techy/Media-Server-Setup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Gitea access gated by Authentik group git-users; roles table example

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Brandyn / Techy
2026-10-31 17:10:09 -05:00
parent b661ee795b
commit 7e935c31d1
3 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
CommunityDiscordMedia.md
View File

@@ -258,7 +258,7 @@ Same pattern as Jellyfin: Authentik is the identity, Gitea trusts it.
- [x] Gitea env: `DISABLE_REGISTRATION=false` + `ALLOW_ONLY_EXTERNAL_REGISTRATION=true` (local self-signup stays - [x] Gitea env: `DISABLE_REGISTRATION=false` + `ALLOW_ONLY_EXTERNAL_REGISTRATION=true` (local self-signup stays
off), `ENABLE_AUTO_REGISTRATION`, `ACCOUNT_LINKING=auto`, `USERNAME=nickname`, `UPDATE_AVATAR` off), `ENABLE_AUTO_REGISTRATION`, `ACCOUNT_LINKING=auto`, `USERNAME=nickname`, `UPDATE_AVATAR`
- [ ] optional: hide the password form on the login page (custom template) so Discord is the only visible way in - [ ] optional: hide the password form on the login page (custom template) so Discord is the only visible way in
- [ ] policy on the Authentik application: who may reach Gitea at all (e.g. `admins` + a `devs` group) - [ ] Authentik group `git-users` (from a Discord role) bound on the `Gitea` application (+ `admins`); only they can log in
- [ ] test with a non-admin Discord user; confirm admin mapping via `admins` group - [ ] test with a non-admin Discord user; confirm admin mapping via `admins` group
### Phase 11 — MediaMTX auth through Authentik (no stream keys anywhere) ✅ live ### Phase 11 — MediaMTX auth through Authentik (no stream keys anywhere) ✅ live

5
README.md
View File

@@ -215,7 +215,10 @@ Keep repo write access to trusted people.
2FA", claim name for groups `groups`, administrator group claim value `admins`. Save. 2FA", claim name for groups `groups`, administrator group claim value `admins`. Save.
3. compose (already set): registration only via external sources, auto-registration + account linking on, 3. compose (already set): registration only via external sources, auto-registration + account linking on,
username from `preferred_username`. A first Discord login creates the Gitea user with no form. username from `preferred_username`. A first Discord login creates the Gitea user with no form.
4. Test in a private window: https://git.HOST/user/login → "Sign in with authentik" → Discord → logged in. 4. Access = Authentik group **`git-users`**: Directory → Groups → create it (add a Discord role to it in the
roles→groups table); Applications → `Gitea` → Policy / Group / User Bindings → bind `git-users` (and `admins`).
Non-members are refused by Authentik before Gitea sees them.
5. Test in a private window: https://git.HOST/user/login → "Sign in with authentik" → Discord → logged in.
Members of `admins` become Gitea site admins on login. The local admin account stays as a fallback. Members of `admins` become Gitea site admins on login. The local admin account stays as a fallback.
Optional later: hide the password form (custom template) so Discord is the only visible way in. Optional later: hide the password form (custom template) so Discord is the only visible way in.

1
authentik/discord-roles-to-groups.py
View File

@@ -13,6 +13,7 @@ ROLE_TO_GROUP = { # <- Discord role id : A
# "222222222222222222": "streamers", # "222222222222222222": "streamers",
# "333333333333333333": "editors", # "333333333333333333": "editors",
# "444444444444444444": "admins", # "444444444444444444": "admins",
"555555555555555555": "git-users",
} }
from authentik.core.models import Group from authentik.core.models import Group