Thore CimbalandClaude Sonnet 5
c52ff97502
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
Closes issue #36. The OAuth2 Provider ("Matrix Authentication Service") and its Application ("matrix" slug) linking Authentik to MAS were originally clicked together by hand in the UI and existed nowhere as code - unlike the flow fixes already captured in authentik-blueprints.yaml. Losing the Authentik DB would have meant re-creating this from scratch, including a fresh client_secret that MAS would no longer match. The client_secret is read via !Env from AUTHENTIK_MAS_OIDC_CLIENT_SECRET, sourced from a new key in the existing SOPS-encrypted authentik-credentials Secret, rather than inlined into the blueprint ConfigMap (which isn't itself encrypted). Value used is the actual live secret already in use, read directly from the running Authentik DB - not a new/rotated one, so this changes nothing about the current MAS<->Authentik pairing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
101 lines
2.3 KiB
YAML
101 lines
2.3 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: authentik
|
|
namespace: authentik
|
|
spec:
|
|
interval: 1h
|
|
chart:
|
|
spec:
|
|
chart: authentik
|
|
version: "2026.2.3"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: goauthentik
|
|
namespace: flux-system
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
valuesFrom:
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: secret_key
|
|
targetPath: authentik.secret_key
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: pg-password
|
|
targetPath: authentik.postgresql.password
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: pg-password
|
|
targetPath: postgresql.auth.password
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: smtp-password
|
|
targetPath: authentik.email.password
|
|
values:
|
|
global:
|
|
security:
|
|
allowInsecureImages: true
|
|
# Read by the matrix-oidc-provider blueprint via !Env, so the OAuth2
|
|
# Provider's client_secret can be captured as code without ever
|
|
# inlining the live credential into a plain (non-SOPS) ConfigMap.
|
|
env:
|
|
- name: AUTHENTIK_MAS_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-credentials
|
|
key: mas-oidc-client-secret
|
|
|
|
authentik:
|
|
log_level: info
|
|
error_reporting:
|
|
enabled: false
|
|
email:
|
|
host: smtp.ionos.de
|
|
port: 587
|
|
username: gamemaster@axion1337.chat
|
|
use_tls: true
|
|
from: "Authentik <gamemaster@axion1337.chat>"
|
|
|
|
blueprints:
|
|
configMaps:
|
|
- authentik-blueprints
|
|
|
|
server:
|
|
ingress:
|
|
enabled: false
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
worker:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
postgresql:
|
|
enabled: true
|
|
auth:
|
|
username: authentik
|
|
database: authentik
|
|
primary:
|
|
persistence:
|
|
enabled: true
|
|
size: 8Gi
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|