Merge remote-tracking branch 'origin/main' into wt/20261104-104444
This commit is contained in:
Frank committed
commit
25114ca622
9 files changed
+892
-100
No files matched your search
@@ -188,7 +188,7 @@ Client access paths and the public-exposure policy (auth wall required before
|
||||
any public vhost; Plex-style claim tokens do not exist here — Jellyfin uses its
|
||||
own users/API keys) follow the fleet [[Authentik]]/[[Anubis]] chain pattern.
|
||||
|
||||
## Authentik LDAP authentication (2026-09-25)
|
||||
## Authentik LDAP authentication (live since 2026-09-25, re-verified 2026-11-04)
|
||||
|
||||
Jellyfin has no native external-auth, so it authenticates users through the
|
||||
**LDAP-Auth plugin** (`jellyfin-plugin-ldapauth`) against an [[Authentik]] LDAP
|
||||
@@ -204,17 +204,35 @@ user to verify the password.
|
||||
publishing `389`/`636` on the Dankclaw host for cross-host binds.
|
||||
- Service account `svc-jellyfin-ldap` (DN
|
||||
`cn=svc-jellyfin-ldap,ou=users,dc=franksdank,dc=cloud`).
|
||||
- Access groups `jellyfin_users` (search filter
|
||||
`(memberOf=cn=jellyfin_users,ou=groups,dc=franksdank,dc=cloud)`) and
|
||||
`jellyfin_admins` (admin filter `(cn=jellyfin_admins)`). Add a user to
|
||||
`jellyfin_users` to grant them Jellyfin access; `jellyfin_admins` grants
|
||||
the Jellyfin admin role.
|
||||
- Access group `jellyfin_users`: the plugin's search filter is
|
||||
`(memberOf=cn=jellyfin_users,ou=groups,dc=franksdank,dc=cloud)`, so a user
|
||||
who is not in that group is **invisible** to the plugin and the login fails
|
||||
as "Wrong username or password". Add members with
|
||||
`Group.objects.get(name="jellyfin_users").users.add(user)` in `ak shell`
|
||||
(directory data — the DB owns it, not this repo).
|
||||
`jellyfin_admins` is **inert as configured** — see the admin-filter law.
|
||||
|
||||
**Jellyfin side** (plugin config, set via admin → Plugins → LDAP-Auth):
|
||||
- Server `192.168.0.143:389` (plain LDAP over the trusted LAN), Base DN
|
||||
`dc=franksdank,dc=cloud`, bind user = the service-account DN, search
|
||||
attributes `uid,cn,mail,displayName`, uid attr `uid`, username attr `cn`
|
||||
`CreateUsersFromLdap=true`, all folders enabled.
|
||||
- Admin base `ou=groups,dc=franksdank,dc=cloud`, admin filter
|
||||
`(cn=jellyfin_admins)`, `EnableLdapAdminFilterMemberUid=false`.
|
||||
|
||||
**Law — the admin filter grants nothing unless it can return the user's own
|
||||
DN.** With `EnableLdapAdminFilterMemberUid=false` the plugin searches
|
||||
`LdapAdminBaseDn` with `LdapAdminFilter` and sets the admin permission only when
|
||||
a returned entry's DN equals the bound user's DN
|
||||
(`LDAP-Auth/LDAPAuthenticationProviderPlugin.cs`). A group-OU base returns the
|
||||
*group* entry, whose DN never matches, so **no LDAP user can ever become a
|
||||
Jellyfin admin** — measured 2026-11-04: the search answers
|
||||
`cn=jellyfin_admins,ou=groups,…` for every login. Working shape if group-granted
|
||||
admins are ever wanted: base `dc=franksdank,dc=cloud` +
|
||||
`(memberOf=cn=jellyfin_admins,ou=groups,dc=franksdank,dc=cloud)`. Deliberate
|
||||
today: the server's own admin account stays **local**, which is the break-glass
|
||||
door when authentik or the outpost is down. A *malformed* admin filter is not
|
||||
inert — the plugin throws for every login, so this knob is all-or-nothing.
