duybq86/obot repository overview

⁠Obot + Authentik provider

Goal: build upstream Obot with a local provider registry, no core patch.

⁠Layout

• plugin/providers/authentik-auth-provider/ → Go provider binary.
• plugin/providers/auth-providers/authentik-auth-provider.yaml → Obot provider manifest.
• Dockerfile.providers-authentik → packages local providers into a temporary providers image.
• build_image_authentik.sh → CI/CD entrypoint: clone Obot source, build providers image, build final image, push, remove cloned source.
• build_obot_authentik.py → local/debug builder.

⁠Build flow

flowchart LR
  A[plugin/providers] --> B[providers image]
  C[upstream obot source] --> D[final obot image]
  B -->|PROVIDERS_IMAGE build arg| D
  D --> E[duybq86/obot:latest]

Technical detail: upstream source/Dockerfile already accepts PROVIDERS_IMAGE. The custom provider image only supplies /obot-providers. Final runtime image is still Obot, plus custom provider files.

⁠Run image

Minimum runtime env:

OBOT_SERVER_HOSTNAME=https://mcp.example.com
OBOT_SERVER_ENABLE_AUTHENTICATION=true
OBOT_SERVER_PROVIDER_REGISTRIES=/obot-providers/providers

Authentik provider env:

OBOT_AUTHENTIK_AUTH_PROVIDER_ISSUER_URL=https://auth.example.com/application/o/obot/
OBOT_AUTHENTIK_AUTH_PROVIDER_CLIENT_ID=<client-id>
OBOT_AUTHENTIK_AUTH_PROVIDER_CLIENT_SECRET=<client-secret>
OBOT_AUTH_PROVIDER_COOKIE_SECRET=<base64-32-bytes>
OBOT_AUTH_PROVIDER_REDIRECT_URL=https://mcp.example.com/oauth2/callback
OBOT_AUTH_PROVIDER_EMAIL_DOMAINS=*
OBOT_AUTHENTIK_AUTH_PROVIDER_SCOPE=openid email profile groups
OBOT_AUTHENTIK_AUTH_PROVIDER_GROUPS_CLAIM=groups
OBOT_AUTHENTIK_AUTH_PROVIDER_ALLOW_UNVERIFIED_EMAIL=false
OBOT_AUTH_PROVIDER_TOKEN_REFRESH_DURATION=1h
OBOT_AUTH_PROVIDER_ENABLE_LOGGING=false

Prefer email_verified=true in Authentik. Use OBOT_AUTHENTIK_AUTH_PROVIDER_ALLOW_UNVERIFIED_EMAIL=true only as compatibility bypass.

Generate cookie secret:

openssl rand -base64 32

⁠Authentik callback

Configure Authentik Redirect URIs exactly:

https://mcp.example.com/oauth2/callback

Set same value in OBOT_AUTH_PROVIDER_REDIRECT_URL. If omitted, provider defaults to <OBOT_SERVER_PUBLIC_URL|OBOT_SERVER_URL|OBOT_SERVER_HOSTNAME>/oauth2/callback.