authelia

clusters/base/apps/authelia/helmrelease.yaml

@@ -0,0 +1,68 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: authelia
+  namespace: auth
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: authelia
+  values:
+    controllers:
+      auth:
+        containers:
+          app:
+            image:
+              repository: authelia/authelia
+              tag: latest
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: auth
+        ports:
+          http:
+            port: 9091
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: auth.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: auth-tls
+            hosts:
+              - auth.aggtaa.com
+
+    persistence:
+      config:
+        type: secret
+        name: authelia-secrets
+        globalMounts:
+          - path: /config/configuration.yml
+            subPath: configuration.yml
+            readOnly: true
+          - path: /config/users_database.yml
+            subPath: users_database.yml
+            readOnly: true
+      db:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /db

clusters/base/apps/authelia/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: authelia
+  namespace: auth
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/authelia/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - middleware.yaml
+  - secret.enc.yaml
+  

clusters/base/apps/authelia/middleware.yaml

@@ -0,0 +1,14 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authelia
+  namespace: auth
+spec:
+  forwardAuth:
+    address: http://authelia.authelia.svc.cluster.local:9091/api/verify?rd=https://auth.aggtaa.com
+    trustForwardHeader: true
+    authResponseHeaders:
+      - Remote-User
+      - Remote-Groups
+      - Remote-Name
+      - Remote-Email