|
||||
|
||||
**Gotcha — the bind credential is a PASSWORD, not a token.** The LDAP bind is
|
||||
verified by authentik's default authentication flow (standard-password
|
||||
@@ -224,10 +242,23 @@ password and the bind fails with `flow error password: Invalid`. The
|
||||
service-account password is stored only in the Jellyfin plugin config (the
|
||||
`LdapBindPassword` field) — it is never committed to this repo.
|
||||
|
||||
**Verification (2026-09-25):** `ldapsearch` bind + the `jellyfin_users`
|
||||
search both succeed from Dankclaw; a real user (`alex`, in `jellyfin_users`)
|
||||
logged into the web UI with their authentik password and the plugin created
|
||||
the matching Jellyfin user.
|
||||
**Verification (re-taken 2026-11-04, from Dankserver):** the container reaches
|
||||
`192.168.0.143:389`; the service-account bind plus the `jellyfin_users` search
|
||||
return every member; LDAP-Auth 23.0.0.0 loads on Jellyfin 12.4; the `alex` row
|
||||
still carries
|
||||
`AuthenticationProviderId=Jellyfin.Plugin.LDAP_Auth.LdapAuthenticationProviderPlugin`.
|
||||
|
||||
**Law — "the authentik login doesn't work" has two opposite causes; read the
|
||||
Users table before touching authentik.** Copy `config/data/jellyfin.db` with its
|
||||
`-wal`/`-shm` and read it read-only (never sqlite the live file):
|
||||
`Users.AuthenticationProviderId` names the door — `…Users.DefaultAuthentication
|
||||
Provider` = local password, `…LDAP_Auth.LdapAuthenticationProviderPlugin` =
|
||||
authentik. Because the LDAP search is scoped to `jellyfin_users`, a name that
|
||||
exists only as a local account is rejected by the plugin and Jellyfin then
|
||||
silently falls back to the local provider: same UI message, opposite fix. The
|
||||
instrument for "did a bind ever reach authentik" is the **event registry**, never
|
||||
the outpost journal — see [[Authentik Outpost Reference]].
|
||||
|
||||
**Gotcha — the login endpoint changed in Jellyfin 12.1.** The legacy
|
||||
`POST /Users/Auth/Password` route (and its `LegacyEmbyRouteRewriteMiddleware`)
|
||||
was removed; probing it now returns a silent 401 with no plugin log, which
|
||||
@@ -309,33 +340,40 @@ scripts/jellyfin-providers.sh verify # plugin + key LENGTHS, never key bytes
|
||||
|
||||
## Triggering a scan
|
||||
|
||||
The scan key lives in `~/.config/secrets/jellyfin` (mode 600; the same value is
|
||||
`JELLYFIN_API_KEY` in the ignored `dankserver/.env`). It rides a mode-600 curl
|
||||
config, never a header argument, in the `MediaBrowser` form: 12.4 authenticates
|
||||
only `Authorization: MediaBrowser Token="…"` and refuses a bare `X-Emby-Token`
|
||||
for every key, valid or not. Before believing a 401, prove the key against the
|
||||
server's own table — `select count(*) from ApiKeys where AccessToken = ?` on
|
||||
`jellyfin.db` opened `mode=ro&immutable=1`. The backslashes below matter:
|
||||
Run the driver from the deploy checkout: `scripts/media-refresh-jellyfin.py
|
||||
trigger`, then `… wait`. It calls the library settled only on the rule below — the
|
||||
task seen `Running` (or a run that finished while it watched) first, then
|
||||
`--require-quiet` reads with no scan and no writes — and refuses by name when the
|
||||
scan never started, because a watcher that saw no `Running` would otherwise report
|
||||
the pre-scan library as the fresh one. `… status --after <the trigger's epoch>` is the
|
||||
"has the scan reached my moves" answer, read from the task's `EndTimeUtc` — and that
|
||||
timestamp only advances when a scan *finishes*, so the epoch must be one your trigger
|
||||
could not have followed: a journal mtime is already passed by whatever scan ran before
|
||||
you asked, and bare `status` cannot tell that walk from yours, while `wait` refuses such
|
||||
an epoch by name. The Plex door is worse still — [[Plex]].
