authelia

clusters/base/apps/authelia/helmrelease.yaml

@@ -0,0 +1,68 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: authelia
+  namespace: auth
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: authelia
+  values:
+    controllers:
+      auth:
+        containers:
+          app:
+            image:
+              repository: authelia/authelia
+              tag: latest
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: auth
+        ports:
+          http:
+            port: 9091
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: auth.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: auth-tls
+            hosts:
+              - auth.aggtaa.com
+
+    persistence:
+      config:
+        type: secret
+        name: authelia-secrets
+        globalMounts:
+          - path: /config/configuration.yml
+            subPath: configuration.yml
+            readOnly: true
+          - path: /config/users_database.yml
+            subPath: users_database.yml
+            readOnly: true
+      db:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /db

clusters/base/apps/authelia/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: authelia
+  namespace: auth
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/authelia/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - middleware.yaml
+  - secret.enc.yaml
+  

clusters/base/apps/authelia/middleware.yaml

@@ -0,0 +1,14 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authelia
+  namespace: auth
+spec:
+  forwardAuth:
+    address: http://authelia.authelia.svc.cluster.local:9091/api/verify?rd=https://auth.aggtaa.com
+    trustForwardHeader: true
+    authResponseHeaders:
+      - Remote-User
+      - Remote-Groups
+      - Remote-Name
+      - Remote-Email

clusters/base/namespaces/auth.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: auth

clusters/home/apps/authelia.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: auth
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/auth
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age

clusters/home/apps/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - vaultwarden.yaml
   - zigbee2mqtt.yaml
   - radicale.yaml
+  - authelia.yaml

clusters/home/namespaces/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - ../../base/namespaces/zigbee2mqtt.yaml
   - ../../base/namespaces/pim.yaml
   - ../../base/namespaces/longhorn-system.yaml
+  - ../../base/namespaces/auth.yaml