Add support for AUTHENTIK_TOKEN_FILE environment variable fallback to
service_orchestrator.py, configure_vault_authentik.py, and the Rust
authentik_agent_manager CLI/MCP server. This prevents hardcoding or
exposing raw tokens in environment blocks or CLI arguments. Document
the new Authentik SSO stack deployment on cupfox k3s in AGENTS.md and
update .mcp.json.full configuration.
Build: 0 jobs, 0 errors (lake build)
- Set SIGNUPS_ALLOWED=false in Vaultwarden environment on cupfox to disable public signups.
- Automated OIDC/Proxy setup via configure_vault_authentik.py by registering proxy provider, application, and updating the embedded outpost.
- Modified /etc/caddy/Caddyfile.vault on racknerd to forward authentication requests through the Authentik outpost.
- Added vaultwarden-verify-sso.spec.ts Playwright verification test ensuring SSO redirects, successful login, and disabled registration are enforced.
Build: 3314 jobs, 0 errors (lake build)