|
||||
|
||||
```bash
|
||||
umask 077
|
||||
{ printf 'header = "Authorization: MediaBrowser Token=\\"%s\\""\n' \
|
||||
"$(cat ~/.config/secrets/jellyfin)"
|
||||
echo 'url = "http://127.0.0.1:8096/Library/Refresh"'
|
||||
echo 'request = "POST"'; } >/tmp/jf.hdr
|
||||
curl -s -K /tmp/jf.hdr -o /dev/null -w "jellyfin scan: %{http_code}\n"
|
||||
shred -u /tmp/jf.hdr
|
||||
```
|
||||
It carries every law below. Hand-written, the door is a `curl -K` on a mode-600
|
||||
config: the scan key lives in `~/.config/secrets/jellyfin` (mode 600; the same
|
||||
value is `JELLYFIN_API_KEY` in the ignored `dankserver/.env`) and rides as
|
||||
`Authorization: MediaBrowser Token="…"` — 12.4 refuses a bare `X-Emby-Token` for
|
||||
every key, valid or not — never as a header argument, because
|
||||
`/proc/<pid>/cmdline` is world-readable. `recentMedia` counts
|
||||
`BaseItems.DateModified` rows in `jellyfin.db`, which on this host sits in the
|
||||
quadlet's config bind at `/home/dank/Containers/jellyfin/config/data/`, not the
|
||||
stock `~/.local/share/jellyfin`.
|
||||
|
||||
`204` is acceptance; anything else queued no scan, so re-issue the identical
|
||||
request instead of diagnosing. A `401` from a key that answers `200` on a
|
||||
hand-typed request is this block's quoting, not the server: bash `printf`
|
||||
collapses `\"` to `"`, curl ends the quoted value at that quote, and Jellyfin
|
||||
receives `Authorization: MediaBrowser Token=` with nothing after it (`\\"` answers
|
||||
204, `\"` answers 401 — both run on this host).
|
||||
Reading the progress with the same config trick takes **one** URL: a config `url`
|
||||
line *plus* a command-line URL makes curl perform both transfers, and the second
|
||||
dumps the whole `ScheduledTasks` body onto your stdout.
|
||||
204, `\"` answers 401 — both run on this host). Before believing a 401, prove the
|
||||
key against the server's own table — `select count(*) from ApiKeys where
|
||||
AccessToken = ?` on `jellyfin.db` opened plain `mode=ro` (`immutable=1` only as
|
||||
the fallback for a database whose `-shm` cannot be read; it skips the write-ahead
|
||||
log, see [[Media Relayout]]). Reading progress with the same config trick takes
|
||||
**one** URL: a config `url` line *plus* a command-line URL makes curl perform both
|
||||
transfers, and the second dumps the whole `ScheduledTasks` body onto your stdout.
|
||||
|
||||
One accepted refresh is the whole procedure. A second one while a scan runs moves
|
||||
`Scan Media Library` to `Cancelling`, and once the runner holds `Cancelling` every
|
||||
|
||||
@@ -151,6 +151,18 @@ Each of these is a file that would have been destroyed without it:
|
||||
- Media containers only. Grouping every extension buries the report in subtitle
|
||||
and cover pairs — and a duration guard that appears to fire on 720 groups is
|
||||
counting subtitles, not protecting films.
|
||||
- **A short file named after a film is promotion, not a movie.** Thirty-two files
|
||||
in `Movies` — 31 clips and the `.nfo` filed beside one of them — carried real
|
||||
titles (`The Descent (2005) - SD.mkv`) and were 8–20-second h264 video at
|
||||
640×360, 1024×576 or 1280×720, 49 MiB all together —
|
||||
25 of them in a `_release-group watermarks/` folder and the rest at the library
|
||||
root or inside one film's folder. No duplicate screen ever catches them: nothing
|
||||
shares their size, and the feature-length guard above makes them invisible to the
|
||||
similar-title pass too. They were held as `.AGENTTRASH/20261104-promo-clips`
|
||||
(journal `/mnt/entropy/.media-campaign/promo-hold.jsonl`, which survives) and purged
|
||||
the same evening, once both databases read `REAL: 0` against that journal.
|
||||
The census that finds the next batch is a duration floor, not a hash: a video under
|
||||
a minute on a name that reads like a feature is advertising.
|
||||
|
||||
## The hold
|
||||
|
||||
|
||||
@@ -99,12 +99,17 @@ interrupted apply still replays the batch and resumes with nothing lost. Batch 1
|
||||
is the old behaviour; the only reason to name it is debugging, because on the
|
||||
spinning array it spends most of a large apply's wall time in fsyncs.
