docs: Jellyfin LDAP-Auth integration (outpost + plugin) and authentik LDAP rules

serverAppConfigs-docs/Infrastructure/Authentik.md

@@ -11,6 +11,8 @@ Pi-hole) are not wrapped — they handle their own session.
 - **Name:** `auth.franksdank.cloud`
 - **Stack:** 3 compose services — `authentik-postgres`, `authentik-server`,
   `authentik-worker` (see [Pi-hole](Pi-hole.md) for the LAN-DNS pattern)
+- **LDAP outpost:** a 4th, quadlet-deployed unit (`authentik-outpost-ldap`)
+  serves LDAP for Jellyfin — see the section below.
 
 ## Why Authentik
 
@@ -155,6 +157,51 @@ implementation diverges from upstream in ways that bit us; all verified live:
   `grafana-profile-scope`, Python-syntax expressions) and will start emitting
   claims the moment the evaluator bug is fixed — no config change needed then.
 
+## LDAP outpost (Jellyfin auth, live 2026-09-01)
+
+A fourth unit, `dankclaw/authentik/quadlet/authentik-outpost-ldap.container`
+→ `authentik-outpost-ldap.service`, serves LDAP for Jellyfin's LDAP-Auth
+plugin. The image is pinned by its **amd64 single-platform digest**
+(`ghcr.io/goauthentik/ldap@sha256:fa33bc8f522113830e1662f4c034352f9eb08e0a7d3da2ddadad9a4b33b4cbf4`):
+podman 5.7.0 refuses the
+`ghcr.io/goauthentik/ldap:2026.8.0` tag because the tag resolves to a
+*nested* manifest list (index → per-platform manifest lists) —
+`unexpectedly received a manifest list instead of a manifest for a single
+image`. Resolve once with `podman manifest inspect <image> | jq -r
+'.manifests[] | select(.platform.architecture=="amd64") | .digest'` and pin
+that digest.
+
+- Ports **389** (ldap) and **636** (ldaps) publish on the LAN; Jellyfin on
+  Dankserver binds `192.168.0.143:389`. The outpost token travels in
+  `AUTHENTIK_LDAP_OUTPOST_TOKEN` from the host `.env` (git-ignored).
+
+### Authentik-side objects (provisioned via `ak shell` ORM)
+
+| Object | Value |
+|---|---|
+| LDAP provider | `Jellyfin LDAP` (pk 11), base DN `dc=franksdank,dc=cloud` |
+| Bind DN | `cn=svc-jellyfin-ldap,ou=users,dc=franksdank,dc=cloud` |
+| Service account | `svc-jellyfin-ldap` — passwordless/unusable; authenticates by token |
+| Bind token | intent **`verification`**, non-expiring — its key is the LDAP bind password |
+| RBAC role | `svc-jellyfin-ldap-search` carrying object-level permission `authentik_providers_ldap.search_full_directory` on the provider |
+| Groups | `jellyfin_users`, `jellyfin_admins` |
+| Application | `jellyfin` (slug `jellyfin`) |
+
+Hard-won rules, each verified live:
+
+- **Token intent is load-bearing.** A bind token with `intent=app_password`
+  is rejected by the flow's password stage with `Invalid password`;
+  `intent=verification` passes. The outpost's direct binder executes the
+  provider's authorization flow, and that password stage only accepts
+  verification-intent tokens as static passwords.
+- **Search needs `search_full_directory`.** Without the RBAC grant the
+  outpost returns only the bind user itself — a `(memberOf=…)` filter then
+  matches zero entries and the plugin logs `Found no users matching X`.
+  The permission is object-level on the provider; grant it via an RBAC role
+  and retest.
+- `ak shell` import path for the provider model in 2026.8:
+  `from authentik.providers.ldap.models import LDAPProvider`.
+
 ## Configuration (secrets)
 
 Two secrets live in the host `.env` (git-ignored; placeholders in
@@ -205,5 +252,6 @@ Two secrets live in the host `.env` (git-ignored; placeholders in
 
 - [Caddy](Caddy.md) — the reverse proxy carrying the `:8016`/`:8017` auth-chain listeners
 - [Pi-hole](Pi-hole.md) — the LAN DNS that resolves `auth.franksdank.cloud`
+- [Jellyfin](../Dankserver/Jellyfin.md) — consumes the LDAP outpost via its LDAP-Auth plugin
 - [Network Architecture](../Architecture/Network%20Architecture.md) — the flat naming scheme
 - Research: `.docaudit/research/auth.md` — the full provider comparison