From 8be69c063139876b3692a3cfdbd53312ba9d4991 Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Fri, 28 Aug 2026 19:09:23 -0700
Subject: [PATCH] deploy: map authentik quadlet units to their own services
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The quadlet-dir allowlist silently dropped every change under
dankclaw/authentik/ — the new outpost unit (and its siblings) now route
by exact unit name, mirroring the searxng/gitea pattern. Adds
authentik-outpost to the service inventories; it is a quadlet unit, not
a compose service, so it stays out of the compose set.
---
 scripts/deploy-plan.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/scripts/deploy-plan.py b/scripts/deploy-plan.py
index 49ddf32..2962f86 100755
--- a/scripts/deploy-plan.py
+++ b/scripts/deploy-plan.py
@@ -39,6 +39,7 @@ SERVICE_ORDER = (
     "authentik-postgres",
     "authentik-server",
     "authentik-worker",
+    "authentik-outpost",
     "caddy",
     "homepage",
     "mariadb",
@@ -78,6 +79,7 @@ DANKCLAW_SERVICES = {
     "authentik-postgres",
     "authentik-server",
     "authentik-worker",
+    "authentik-outpost",
     "caddy",
     "homepage",
     "frank-default-large",
@@ -249,6 +251,11 @@ def services_for_path(path: str, target: str) -> set[str]:
         if len(parts) >= 2 and parts[1] in {"caddy", "comfyui", "loki", "alloy", "hermes", "anubis"}:
             _add(services, parts[1])
             return services
+        if len(parts) >= 4 and parts[1] == "authentik" and parts[2] == "quadlet":
+            name = parts[3].removesuffix(".container")
+            if name in {"authentik-postgres", "authentik-server", "authentik-worker", "authentik-outpost"}:
+                _add(services, name)
+            return services
         if len(parts) >= 2 and parts[1] == "searxng":
             if len(parts) >= 4 and parts[2] == "quadlet":
                 name = parts[3]