|
||||
|
||||
After it lands, both servers need a scan or the change is invisible. [[Plex]] and
|
||||
[[Jellyfin]] own the exact requests; two laws hold at this step: `204` is
|
||||
acceptance and anything else queued nothing — re-issue the identical request
|
||||
rather than diagnosing — and ONE accepted refresh is the whole procedure, because
|
||||
a second while a scan runs moves `Scan Media Library` to `Cancelling` and every
|
||||
later `204` is accepted and then discarded.
|
||||
After it lands, both servers need a scan or the change is invisible. The two
|
||||
drivers are the doors — `scripts/media-refresh-jellyfin.py trigger` then `… wait`,
|
||||
and only after it settles, `scripts/media-refresh-plex.sh trigger --library <key>`
|
||||
with `… status --library <key> --after $(stat -c %Y <journal>)` as the poll. Run
|
||||
them in that order and never together: Jellyfin's only door walks every library,
|
||||
every Plex section forks its own scanner walk, and the array is the bottleneck
|
||||
both servers share. [[Plex]] and [[Jellyfin]] own the laws behind the drivers; two
|
||||
of them decide this step: `204` is acceptance and anything else queued nothing —
|
||||
re-issue the identical request rather than diagnosing — and ONE accepted refresh is
|
||||
the whole procedure, because a second while a scan runs moves `Scan Media Library`
|
||||
to `Cancelling` and every later `204` is accepted and then discarded.
|
||||
|
||||
### Proving the move landed
|
||||
|
||||
|
||||
@@ -106,43 +106,57 @@ root runs as the `dank` user, and the deployer adopts the data root with
|
||||
## Triggering a scan
|
||||
|
||||
A rename on disk is invisible until the section is rescanned, and a moved file is
|
||||
a `Couldn't find the file to stream` 404 until that scan passes it. Run this from
|
||||
the host shell through `podman exec`, never from a neighbour container: PMS's
|
||||
HTTPD closes without a single byte on any request that arrives from another
|
||||
container's netns (10.89.x.x reads as "empty reply", not as a 401). The token
|
||||
rides stdin, never argv, where any process on the host could read it out of
|
||||
`/proc/<pid>/cmdline`; it lives in `Preferences.xml` inside the RW data bind.
|
||||
a `Couldn't find the file to stream` 404 until that scan passes it. Run the
|
||||
driver from the host shell; the section keys are `1` Movies, `3` TV Shows,
|
||||
`5` Audiobooks, `6` Music, `11` VODs & Live Events:
|
||||
|
||||
```bash
|
||||
umask 077
|
||||
podman exec plex sh -c "sed -n 's/.*PlexOnlineToken=\"\\([^\"]*\\)\".*/\\1/p' \
|
||||
'/config/Library/Application Support/Plex Media Server/Preferences.xml'" >/tmp/px.tok
|
||||
cat >/tmp/pxscan.sh <<'EOS'
|
||||
read -r T
|
||||
cfg=$(mktemp)
|
||||
mk() { { printf 'header = "X-Plex-Token: %s"\nheader = "Accept: application/json"\n' "$T"
|
||||
printf 'url = "%s"\n' "$1"; } > "$cfg"; }
|
||||
mk "http://127.0.0.1:32400/library/sections"
|
||||
for k in $(curl -s -K "$cfg" | grep -o '"key":"[0-9]*"' | cut -d\" -f4); do
|
||||
mk "http://127.0.0.1:32400/library/sections/$k/refresh"
|
||||
printf 'request = "POST"\n' >> "$cfg"
|
||||
echo "plex section $k: $(curl -s -o /dev/null -w '%{http_code}' -K "$cfg")"
|
||||
done
|
||||
shred -u "$cfg"
|
||||
EOS
|
||||
podman cp /tmp/pxscan.sh plex:/tmp/pxscan.sh
|
||||
podman exec -i plex sh /tmp/pxscan.sh </tmp/px.tok
|
||||
shred -u /tmp/px.tok
|
||||
scripts/media-refresh-plex.sh trigger --library 1
|
||||
python3 scripts/media-verify.py --db-kind plex \
|
||||
--journal /mnt/entropy/.media-campaign/<journal>.jsonl # the real proof
|
||||
```
|
||||
|
||||
Every section answers `204` — or `200` with a Directory body when
|
||||
`Accept: application/json` is sent. A refresh fired while PMS is still warming
|
||||
answers `000` instead (the empty reply of gotcha 4, arriving mid-request): retry
|
||||
until it answers and never restart the service over it. Inside the quoted
|
||||
`printf` format a backslash-newline is LITERAL, not a continuation, so `mk`
|
||||
writes two `printf`s: one glued line and one stray backslash is a config file
|
||||
curl rejects, and the failure prints as `option -K: is unknown`, never as a bad
|
||||
config line.
