From caf5e1e0ca30e037c71ef7b08adc60dd3f6f9834 Mon Sep 17 00:00:00 2001 From: Frank Date: Wed, 7 Oct 2026 18:20:11 -0700 Subject: [PATCH] docs(authentik): record the human-user template and alex's recreation kassie (pk 14) and alex (pk 15, deleted pk 7 then recreated) now share the ridley shape: @franksdank.cloud + Non-Admin Users + jellyfin_users + openwebui_users. Audit before destroy: the old alex row carried no MFA device, token, entitlement, or proxy session - checked across the MFA device tables, authentik_core_token, and providers_proxy_proxysession (the fleet's column names differ from the ORM names: events.user is denormalized JSON, certificatekeypair has no user_id). Events survive the delete, so the audit trail keeps its shape. Co-Authored-By: omp --- serverAppConfigs-docs/Infrastructure/Authentik.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/serverAppConfigs-docs/Infrastructure/Authentik.md b/serverAppConfigs-docs/Infrastructure/Authentik.md index d4348bf..b132d02 100644 --- a/serverAppConfigs-docs/Infrastructure/Authentik.md +++ b/serverAppConfigs-docs/Infrastructure/Authentik.md @@ -449,8 +449,16 @@ access is decided entirely by GROUP MEMBERSHIP consumed downstream — `u.app_entitlements(app)`. - `jellyfin_users` / `jellyfin_admins` → Jellyfin via the LDAP outpost (filter `(memberOf=cn=jellyfin_users,ou=groups,dc=franksdank,dc=cloud)`). -- `Non-Admin Users` = the plain-user marker group (precedents: alex, - qa-e2e). +- `Non-Admin Users` = the plain-user marker group (precedents: qa-e2e, and + every human account). +- **The human-user template** (ridley, kassie, alex — the last two created + 2026-10-08): `username` + `@franksdank.cloud` + display name + + `is_active=True` + the password set via `set_password`, membership in + `Non-Admin Users` + `jellyfin_users` + `openwebui_users`. `alex` was + recreated from scratch on 2026-10-08 into this shape (the old row had an + empty email and no `openwebui_users`; audit first — the row carried no MFA + device, token, entitlement, or proxy session, and events survive a user + delete because `Event.user` is a denormalized JSON field, not a FK). - EXCLUDE from a user-level account: `homepage-admins`, `jellyfin_admins`, `openwebui_admins`, `authentik Admins`, `authentik Read-only`. - Other user-category vhosts (SearXNG, Gitea, Calibre-Web, RomM, Copyparty,