feat: rebuild xiteng.site homelab platform

authentik/bootstrap.py

@@ -0,0 +1,66 @@
+from pathlib import Path
+
+from authentik.core.models import Application, Group, Token, TokenIntents, User
+from authentik.policies.models import PolicyBinding
+
+ADMIN_USERNAME = "liooil"
+FAMILY_GROUP = "liuhome"
+TOKEN_IDENTIFIER = "xiteng-portal-admin"
+TOKEN_PATH = Path("/run/secrets/portal_api_token")
+MANAGED_APPLICATIONS = [
+    "xiteng-portal-admin",
+    "xiteng-portal",
+    "xiteng-chat",
+    "code-server",
+    "comfyui",
+    "invokeai",
+    "gitea",
+    "hedgedoc",
+    "hedgedoc2",
+    "minio",
+    "seaweedfs",
+    "remark42",
+]
+
+liooil = User.objects.get(username=ADMIN_USERNAME)
+admin_group = Group.objects.get(name="authentik Admins")
+admin_group.users.add(liooil)
+
+User.objects.filter(username="akadmin").delete()
+
+liuhome, _ = Group.objects.get_or_create(
+    name=FAMILY_GROUP,
+    defaults={"is_superuser": False},
+)
+if liuhome.is_superuser:
+    liuhome.is_superuser = False
+    liuhome.save(update_fields=["is_superuser"])
+for username in ["liooil", "ziyue"]:
+    liuhome.users.add(User.objects.get(username=username))
+
+for application in Application.objects.filter(slug__in=MANAGED_APPLICATIONS):
+    PolicyBinding.objects.filter(target=application).delete()
+    PolicyBinding.objects.create(
+        target=application,
+        group=liuhome,
+        order=0,
+        enabled=True,
+        negate=False,
+        failure_result=False,
+    )
+
+Token.objects.filter(identifier=TOKEN_IDENTIFIER).delete()
+token = Token.objects.create(
+    identifier=TOKEN_IDENTIFIER,
+    intent=TokenIntents.INTENT_API,
+    user=liooil,
+    description="Xiteng Portal Authentik administration",
+    expiring=False,
+)
+TOKEN_PATH.write_text(token.key, encoding="utf-8")
+TOKEN_PATH.chmod(0o600)
+
+print(
+    f"Identity bootstrap complete: administrator={ADMIN_USERNAME}, "
+    f"group={FAMILY_GROUP}, applications={len(MANAGED_APPLICATIONS)}"
+)