|
||||
Exactly ONE section: a refresh costs a full walk of that tree, and refreshing all
|
||||
five for a rename that touched one buys nothing. `trigger` answers
|
||||
`refresh accepted (204)` — `200` when a body is requested — and `000` means PMS is
|
||||
still warming, which the driver retries out loud; a service restart is never the
|
||||
fix.
|
||||
|
||||
**`status` is a census, not a waiter: no epoch makes it watch a scan.** It reads
|
||||
`section_locations.scanned_at` — the epoch of the last scan PMS has *recorded* for the
|
||||
section, the same value `GET /library/sections` prints as `scannedAt` (verified
|
||||
2026-11-04) — and compares it against `--after`. Measured twice on 2026-11-04: a chain
|
||||
fell through its wait loop in the same second its own trigger was accepted, and a direct
|
||||
read 30 minutes later still answered `settled` off that one stamp
|
||||
(`2026-11-04T19:46:59Z`, for a request accepted at `19:46:58Z`) while the walk ran. A
|
||||
journal's mtime fails, and so does the trigger's own epoch — the request satisfies the
|
||||
very door it was asked to wait for. The failure direction is a false *success*, never a
|
||||
false alarm, which is what makes it worth the warning: ask `status` whether a scan got
|
||||
recorded, and never let a chain depend on it.
|
||||
|
||||
**The proof that a scan did its work is the journal replayed against the database:**
|
||||
`scripts/media-verify.py --db-kind plex --journal <journal>` names every row that still
|
||||
points at a source path (`still at src`) and every entry whose file is physically still
|
||||
there (`REAL`). Both at zero is what gates a purge, and it needs no settle signal at all
|
||||
— a scan can clear rows but cannot invent one. Jellyfin's door has no such trap:
|
||||
`scripts/media-refresh-jellyfin.py wait` watches the scan task itself and refuses by
|
||||
name when no task reaches `Running`.
|
||||
|
||||
The driver ships its runner into the container with `podman cp` rather than
|
||||
quoting a command through `podman exec sh -c`, because PMS's HTTPD closes without
|
||||
a single byte on a request that arrives from another netns — the host address and
|
||||
the `10.89.x.x` container address both read as "empty reply", never as a 401 —
|
||||
and because a three-layer `ssh → podman exec → sh -c` quote chain dies on a parse
|
||||
error long before it reaches the server. The request therefore rides plain
|
||||
`http://127.0.0.1:32400` from inside the container, where insecure connections
|
||||
are allowed (gotcha 5). The credential is `PlexOnlineToken` in the container's
|
||||
`Preferences.xml` — NOT `PlexHTTPToken`, which a claimed server need not carry —
|
||||
read inside the container into a mode-600 curl config there, so it never enters
|
||||
argv (`/proc/<pid>/cmdline` is world-readable) and never a URL (proxies log
|
||||
URLs). Hand-writing that config has one more trap: inside a quoted `printf`
|
||||
format a backslash-newline is LITERAL, so a two-line string becomes one glued
|
||||
line plus a stray backslash, and curl answers `option -K: is unknown` — never
|
||||
"bad config line".