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:O0RSnoeSh0fTImpMReW7qBWXAqxedIZhJqp2WTFC1OaUbsYfDjQJW38Q37ywpN/pG8uIV+QZKLlf,iv:5ad8L8pSb2icOrpkuxcGPd5GISn9ATFzhrgWPH01RSw=,tag:AH9UK+kMrmg6IyL30s1PCw==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:+jZUF4Qlw0l381r+QgKigO7WEnwO/QnwcmViVurMGIe0StBZeRP1qWYRq8W0eF0foln7k4mn2uSWig7S1vv9PveDX7NDAknetfkd3yuiygVHN8U7xqRMRVplcSXDXxLKa8NmJp4QqDtp+CG+g+cC57lDlX3oBg==,iv:5RX9osm1pucGE8PXxbS05vJxjjlVgYbmxuIszqX2lfk=,tag:aAS2TgiPsgXLfp4lHz+d1g==,type:str]
+    #ENC[AES256_GCM,data:OBr662e8fx6irLEuGV/1/6rsJDCc9CYWSCGsavXPCRoU2txNR+JMOims0qeMcCUi0lvRsaUBLMu6,iv:8mdUKgI4CE7pSAcOiT67iSPKLtu5BCBgEWj6grskBmU=,tag:+R/hFKCU9pc86G6epooiuw==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:LWnQnvTtIYLHZs4/Bbn1QjrZpFOS+9vK1cdB5BXTjtFurRWJIsfDX8cqa1jxLKUjg4DXEkGxvUzdPN7dOLuRdepp3IFGwyPTERMZEdfWbFdHnEpg6r78Q4jlfVsdUM2i9BlVb9O5yVh9joX62NPUf/RQvNdCyw==,iv:WMb4aHNik++OB/VELj8XHTmHaVpZgh2IYgfgEtHd2OU=,tag:JJn9dL89lexFuaplSIG9Lw==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiRGxhQjJ0WktkWkNKai84
-            ZHJIbldzVzdnOFJZNlhmRnJRc1pReHA2UGlVCnA4ZVk1SGxnd2ZWZ3prWmZWOFo2
-            TUJkVXpseFRiTVpZaGtJS1NyeWszOTAKLS0tIDdyd1c5U2h6ZjRoM1Z0aitVR3hJ
-            dWM3aFRQRU05dzM5Vk82Vm9Ia05IeVUKxmwCQl5I93tN8e7R5UXRB9TTLNnoVlzy
-            pnL+nuoIpz3Bx29ejexep1T49PnCEqMm6kFknkwVProouPrytDOg3A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtbTFUYk9lNmFXRDR4RmhE
+            RzdjQUE3cG1od05EelBmYnU1MEhDeGlnbVdZCll2UFdrYUJ0RERXaGxCMXdWSGoz
+            TlhZYy9YN3JEbFp6eUp1a1VlQ0p3dFEKLS0tIHVLTE1oU2UxY0UxY1B1WlJBWU8z
+            TEpjMGxubTFNYTFLS1pVb1MzM0d2MkkKHc1PWNIDZzfKRlV3Jm9llWGVE+s3vRU3
+            CrQKsTi4M0H2DNrpAbmxhDZlk1z7ZL6UQHc6PX/4+Sji/0UKGH4BJA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:18:56Z"
-    mac: ENC[AES256_GCM,data:SvPOOWlGMngGujHVmfxtgM3WmLABRUBgH333DqizAVsgjuMJ4qIGuDFwGOaPtNvnlzqaSeURL83zxhJ7/FJr7pPALhz+K3Jv7FQo2GhMfXOkFX3NTu40ofm+7dxNFnysxiDXGjcb2ihEx3EDSr1XpZXaVjGX1g/GVzGdZm+QYRc=,iv:aPQzuksy3K6otDgvVdqhgwkc7wEJxN5bm+/n7Y73euc=,tag:UHKozRWL1ZErnPgYZ/UMdw==,type:str]
+    lastmodified: "2026-08-26T10:19:00Z"
+    mac: ENC[AES256_GCM,data:lneSlMUs74GVu0sNcONqamQWXYnOGascxawp1Sztqq/8zZ1ZO9mCCYS3FbLK21IbSn8jeSzqcjBMU9lbbRrj+LcQpp3CTTDX0tnv7+RvSmIU+gDj1rlk4l6eOro9XUL6XQrR+nAODgKQbDGxnT+9wqHK+U4p9cO4zA/CpiVmOUM=,iv:yzTpqtyT3fPaohUwiNIbFwN0T5OwR2pP1ivIFvKJ9ws=,tag:ekV3uO3DLrKsi8g1g8LhSw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:NcGyDTt8bPtjVXmS5MFrc6L/sFmvQn40/O50M+OduBlxJrtV9xSPdK2sbTPBjLiMcgwudmXYn55JjTtcS/DwIHbKLnSgq+Qkab/LORI1FLlHhV/I+Q6PdWTMPQ96UMCCMhS9JPuZtguZB4OK2BIiGVwzvQX4cC2PSl+g89w=,iv:cLZYkozTif5rpbxQmnDONEAFr1O/nDWCs4umZqg4Ne8=,tag:jjSZH9icAjt2zhXDvp6ufw==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:EnKjpaEDmBpyC8Y8tOovIr9SK44FD+4MCzL8h2eUYrzK1XZo3QYqGb52ygpU3TdWA6VyxHr+VLEkWXtOyURodQ4Yx8zMCrc5jMbj71yGRjbMvWqungp1rDenz1Ft3ssz19xRrn5iNxo1YHX8M1dq77gRNItl88nta4QEFJc=,iv:Hckga4VNU237I938F48yQ4QiYyr6jW2hWP5IG+te8qc=,tag:LmJXpwZ18kkPyzn5PjHzcg==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIbVh1ckJCY1NUbXpqVTRu
-            RTBnczdtVlpWMkJ6UU5WcnIwQzRMY3Nod0hVClhrS0J2MHgzdzd4eCt1dWtnWDJI
-            VGF2TG9Tc1VTN01halFRVmNndEc3VjAKLS0tIEZTcWQwQ3A0RmlDeTR2RjdMYW1x
-            MHZMRnhXR2hTWkxObllWSVMzQ3dkeGMKC2oE6Yhh9SUjhx54SYRxk5d/BFWcXP8x
-            ptYkUbM0yp64cq2TCmyFWtWL56cBfCs4ORwlCNqpnhWP9s+You/9jw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLbjhYK3RUMENVdUVYZlU1
+            alhTNTVFK2hkSVltV2x4TTcwSHlHbGdtbVRFCmlGZ2IzUTBxT2ZDTk5FQmQxOHpT
+            cUplVFFSMU1rdnRCSHBPeTJ3QVY0NWMKLS0tIGszcThSYlBkaDNYTkU5RlpMM01G
+            eSsvaXhjWjRvZzYwbXlpT2NWNXE0VVkKHJLBGVwEaoBJgznnAHCau8NdQP3zvNM5
+            Hf93ZBq0/+hETieJfwNV1RO7A03SVSK8oaNbMVcCrfLJc/PB9N327Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:18:57Z"
-    mac: ENC[AES256_GCM,data:OjbwpeCo/lnVpuly+G9GP6ZE5rxqepiRWnw0u/5wp2C+IFdb41gyNw/d+PQRK7jAwHg7onC9jGo5VqNobIzRBqmDgIr6NdHOK4JulqAb0tirQC1t7VUpk9k9nZs5QojTOAEIYdnDGlzebZ1fZTHv3A/ckFVTB2LEcw86cRQJ+bk=,iv:tX26s2RSG6uoUXnIwFAId0voqPNyZkIuImZp3CkMl94=,tag:Kills54oTQ+lSocb5opugg==,type:str]
+    lastmodified: "2026-08-26T10:19:01Z"
+    mac: ENC[AES256_GCM,data:eUp9kiDcqUqDu3hExNQE0rC/MjLIeFZ49EvaG/cp2DsP1myMHNaBrvbQAhJOG0j+m0CJyBplBcFiboTmOEMVo0EitGxsKsvIX0m1O8Ko6vT849lWVPd9TCo6PpUZloDDguYzeSoXoI9lREnonTheOmDxWlZbEu2VGX/um9YD0+4=,iv:efk7vL33KUMQrY+kmZyYdq2y0DMs3mawLz7Z9eZEUqs=,tag:CvfV8MhAT3ieE2/vUuTiIQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/namespaces/auth.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: auth

clusters/home/apps/authelia.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: auth
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/auth
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age

clusters/home/apps/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - vaultwarden.yaml
   - zigbee2mqtt.yaml
   - radicale.yaml
+  - authelia.yaml

clusters/home/namespaces/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - ../../base/namespaces/zigbee2mqtt.yaml
   - ../../base/namespaces/pim.yaml
   - ../../base/namespaces/longhorn-system.yaml
+  - ../../base/namespaces/auth.yaml