My seed asks the FreeIPA realm’s own CA for ten real certificates, and a CA has no delete. Teardown revokes them, so every seeded realm keeps a record of the run, next to HBAC and sudo rules built to be misread.
Authentik was already in my homelab doing single sign-on, so there was no license cap to design around. Of everything the provider seeds, the three hundred users are the least interesting.
Every login in the house resolved against one thin client, and the only spare machine ran Ubuntu. The second server became a container, and a bad image tag left me a replica that looked healthy.
The rule a fresh FreeIPA install ships lets every account reach every service on every host, and it is on. That set my order: harden first, enroll second, then argue with each distro about sudo.
My lab has no Windows in it, and a directory should not be the reason to add some. FreeIPA gave me a Kerberos realm and an internal CA on a thin client, and a DNS migration that took the longest.
Six posts of proxying applications that cannot do SSO. Proxmox speaks OpenID Connect natively, so the right move was to get out of the way, and small disagreements made that harder.
Last post I deleted an application login and let the proxy gatekeep. This one keeps its login, and making the proxy a real boundary took a firewall rule and a lesson about who else talks to a service.
Tautulli has its own login and no way to accept an identity from a proxy. I deleted the account and let authentik be the single gate. Whether that is sensible or reckless depends on your network.
I put my identity provider on the internet through a tunnel, then went looking for where to put an access policy in front of it. The answer is a far smaller surface than I expected.
Thirty lines of nginx boilerplate per service, copied nine times, so any improvement meant nine edits. Caddy does it in two, and writing that up is what made me spot a hop left in cleartext.