apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: authentik
  namespace: authentik
spec:
  interval: 1h
  chart:
    spec:
      chart: authentik
      version: "2026.2.3"
      sourceRef:
        kind: HelmRepository
        name: goauthentik
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  valuesFrom:
    - kind: Secret
      name: authentik-credentials
      valuesKey: secret_key
      targetPath: authentik.secret_key
    - kind: Secret
      name: authentik-credentials
      valuesKey: pg-password
      targetPath: authentik.postgresql.password
    - kind: Secret
      name: authentik-credentials
      valuesKey: pg-password
      targetPath: postgresql.auth.password
    - kind: Secret
      name: authentik-credentials
      valuesKey: smtp-password
      targetPath: authentik.email.password
  values:
    global:
      security:
        allowInsecureImages: true
      # Read by the matrix-oidc-provider blueprint via !Env, so the OAuth2
      # Provider's client_secret can be captured as code without ever
      # inlining the live credential into a plain (non-SOPS) ConfigMap.
      env:
        - name: AUTHENTIK_MAS_OIDC_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: authentik-credentials
              key: mas-oidc-client-secret

    authentik:
      log_level: info
      error_reporting:
        enabled: false
      email:
        host: smtp.ionos.de
        port: 587
        username: gamemaster@axion1337.chat
        use_tls: true
        from: "Authentik <gamemaster@axion1337.chat>"

    blueprints:
      configMaps:
        - authentik-blueprints

    server:
      ingress:
        enabled: false
      resources:
        requests:
          cpu: 100m
          memory: 512Mi
        limits:
          memory: 1Gi

    worker:
      resources:
        requests:
          cpu: 50m
          memory: 512Mi
        limits:
          memory: 1Gi

    postgresql:
      enabled: true
      auth:
        username: authentik
        database: authentik
      primary:
        persistence:
          enabled: true
          size: 8Gi
        resources:
          requests:
            cpu: 50m
            memory: 256Mi
          limits:
            memory: 512Mi
        # Chart's own generated policy allows ANY pod in ANY namespace on 5432
        # (see issue #37) - disabled in favor of our own scoped policy in
        # apps/authentik/networkpolicy.yaml.
        networkPolicy:
          enabled: false