feat: rebuild xiteng.site homelab platform

2026-08-12 09:48:25 +08:00
parent 557b0eca33
commit 5b84988789
128 changed files with 14979 additions and 292 deletions
@@ -0,0 +1,102 @@
+version: 1
+metadata:
+  name: Xiteng - Brand and login flow
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+entries:
+  - model: authentik_brands.brand
+    state: present
+    identifiers:
+      domain: authentik-default
+      default: true
+    attrs:
+      branding_title: Xiteng
+      # Versioned repository assets live in Authentik's built-in static tree.
+      branding_logo: /static/dist/assets/xiteng/xiteng-wordmark-v1.svg
+      branding_favicon: /static/dist/assets/xiteng/xiteng-favicon-v1.svg
+      branding_default_flow_background: /static/dist/assets/xiteng/xiteng-background-v1.svg
+      attributes:
+        settings:
+          locale: zh-hans
+      branding_custom_css: |
+        :root {
+          --ak-font-family-sans-serif: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+          --ak-font-family-heading: var(--ak-font-family-sans-serif);
+          --ak-global--background-color: #f7efe0;
+          --ak-c-login--MaxWidth: 31rem;
+          --ak-c-login__content-BoxShadow: none;
+          --ak-c-login__main--BackgroundColor: #fffaf0;
+          --ak-c-login__main--Color: #1c1712;
+          --ak-c-login__main--BoxShadow: 8px 8px 0 #1c1712;
+          --ak-c-login__footer--Color: #675f55;
+          --pf-global--primary-color--100: #d83b21;
+          --pf-global--primary-color--200: #a92a18;
+          --pf-global--Color--100: #1c1712;
+          --pf-global--Color--200: #675f55;
+          --pf-global--BorderColor--100: #1c1712;
+          --pf-global--BorderRadius--sm: 6px;
+          --pf-c-login__main--BackgroundColor: #fffaf0;
+          --pf-c-card--BackgroundColor: #fffaf0;
+          --pf-c-button--m-primary--BackgroundColor: #d83b21;
+          --pf-c-button--m-primary--hover--BackgroundColor: #bc321d;
+          --pf-c-button--m-primary--active--BackgroundColor: #a92a18;
+          --pf-c-button--m-secondary--Color: #1c1712;
+          --pf-c-button--m-secondary--BorderColor: #1c1712;
+        }
+
+        ak-flow-executor::part(locale-select) {
+          display: none;
+        }
+
+        .pf-c-login__main,
+        .pf-c-card {
+          border: 2px solid #1c1712;
+          border-radius: 10px;
+        }
+
+        .pf-c-button.pf-m-primary {
+          border: 2px solid #1c1712;
+          border-radius: 6px;
+          box-shadow: 3px 3px 0 #1c1712;
+          font-weight: 800;
+        }
+
+        .pf-c-button.pf-m-primary:hover {
+          box-shadow: 1px 1px 0 #1c1712;
+          transform: translate(2px, 2px);
+        }
+
+        .pf-c-form-control {
+          border: 2px solid #1c1712;
+          border-radius: 6px;
+        }
+
+        @media (max-width: 576px) {
+          :root {
+            --ak-c-login--MaxWidth: calc(100vw - 2rem);
+            --ak-c-login__main--BoxShadow: 5px 5px 0 #1c1712;
+          }
+        }
+
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: xiteng-portal
+    attrs:
+      name: Xiteng Portal
+      meta_launch_url: https://xiteng.site/?focus=authentik#infrastructure
+      open_in_new_tab: false
+      meta_description: 返回 xiteng.site 服务目录
+      meta_publisher: Xiteng
+      meta_icon: https://xiteng.site/favicon.svg
+  - model: authentik_flows.flow
+    state: present
+    identifiers:
+      slug: default-authentication-flow
+    attrs:
+      name: Xiteng 登录
+      title: 欢迎回来
+      designation: authentication
+      authentication: none
+      layout: stacked
@@ -0,0 +1,39 @@
+version: 1
+# Managed ForwardAuth application and outpost assignment for chat.xiteng.site.
