provider, so ipodderx shows in the library
beside Outline. Recorded with its id and how to delete it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TAC7sLVqfKmY6rsTLXzNgk
This commit is contained in:
Ray Slakinski
2026-09-12 14:03:06 +00:00
parent bedf64e645
commit 9a8a3c696f
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/history.md
View File

@@ -39,8 +39,14 @@ Every change, in order, with how to undo it:
`"Cf-Access-Authenticated-User-Email"`, and `"192.168.16.1"` added to `trusted_proxies`. The
file as it was is `config.toml.2026-09-12-sso.bak` beside it. Undo: copy the backup back and
`docker compose -f /mnt/fast/arcane/projects/content/compose.yaml restart ipodderx`.
4. **Cloudflare, Authentik, Docker networks and other containers**: unchanged. The `busybox` test
container was removed when it exited, and its image afterwards.
4. **Cloudflare, Docker networks and other containers**: unchanged. The `busybox` test container
was removed when it exited, and its image afterwards.
5. **Authentik**, later the same day, because ipodderx had no tile in its library while Outline
did: a bookmark application `ipodderx` (pk `5854a98e-816a-4c4f-9f27-63e69dc29d1d`), made
through the API with a token of Ray's. No provider and no policy bindings, like Outline's, the
iPodderX icon, and a link to `https://ipodderx.sdf1.net`. It changes nothing about who can sign
in. Undo: delete it under Applications → Applications, or
`DELETE /api/v3/core/applications/ipodderx/`.
What the address trusts is any container on Tower that connects through the host's port, not only
`cloudflared`. Verifying Cloudflare's signed `Cf-Access-Jwt-Assertion` would remove that, and is

8
docs/sso.md
View File

@@ -89,6 +89,14 @@ send:
docker exec iPodderX ipx user rename <old name> <email address>
```
### The tile in Authentik's library
Authentik's library lists Authentik's own applications, and ipodderx signs in through the one
called `Cloudflare Access`, so ipodderx needs a bookmark of its own to show up there. It is
Applications → Applications → `ipodderx`: no provider, launch URL `https://ipodderx.sdf1.net`, and
the iPodderX icon. Like Outline's, it has no policy bindings, so everyone in Authentik sees the
tile. Who actually gets in is still up to the Access policy.
### Check it
```sh