Authelia SSO Access Portal and Backend Readiness Sentinel

id: authelia-sso-and-backend-readiness-sentinel
namespace: company.team

description: |
  Continuously monitors Authelia Single Sign-On (SSO) and Multi-Factor Authentication (MFA) instances by probing API health and authentication engine state, validating Redis session storage and backend database connectivity, classifying operational posture, routing real-time Slack incident alerts, and logging compliance audit records.

inputs:
  - id: authelia_host
    type: STRING
    displayName: Authelia Host
    description: Hostname or IP address of the Authelia instance reachable by the
      Kestra worker.
    defaults: "localhost"

  - id: authelia_port
    type: INT
    displayName: Authelia Port
    description: HTTP port of the Authelia service (defaults to 9091).
    defaults: 9091

  - id: authelia_scheme
    type: STRING
    displayName: Protocol Scheme
    description: URI protocol scheme (http or https).
    defaults: "http"

  - id: expected_status
    type: STRING
    displayName: Expected Health Status
    description: Expected string value of the status attribute in Authelia
      /api/health response JSON.
    defaults: "ok"

tasks:
  - id: probe_health_endpoint
    type: io.kestra.plugin.core.http.Request
    description: Queries Authelia /api/health to audit process liveness and backend
      storage connectivity (Redis session store, PostgreSQL/MySQL/SQLite user
      storage).
    uri: "{{ inputs.authelia_scheme }}://{{ inputs.authelia_host }}:{{
      inputs.authelia_port }}/api/health"
    method: GET
    headers:
      Accept: "application/json"
    options:
      allowFailed: true
    allowFailure: true

  - id: probe_state_endpoint
    type: io.kestra.plugin.core.http.Request
    description: Queries Authelia /api/state to verify authentication engine
      readiness and session provider state.
    uri: "{{ inputs.authelia_scheme }}://{{ inputs.authelia_host }}:{{
      inputs.authelia_port }}/api/state"
    method: GET
    headers:
      Accept: "application/json"
    options:
      allowFailed: true
    allowFailure: true

  - id: classify_authelia_posture
    type: io.kestra.plugin.core.debug.Return
    description: Evaluates HTTP status codes and health JSON response attributes to
      classify cluster operational posture into HEALTHY_COMPLIANT,
      STORAGE_OR_BACKEND_DEGRADED, AUTH_ENGINE_UNREADY, or INSTANCE_UNREACHABLE.
    format: |
      {{ outputs.probe_health_endpoint.code is not defined or outputs.probe_state_endpoint.code is not defined ? 'INSTANCE_UNREACHABLE' : (outputs.probe_health_endpoint.code != 200 or not (((outputs.probe_health_endpoint.body | json | jq('.status') | first) ?? '') == inputs.expected_status) ? 'STORAGE_OR_BACKEND_DEGRADED' : (outputs.probe_state_endpoint.code != 200 ? 'AUTH_ENGINE_UNREADY' : 'HEALTHY_COMPLIANT')) }}

  - id: route_by_posture
    type: io.kestra.plugin.core.flow.Switch
    description: Routes alerts and logs based on the classified Authelia operational
      posture.
    value: "{{ outputs.classify_authelia_posture.value }}"
    cases:
      "HEALTHY_COMPLIANT":
        - id: log_healthy
          type: io.kestra.plugin.core.log.Log
          message: "Authelia SSO instance at {{ inputs.authelia_scheme }}://{{
            inputs.authelia_host }}:{{ inputs.authelia_port }} is
            HEALTHY_COMPLIANT. /api/health status: {{
            outputs.probe_health_endpoint.code }} ({{
            outputs.probe_health_endpoint.body | json | jq('.status') | first
            }}). /api/state: {{ outputs.probe_state_endpoint.code }}."

      "STORAGE_OR_BACKEND_DEGRADED":
        - id: alert_storage_degraded_slack
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {{ {"text": "Authelia Sentinel CRITICAL ALERT: Backend storage degraded on " ~ inputs.authelia_host ~ ":" ~ inputs.authelia_port ~ "! /api/health returned HTTP " ~ (outputs.probe_health_endpoint.code ?? 'NONE') ~ " (payload: " ~ (outputs.probe_health_endpoint.body ?? 'EMPTY') ~ "). Redis session storage, SQL database, or LDAP user provider connection failed. User logins blocked! Execution: " ~ execution.id ~ "."} | toJson }}

        - id: log_storage_degraded
          type: io.kestra.plugin.core.log.Log
          message: "CRITICAL: Authelia /api/health returned non-200 or degraded status: {{
            outputs.probe_health_endpoint.code }}."

      "AUTH_ENGINE_UNREADY":
        - id: alert_auth_engine_slack
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {{ {"text": "Authelia Sentinel WARNING: Authentication engine unready on " ~ inputs.authelia_host ~ ":" ~ inputs.authelia_port ~ "! /api/state returned HTTP " ~ (outputs.probe_state_endpoint.code ?? 'NONE') ~ ". Portal is responding but authentication pipeline is unready. Execution: " ~ execution.id ~ "."} | toJson }}

        - id: log_auth_engine_unready
          type: io.kestra.plugin.core.log.Log
          message: "WARNING: Authelia /api/state returned non-200 code: {{
            outputs.probe_state_endpoint.code }}."

      "INSTANCE_UNREACHABLE":
        - id: alert_unreachable_slack
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {{ {"text": "Authelia Sentinel OUTAGE: Cannot reach Authelia SSO at " ~ inputs.authelia_scheme ~ "://" ~ inputs.authelia_host ~ ":" ~ inputs.authelia_port ~ ". Container offline, network partitioned, or reverse-proxy connection refused. Execution: " ~ execution.id ~ "."} | toJson }}

        - id: log_unreachable
          type: io.kestra.plugin.core.log.Log
          message: "OUTAGE: Authelia instance unreachable at {{ inputs.authelia_scheme
            }}://{{ inputs.authelia_host }}:{{ inputs.authelia_port }}."

  - id: audit_summary
    type: io.kestra.plugin.core.output.OutputValues
    description: Exports structured telemetry attributes and endpoint verification
      metrics for compliance audit reporting.
    values:
      target_instance: "{{ inputs.authelia_scheme }}://{{ inputs.authelia_host }}:{{
        inputs.authelia_port }}"
      health_http_code: "{{ outputs.probe_health_endpoint.code ?? 0 }}"
      health_payload_status: "{{ outputs.probe_health_endpoint.body | json |
        jq('.status') | first ?? 'NONE' }}"
      state_http_code: "{{ outputs.probe_state_endpoint.code ?? 0 }}"
      operational_posture: "{{ outputs.classify_authelia_posture.value }}"

errors:
  - id: alert_flow_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Alerts on unexpected workflow runtime execution failure.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {{ {"text": "Authelia Sentinel workflow failed unexpectedly during execution " ~ execution.id ~ " in namespace " ~ flow.namespace ~ "."} | toJson }}

triggers:
  - id: hourly_canary
    type: io.kestra.plugin.core.trigger.Schedule
    description: Executes automated Authelia health and readiness audit at the top
      of every hour. Shipped disabled.
    cron: "0 * * * *"
    disabled: true
    inputs:
      authelia_host: "localhost"
      authelia_port: 9091
      authelia_scheme: "http"
      expected_status: "ok"