From e0fdbafa354b943195e9cd5df90bbd7ad7a879e7 Mon Sep 17 00:00:00 2001
From: Vegard Hagen <vegard@stonegarden.dev>
Date: Sat, 3 May 2025 11:07:36 +0200
Subject: [PATCH] feat(authelia): add audiobookshelf OIDC client

Signed-off-by: Vegard Hagen <vegard@stonegarden.dev>
---
 k8s/apps/media/audiobookshelf/http-route.yaml |  3 ++-
 .../auth/authelia/clients/audiobookshelf.yaml | 12 ++++++++++++
 k8s/infra/auth/authelia/kustomization.yaml    |  1 +
 k8s/infra/auth/authelia/values.yaml           | 19 +++++++++++++++++++
 4 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 k8s/infra/auth/authelia/clients/audiobookshelf.yaml

diff --git a/k8s/apps/media/audiobookshelf/http-route.yaml b/k8s/apps/media/audiobookshelf/http-route.yaml
index 2b61a43..5fdb5c7 100644
--- a/k8s/apps/media/audiobookshelf/http-route.yaml
+++ b/k8s/apps/media/audiobookshelf/http-route.yaml
@@ -5,10 +5,11 @@ metadata:
   namespace: audiobookshelf
 spec:
   parentRefs:
+    - name: external
+      namespace: gateway
     - name: internal
       namespace: gateway
   hostnames:
-    - "audiobookshelf.stonegarden.dev"
     - "abs.stonegarden.dev"
   rules:
     - matches:
diff --git a/k8s/infra/auth/authelia/clients/audiobookshelf.yaml b/k8s/infra/auth/authelia/clients/audiobookshelf.yaml
new file mode 100644
index 0000000..351b566
--- /dev/null
+++ b/k8s/infra/auth/authelia/clients/audiobookshelf.yaml
@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: client-audiobookshelf
+  namespace: authelia
+spec:
+  encryptedData:
+    clientSecret: AgCDrroc9HdC8EIbzxYI94ubAW7X1YmqS8QHmcCSOM/xQjBmSaiOgR0dfw/mD0hbpsEaRF5VQie9JOQ/4nO3qjTPYGYBRwD0pEqqymaiHOA6Smv54wL/xl77MZw3ouk+JPIyX2895KbpjRpjGKYZlkFj9WNaOSSKN9Q39KynLG5mm9xS/pYfsVTc8DnHDklR0dNfLCnY1y3WW05cylmDrPoIb3Ppps0JnjY3JpjOZIe4TRFmwJqLgYlgYh+Z1rTD1iApl5hbi68gq2JsJ3ylSiS6w+HU+66yNvY1o/1j2ai7u+aessI/Y5Imct65hYF69AfwouEE6srRmQbtg+0EKahIfBngYNcEUXbp/HSX8A7fbvTWY/aaPcOqc3E8nAS79Vjcwf3PwwBEGS90ZQSMd5T70UICgXt0Bct6eHT7KLpJhL/eUFeMdiTDFEzGiDanBuXJzNaQThH/lWT3wDgM0ekIMoyFrYaNM7uSZgaZEyIl+B3la637h/qvXWF+NULprtu/VTE+ULg5vtysIdb3DLUyWNtqNy0aCSEmLZkJO7YSS0h+u57lQ2nhCxVu51SzcYPgX4Bxr2deo4pD43FGfF8WYZDo6mh4dlU4x6LJztJTo4/qzbeceX/5gvkVepNjyhRppFFUUQ1BXiJF7FgP80R1hbpPbjb72rmYH+V+qAS+jpeun5JiwmBifueTPFcmubmUkWhPlQpHt3wDqxnve6eSBqLEZ6LfF5CxoHbpU8PMsSmdMPLcntUCW9iVhvlHd0FZNByI2M5/sRNiUH6Z6LbqNftWYU3t9yp3lrE6OMo9NoJISgbBWkWkTVflpxWFjgX/2PcYkf7x3GWnE23gyQyURs4yVKznYBnkv3d/ddX5nB7xSA==
+  template:
+    metadata:
+      name: client-audiobookshelf
+      namespace: authelia
diff --git a/k8s/infra/auth/authelia/kustomization.yaml b/k8s/infra/auth/authelia/kustomization.yaml
index a6c383c..8cd889d 100644
--- a/k8s/infra/auth/authelia/kustomization.yaml
+++ b/k8s/infra/auth/authelia/kustomization.yaml
@@ -12,6 +12,7 @@ resources:
   - http-route.yaml
   - cnpg-db.yaml
   - clients/argocd.yaml
+  - clients/audiobookshelf.yaml
   - clients/netbird.yaml
 
 helmCharts:
diff --git a/k8s/infra/auth/authelia/values.yaml b/k8s/infra/auth/authelia/values.yaml
index 45b5332..2d64e16 100644
--- a/k8s/infra/auth/authelia/values.yaml
+++ b/k8s/infra/auth/authelia/values.yaml
@@ -113,6 +113,21 @@ configMap:
           introspection_endpoint_auth_method: none
           pushed_authorization_request_endpoint_auth_method: none
 
+        - client_id: audiobookshelf
+          client_secret: { path: /secrets/client-audiobookshelf/client_secret.txt }
+          client_name: Audiobookshelf
+          public: false
+          authorization_policy: two_factor
+          pre_configured_consent_duration: 1 month
+          require_pkce: true
+          redirect_uris:
+            - https://abs.stonegarden.dev/audiobookshelf/auth/openid/callback
+            - https://abs.stonegarden.dev/audiobookshelf/auth/openid/mobile-redirect
+            - audiobookshelf://oauth
+          scopes: [ openid, groups, email, profile, offline_access ]
+          id_token_signed_response_alg: ES256
+          access_token_signed_response_alg: ES256
+
         - client_id: kubectl
           client_name: kubectl
           public: true
@@ -183,6 +198,10 @@ secret:
       items:
         - key: clientSecret
           path: client_secret.txt
+    client-audiobookshelf:
+      items:
+        - key: clientSecret
+          path: client_secret.txt
     client-netbird:
       items:
         - key: clientSecret