|
||||
|
||||
Proof that a rename landed is not a scan response: `scripts/media-verify.py`
|
||||
replays the run's journal against the database — the only read that
|
||||
|
||||
@@ -148,36 +148,46 @@ Read from the live database (read-only `SELECT`s against the
|
||||
| Object | Value |
|
||||
|---|---|
|
||||
| LDAP provider | `Jellyfin LDAP` (pk 11), base DN `dc=franksdank,dc=cloud`, `search_mode=direct`, `bind_mode=direct` |
|
||||
| Bind DN | `cn=svc-jellyfin-ldap,ou=users,dc=franksdank,dc=cloud` *(unverified 2026-10-18: base DN confirmed in the DB, the `ou=users` path was not probed — an LDAP bind needs the bind secret)* |
|
||||
| Service account | `svc-jellyfin-ldap` (user pk 8). **It is not passwordless**: its password field is a real hash, not Django's `!`-prefixed unusable marker (`starts_with(password,'!')` → `f`) — an earlier revision's "passwordless/unusable" claim is wrong, which matters because an account with a usable password can sign in through the ordinary password flow *(unverified 2026-10-18: whether anyone holds that password)* |
|
||||
| Bind token | exactly one row for pk 8, **`intent=app_password`**, non-expiring — an earlier revision recorded `intent=verification`; the live value is `app_password` |
|
||||
| Bind DN | `cn=svc-jellyfin-ldap,ou=users,dc=franksdank,dc=cloud` — **verified by a live bind 2026-11-04** (the bind and the `memberOf` search both succeed, so the `ou=users` path is right) |
|
||||
| Service account | `svc-jellyfin-ldap` (user pk 8). It has a usable password and authenticates through the default flow — that password is held by Jellyfin in the plugin config (`LdapBindPassword`) and is what the bind actually uses (live bind 2026-11-04) |
|
||||
| Bind token | exactly one row for pk 8, **`intent=app_password`**, non-expiring — and **unused by Jellyfin**, which has no token field (see the rule below) |
|
||||
| RBAC role | `svc-jellyfin-ldap-search`, carrying exactly one object-level permission `authentik_providers_ldap.search_full_directory` (verified via `guardian_roleobjectpermission`) |
|
||||
| Groups | `jellyfin_users`, `jellyfin_admins` (both exist in `authentik_core_group`) |
|
||||
| Application | name `Jellyfin`, **slug `jellyfin-ldap`** (an earlier revision said slug `jellyfin`, which does not exist) |
|
||||
|
||||
Hard-won rules (the first is now contested by the live database):
|
||||
Hard-won rules:
|
||||
|
||||
- **Token intent: contested, do not trust either value blindly.** An earlier
|
||||
revision asserted that a bind token with `intent=app_password` is rejected by
|
||||
the flow's password stage with `Invalid password` and only
|
||||
`intent=verification` passes. The live token for `svc-jellyfin-ldap` is
|
||||
`app_password` (`authentik_core_token`, 2026-10-18), so either the rule is
|
||||
wrong or the current Jellyfin bind path is not that token. Nothing observable
|
||||
settles it today: the LDAP outpost's retained log holds only its 5-minute
|
||||
`initialized direct binder` / `Update providers` config cycles and no bind
|
||||
activity *(unverified 2026-10-18: no bind was performed — reproducing it
|
||||
requires the bind secret)*. Re-verify with a real bind before changing the
|
||||
token's intent either way.
|
||||
- **Token intent is moot for Jellyfin.** The earlier argument (a bind token with
|
||||
`intent=app_password` is rejected by the flow's password stage, only
|
||||
`intent=verification` passes) never applied here: LDAP-Auth sends the service
|
||||
account's **password** from `LdapBindPassword`, not a token. A live bind plus a
|
||||
`memberOf=cn=jellyfin_users` search (11 entries) succeeded from Dankserver on
|
||||
2026-11-04. Leave the token row alone.
|
||||
- **Search needs `search_full_directory`.** Without the RBAC grant the
|
||||
outpost returns only the bind user itself — a `(memberOf=…)` filter then
|
||||
matches zero entries and the plugin logs `Found no users matching X`.
|
||||
The permission is object-level on the provider; grant it via an RBAC role
|
||||
and retest.
|
||||
- **The outpost log never shows a bind.** Its retained journal is only the
|
||||
5-minute `initialized direct binder` / `Update providers` config cycle; the
|
||||
absence of a bind line is not evidence of anything. Instruments that do answer:
|
||||
`ldapsearch` with the plugin's own DN, password and filter, and the authentik
|
||||
event registry (`login` / `login_failed` with `client_ip` from the podman
|
||||
gateway, since the published port SNATs).
