many things

authentik/jellyfin.tf

@@ -3,14 +3,20 @@ resource "random_id" "jellyfin_client_id" {
 }
 
 resource "authentik_provider_oauth2" "jellyfin" {
-  name = "Jellyfin"
+  name      = "Jellyfin"
   client_id = random_id.jellyfin_client_id.id
 
   authorization_flow = data.authentik_flow.default-provider-authorization-implicit-consent.id
-
-  redirect_uris = [
-    "https://jellyfin.lab.cowley.tech/sso/OID/start/authentik",
-    ".*",
+  invalidation_flow  = data.authentik_flow.default-invalidation-flow.id
+  allowed_redirect_uris = [
+    {
+      matching_mode = "strict",
+      url           = "https://jellyfin.lab.cowley.tech/sso/OID/start/authentik"
+    },
+    {
+      matching_mode = "strict",
+      url           = "http://jellyfin:8096/sso/OID/start/authentik"
+    },
   ]
 
   property_mappings = [
@@ -20,6 +26,7 @@ resource "authentik_provider_oauth2" "jellyfin" {
   ]
   lifecycle {
     ignore_changes = [
+      allowed_redirect_uris,
       signing_key,
       authentication_flow,
     ]
@@ -30,11 +37,11 @@ resource "authentik_application" "jellyfin" {
   name              = "Jellyfin"
   slug              = "jellyfin"
   protocol_provider = authentik_provider_oauth2.jellyfin.id
-  meta_launch_url = "https://jellyfin.lab.cowley.tech/sso/OID/start/authentik"
+  meta_launch_url   = "https://jellyfin.lab.cowley.tech/sso/OID/start/authentik"
 }
 resource "kubernetes_secret" "jellyfin_oidc" {
   metadata {
-    name = "jellyfin-oidc"
+    name      = "jellyfin-oidc"
     namespace = "jellyfin"
   }
   data = {