3c2a03e9c3
Add Authentik v2026.x with embedded PostgreSQL in new namespace. Includes HelmRelease with valuesFrom injection for encrypted credentials, cert-manager Certificate for auth.axion1337.chat, and Traefik IngressRoute. Authentik serves as OIDC provider for MAS; registration via invitation links only. DNS A-record setup and Authentik UI configuration (OIDC provider creation) are manual post-deployment steps. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
88 lines
1.8 KiB
YAML
88 lines
1.8 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: authentik
|
|
namespace: authentik
|
|
spec:
|
|
interval: 1h
|
|
chart:
|
|
spec:
|
|
chart: authentik
|
|
version: "2026.2.2"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: goauthentik
|
|
namespace: flux-system
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
valuesFrom:
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: secret_key
|
|
targetPath: authentik.secret_key
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: pg-password
|
|
targetPath: authentik.postgresql.password
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: pg-password
|
|
targetPath: postgresql.auth.password
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: smtp-password
|
|
targetPath: authentik.email.password
|
|
values:
|
|
global:
|
|
security:
|
|
allowInsecureImages: true
|
|
|
|
authentik:
|
|
log_level: info
|
|
error_reporting:
|
|
enabled: false
|
|
email:
|
|
host: smtp.ionos.de
|
|
port: 587
|
|
username: gamemaster@axion1337.chat
|
|
use_tls: true
|
|
from: "Authentik <gamemaster@axion1337.chat>"
|
|
|
|
server:
|
|
ingress:
|
|
enabled: false
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
worker:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
postgresql:
|
|
enabled: true
|
|
auth:
|
|
username: authentik
|
|
database: authentik
|
|
primary:
|
|
persistence:
|
|
enabled: true
|
|
size: 8Gi
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|