work with authentik

OTSSignsOrchestrator.Desktop/App.axaml.cs

@@ -138,6 +138,7 @@ public class App : Application
         services.AddHttpClient();
         services.AddHttpClient("XiboApi");
         services.AddHttpClient("XiboHealth");
+        services.AddHttpClient("AuthentikApi");
 
         // SSH services (singletons — maintain connections)
         services.AddSingleton<SshConnectionService>();
@@ -156,6 +157,7 @@ public class App : Application
         services.AddTransient<XiboApiService>();
         services.AddTransient<InstanceService>();
         services.AddTransient<IBitwardenSecretService, BitwardenSecretService>();
+        services.AddTransient<IAuthentikService, AuthentikService>();
         services.AddSingleton<PostInstanceInitService>();
 
         // ViewModels

OTSSignsOrchestrator.Desktop/Services/SshDockerCliService.cs

@@ -259,6 +259,58 @@ public class SshDockerCliService : IDockerCliService
         return (false, error);
     }
 
+    public async Task<(bool Success, string? Error)> WriteFileToNfsAsync(
+        string nfsServer,
+        string nfsExport,
+        string relativePath,
+        string content,
+        string? nfsExportFolder = null)
+    {
+        EnsureHost();
+        var exportPath = (nfsExport ?? string.Empty).Trim('/');
+        var subFolder = (nfsExportFolder ?? string.Empty).Trim('/');
+        var subPath = string.IsNullOrEmpty(subFolder) ? string.Empty : $"/{subFolder}";
+
+        // Ensure parent directory exists, then write content via heredoc
+        var targetPath = $"$MNT{subPath}/{relativePath.TrimStart('/')}";
+        var parentDir = $"$(dirname \"{targetPath}\")";
+
+        // Escape content for heredoc (replace any literal EOF that might appear in content)
+        var safeContent = content.Replace("'", "'\\''");
+
+        var script = $"""
+            set -e
+            MNT=$(mktemp -d)
+            sudo mount -t nfs -o addr={nfsServer},nfsvers=4,proto=tcp,soft,timeo=50,retrans=2 {nfsServer}:/{exportPath} "$MNT"
+            sudo mkdir -p {parentDir}
+            sudo tee "{targetPath}" > /dev/null << 'OTSSIGNS_EOF'
+            {content}
+            OTSSIGNS_EOF
+            sudo umount "$MNT"
+            rmdir "$MNT"
+            """;
+
+        _logger.LogInformation(
+            "Writing file to NFS {Server}:/{Export}{Sub}/{Path} on Docker host {Host}",
+            nfsServer, exportPath, subPath, relativePath, _currentHost!.Label);
+
+        var (exitCode, stdout, stderr) = await _ssh.RunCommandAsync(_currentHost!, script, TimeSpan.FromSeconds(30));
+
+        if (exitCode == 0)
+        {
+            _logger.LogInformation(
+                "File written to NFS on {Host}: {Server}:/{Export}{Sub}/{Path}",
+                _currentHost.Label, nfsServer, exportPath, subPath, relativePath);
+            return (true, null);
+        }
+
+        var error = (stderr ?? stdout ?? "unknown error").Trim();
+        _logger.LogWarning(
+            "Failed to write file to NFS on {Host}: {Error}",
+            _currentHost.Label, error);
+        return (false, error);
+    }
+
     public async Task<bool> ForceUpdateServiceAsync(string serviceName)
     {
         EnsureHost();