Adding option to brand across services where possible

roles/authentik/tasks/main.yml

@@ -7,10 +7,25 @@
   loop:
     - "{{ authentik_data_dir }}"
     - "{{ authentik_data_dir }}/media"
+    - "{{ authentik_data_dir }}/media/branding"
     - "{{ authentik_data_dir }}/custom-templates"
+    - "{{ authentik_data_dir }}/blueprints"
     - "{{ authentik_data_dir }}/certs"
     - "{{ authentik_data_dir }}/postgres"
 
+- name: Deploy Authentik branding blueprint
+  ansible.builtin.template:
+    src: branding-blueprint.yaml.j2
+    dest: "{{ authentik_data_dir }}/blueprints/sovereign-branding.yaml"
+    mode: '0644'
+
+- name: Copy tenant logo to Authentik media
+  ansible.builtin.copy:
+    src: "{{ tenant_logo_local_path }}"
+    dest: "{{ authentik_data_dir }}/media/branding/logo.png"
+    mode: '0644'
+  when: tenant_logo_local_path | default('') != ''
+
 - name: Deploy Authentik docker-compose
   ansible.builtin.template:
     src: docker-compose.yml.j2

roles/authentik/templates/branding-blueprint.yaml.j2

@@ -0,0 +1,23 @@
+---
+# Sovereign branding blueprint — applied automatically by Authentik on startup.
+# Customises the default brand with the tenant name, logo, and colour scheme.
+version: 1
+metadata:
+  name: Sovereign Tenant Branding
+  labels:
+    blueprints.goauthentik.io/description: Tenant branding configuration managed by Ansible
+entries:
+  - model: authentik_brands.brand
+    state: present
+    identifiers:
+      domain: authentik-default
+    attrs:
+      branding_title: "{{ tenant_name }}"
+{% if tenant_logo_local_path | default('') != '' %}
+      branding_logo: /media/branding/logo.png
+      branding_favicon: /media/branding/logo.png
+{% endif %}
+      branding_custom_css: |
+        :root {
+          --ak-accent: {{ tenant_primary_color | default('#fd4b2d') }};
+        }

roles/authentik/templates/docker-compose.yml.j2

@@ -61,6 +61,7 @@ services:
     volumes:
       - {{ authentik_data_dir }}/media:/media
       - {{ authentik_data_dir }}/custom-templates:/templates
+      - {{ authentik_data_dir }}/blueprints:/blueprints/custom
       - {{ authentik_data_dir }}/certs:/certs
     ports:
       - "127.0.0.1:9001:9000"