apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: authentik
  namespace: authentik
spec:
  interval: 1h
  chart:
    spec:
      chart: authentik
      version: "2026.2.3"
      sourceRef:
        kind: HelmRepository
        name: goauthentik
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  valuesFrom:
    - kind: Secret
      name: authentik-credentials
      valuesKey: secret_key
      targetPath: authentik.secret_key
    - kind: Secret
      name: authentik-credentials
      valuesKey: pg-password
      targetPath: authentik.postgresql.password
    - kind: Secret
      name: authentik-credentials
      valuesKey: pg-password
      targetPath: postgresql.auth.password
    - kind: Secret
      name: authentik-credentials
      valuesKey: smtp-password
      targetPath: authentik.email.password
  values:
    global:
      security:
        allowInsecureImages: true

    authentik:
      log_level: info
      error_reporting:
        enabled: false
      email:
        host: smtp.ionos.de
        port: 587
        username: gamemaster@axion1337.chat
        use_tls: true
        from: "Authentik <gamemaster@axion1337.chat>"

    server:
      ingress:
        enabled: false
      resources:
        requests:
          cpu: 100m
          memory: 512Mi
        limits:
          memory: 1Gi

    worker:
      resources:
        requests:
          cpu: 50m
          memory: 512Mi
        limits:
          memory: 1Gi

    postgresql:
      enabled: true
      auth:
        username: authentik
        database: authentik
      primary:
        persistence:
          enabled: true
          size: 8Gi
        resources:
          requests:
            cpu: 50m
            memory: 256Mi
          limits:
            memory: 512Mi