+metadata:
+  name: Xiteng Chat ForwardAuth
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+entries:
+  - id: xiteng-chat-provider
+    model: authentik_providers_proxy.proxyprovider
+    state: present
+    identifiers:
+      name: Xiteng Chat
+    attrs:
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+      external_host: https://chat.xiteng.site
+      mode: forward_single
+
+  - model: authentik_core.application
+    state: present
+    identifiers:
+      slug: xiteng-chat
+    attrs:
+      name: Xiteng Chat
+      provider: !KeyOf xiteng-chat-provider
+      meta_launch_url: https://chat.xiteng.site
+      open_in_new_tab: true
+
+  - model: authentik_outposts.outpost
+    state: present
+    identifiers:
+      name: uptime-kuma-outpost
+    attrs:
+      providers:
+        - !Find [authentik_core.provider, [name, Xiteng Portal Admin]]
+        - !Find [authentik_core.provider, [name, comfyui-proxy]]
+        - !Find [authentik_core.provider, [name, invokeai-proxy]]
+        - !Find [authentik_core.provider, [name, code-server-proxy]]
+        - !KeyOf xiteng-chat-provider
@@ -0,0 +1,35 @@
+version: 1
+metadata:
+  name: Xiteng - Passkey passwordless login
+entries:
+  - model: authentik_stages_identification.identificationstage
+    state: present
+    identifiers:
+      name: default-authentication-identification
+    attrs:
+      user_fields:
+        - email
+        - username
+      password_stage: null
+      captcha_stage: null
+      webauthn_stage: !Find [authentik_stages_authenticator_validate.authenticatorvalidatestage, [name, default-authentication-mfa-validation]]
+      case_insensitive_matching: true
+      show_matched_user: true
+      pretend_user_exists: true
+      enable_remember_me: false
+      enrollment_flow: null
+      recovery_flow: null
+      passwordless_flow: null
+      show_source_labels: false
+
+  # Authentik 2026.5 ships the password/MFA skip policies in its default
+  # authentication blueprint. Remove the temporary local copies if present.
+  - model: authentik_policies_expression.expressionpolicy
+    state: absent
+    identifiers:
+      name: xiteng-authentication-password-optional
+
+  - model: authentik_policies_expression.expressionpolicy
+    state: absent
+    identifiers:
+      name: xiteng-authentication-mfa-after-passkey
@@ -0,0 +1,98 @@
+version: 1
+metadata:
+  name: Xiteng password recovery
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+entries:
+  - id: recovery-flow
+    model: authentik_flows.flow
+    state: present
+    identifiers:
+      slug: xiteng-recovery
+    attrs:
+      name: Xiteng 密码恢复
+      title: 设置新密码
+      designation: recovery
+      authentication: require_unauthenticated
+
+  - id: password
+    model: authentik_stages_prompt.prompt
+    state: present
+    identifiers:
+      name: xiteng-recovery-password
+    attrs:
+      field_key: password
+      label: 新密码
+      type: password
+      required: true
+      order: 0
+      placeholder: 新密码
+      placeholder_expression: false
+
+  - id: password-repeat
+    model: authentik_stages_prompt.prompt
+    state: present
+    identifiers:
+      name: xiteng-recovery-password-repeat
+    attrs:
+      field_key: password_repeat
+      label: 再次输入新密码
+      type: password
+      required: true
+      order: 1
+      placeholder: 再次输入新密码
+      placeholder_expression: false
+
+  - id: password-stage
+    model: authentik_stages_prompt.promptstage
+    state: present
+    identifiers:
+      name: Xiteng 设置新密码
+    attrs:
+      fields:
+        - !KeyOf password
+        - !KeyOf password-repeat
+      validation_policies: []
+
+  - id: user-write
+    model: authentik_stages_user_write.userwritestage
+    state: present
+    identifiers:
+      name: xiteng-recovery-user-write
+    attrs:
+      user_creation_mode: never_create
+
+  - id: user-login
+    model: authentik_stages_user_login.userloginstage
+    state: present
+    identifiers:
+      name: xiteng-recovery-user-login
+
+  - model: authentik_flows.flowstagebinding
+    state: present
+    identifiers:
+      target: !KeyOf recovery-flow
+      stage: !KeyOf password-stage
+      order: 10
+
+  - model: authentik_flows.flowstagebinding
+    state: present
+    identifiers:
+      target: !KeyOf recovery-flow
+      stage: !KeyOf user-write
+      order: 20
+
+  - model: authentik_flows.flowstagebinding
+    state: present
+    identifiers:
+      target: !KeyOf recovery-flow
+      stage: !KeyOf user-login
+      order: 30
+
+  - model: authentik_brands.brand
+    state: present
+    identifiers:
+      domain: authentik-default
+      default: true
+    attrs:
+      flow_recovery: !KeyOf recovery-flow