|
||||
- `ak shell` import path for the provider model in 2026.8:
|
||||
`from authentik.providers.ldap.models import LDAPProvider`.
|
||||
- (unverified 2026-10-18: importing it outside a configured Django shell fails
|
||||
with `ImproperlyConfigured`, and no `ak shell` was driven against the live
|
||||
auth service for this check)*
|
||||
`from authentik.providers.ldap.models import LDAPProvider` (verified inside a
|
||||
live `ak shell`, 2026-11-04 — it only fails outside a configured Django shell).
|
||||
- **`ak shell` field names, 2026.8:** `Event` is keyed by `created` and `action`
|
||||
— there is no `timestamp` and no `type`; `Outpost` has `providers` but **no
|
||||
`apps`**. Introspect first: `[f.name for f in Model._meta.get_fields()]`.
|
||||
- **Never pipe `ak shell` inside a heredoc.** `podman exec -i … ak shell | grep
|
||||
-v '^{'` binds the heredoc to `grep` (the redirection belongs to the LAST
|
||||
element of the pipeline), so the shell gets no stdin and prints nothing at all.
|
||||
And `2>/dev/null` on `ak shell` eats the traceback, which looks identical to "no
|
||||
rows". Clean pattern: have the script write its results to a file and read that
|
||||
file back —
|
||||
`podman exec -i authentik-server ak shell >/dev/null 2>/dev/null <<'PY' … open("/tmp/x.txt","w") … PY`
|
||||
then `podman exec authentik-server cat /tmp/x.txt`.
|
||||
|
||||
## Self-serve user-settings flow (password change)
|
||||
|
||||
|
||||
@@ -145,18 +145,17 @@ relying-party quirks are reference lookup: [[Authentik Outpost Reference]].
|
||||
The second outpost — `dankclaw/authentik/quadlet/authentik-outpost-ldap.container`
|
||||
→ `authentik-outpost-ldap.service`, one of the five units in this stack —
|
||||
serves LDAP for Jellyfin's LDAP-Auth plugin (`enabled`=generated, `active`
|
||||
`Restart=always`, container up, 2026-10-18). The image is pinned by its **amd64
|
||||
single-platform digest**
|
||||
`ghcr.io/goauthentik/ldap@sha256:2e7b259eb8c37faac916946ddf48ec681ee9d3a9f724fe8521bf161973f13cf9`
|
||||
(`dankclaw/authentik/quadlet/authentik-outpost-ldap.container:26`, matching the
|
||||
running image in `podman ps`, 2026-10-18). The digest in this page before 2026-10-18
|
||||
(`…fa33bc8f…`) is superseded. The reason for pinning a digest at all: podman
|
||||
5.7.0 refuses the plain tag because it resolves to a *nested* manifest list
|
||||
(index → per-platform manifest lists) — `unexpectedly received a manifest list
|
||||
instead of a manifest for a single image` — first hit on `:2026.8.0`, still the
|
||||
rule at the current `2026.8.3` pin. Resolve once with `podman manifest inspect
|
||||
<image> | jq -r '.manifests[] | select(.platform.architecture=="amd64") |
|
||||
.digest'` and pin that digest.
|
||||
`Restart=always`, container up, re-checked 2026-11-04). **The image pin has one
|
||||
owner: the `Image=` line of
|
||||
`dankclaw/authentik/quadlet/authentik-outpost-ldap.container`** — never restate
|
||||
the digest here, because every pin bump turns this page into a lie (the digest
|
||||
cited here went stale twice: `…fa33bc8f…`, then `…2e7b259e…`). The reason a
|
||||
digest is pinned at all: podman 5.7.0 refuses the plain tag because it resolves
|
||||
to a *nested* manifest list (index → per-platform manifest lists) —
|
||||
`unexpectedly received a manifest list instead of a manifest for a single image`
|
||||
— first hit on `:2026.8.0` and still the rule. Resolve once with
|
||||
`podman manifest inspect <image> | jq -r '.manifests[] |
|
||||
select(.platform.architecture=="amd64") | .digest'` and pin that digest.
|
||||
|
||||
- Ports **389** (ldap) and **636** (ldaps) publish on the LAN
|
||||
(`PublishPort=389:3389`, `636:6636`
|
||||
|
||||
Reference in new issue
Block a user