From 9e02835121b91ecf6b03d812ed30f295a120c99d Mon Sep 17 00:00:00 2001 From: "azykov@mail.ru" Date: Tue, 21 Jul 2026 20:44:04 +0300 Subject: [PATCH] authelia --- clusters/base/apps/authelia/helmrelease.yaml | 68 +++++++++++++++++++ .../base/apps/authelia/helmrepository.yaml | 10 +++ .../base/apps/authelia/kustomization.yaml | 8 +++ clusters/base/apps/authelia/middleware.yaml | 14 ++++ .../base/apps/vaultwarden/secret.enc.yaml | 18 ++--- .../base/apps/zigbee2mqtt/secret.enc.yaml | 16 ++--- clusters/base/namespaces/auth.yaml | 4 ++ clusters/home/apps/authelia.yaml | 21 ++++++ clusters/home/apps/kustomization.yaml | 1 + clusters/home/namespaces/kustomization.yaml | 1 + 10 files changed, 144 insertions(+), 17 deletions(-) create mode 100644 clusters/base/apps/authelia/helmrelease.yaml create mode 100644 clusters/base/apps/authelia/helmrepository.yaml create mode 100644 clusters/base/apps/authelia/kustomization.yaml create mode 100644 clusters/base/apps/authelia/middleware.yaml create mode 100644 clusters/base/namespaces/auth.yaml create mode 100644 clusters/home/apps/authelia.yaml diff --git a/clusters/base/apps/authelia/helmrelease.yaml b/clusters/base/apps/authelia/helmrelease.yaml new file mode 100644 index 0000000..043ce55 --- /dev/null +++ b/clusters/base/apps/authelia/helmrelease.yaml @@ -0,0 +1,68 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: authelia + namespace: auth +spec: + interval: 10m + chartRef: + kind: OCIRepository + name: authelia + values: + controllers: + auth: + containers: + app: + image: + repository: authelia/authelia + tag: latest + probes: + liveness: + enabled: true + readiness: + enabled: true + + service: + app: + controller: auth + ports: + http: + port: 9091 + + ingress: + app: + className: traefik + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + hosts: + - host: auth.aggtaa.com + paths: + - path: / + pathType: Prefix + service: + identifier: app + port: http + tls: + - secretName: auth-tls + hosts: + - auth.aggtaa.com + + persistence: + config: + type: secret + name: authelia-secrets + globalMounts: + - path: /config/configuration.yml + subPath: configuration.yml + readOnly: true + - path: /config/users_database.yml + subPath: users_database.yml + readOnly: true + db: + type: persistentVolumeClaim + accessMode: ReadWriteOnce + size: 1Gi + storageClass: longhorn + retain: true + globalMounts: + - path: /db diff --git a/clusters/base/apps/authelia/helmrepository.yaml b/clusters/base/apps/authelia/helmrepository.yaml new file mode 100644 index 0000000..8f565de --- /dev/null +++ b/clusters/base/apps/authelia/helmrepository.yaml @@ -0,0 +1,10 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: OCIRepository +metadata: + name: authelia + namespace: auth +spec: + interval: 1h + url: oci://ghcr.io/bjw-s-labs/helm/app-template + ref: + tag: "5.0.1" diff --git a/clusters/base/apps/authelia/kustomization.yaml b/clusters/base/apps/authelia/kustomization.yaml new file mode 100644 index 0000000..b0b74c3 --- /dev/null +++ b/clusters/base/apps/authelia/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helmrepository.yaml + - helmrelease.yaml + - middleware.yaml + - secret.enc.yaml + \ No newline at end of file diff --git a/clusters/base/apps/authelia/middleware.yaml b/clusters/base/apps/authelia/middleware.yaml new file mode 100644 index 0000000..8d8cb32 --- /dev/null +++ b/clusters/base/apps/authelia/middleware.yaml @@ -0,0 +1,14 @@ +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: authelia + namespace: auth +spec: + forwardAuth: + address: http://authelia.authelia.svc.cluster.local:9091/api/verify?rd=https://auth.aggtaa.com + trustForwardHeader: true + authResponseHeaders: + - Remote-User + - Remote-Groups + - Remote-Name + - Remote-Email \ No newline at end of file diff --git a/clusters/base/apps/vaultwarden/secret.enc.yaml b/clusters/base/apps/vaultwarden/secret.enc.yaml index 695250e..cee55ca 100644 --- a/clusters/base/apps/vaultwarden/secret.enc.yaml +++ b/clusters/base/apps/vaultwarden/secret.enc.yaml @@ -4,20 +4,20 @@ metadata: name: vaultwarden-secrets namespace: vaultwarden stringData: - #ENC[AES256_GCM,data:O0RSnoeSh0fTImpMReW7qBWXAqxedIZhJqp2WTFC1OaUbsYfDjQJW38Q37ywpN/pG8uIV+QZKLlf,iv:5ad8L8pSb2icOrpkuxcGPd5GISn9ATFzhrgWPH01RSw=,tag:AH9UK+kMrmg6IyL30s1PCw==,type:comment] - ADMIN_TOKEN: ENC[AES256_GCM,data:+jZUF4Qlw0l381r+QgKigO7WEnwO/QnwcmViVurMGIe0StBZeRP1qWYRq8W0eF0foln7k4mn2uSWig7S1vv9PveDX7NDAknetfkd3yuiygVHN8U7xqRMRVplcSXDXxLKa8NmJp4QqDtp+CG+g+cC57lDlX3oBg==,iv:5RX9osm1pucGE8PXxbS05vJxjjlVgYbmxuIszqX2lfk=,tag:aAS2TgiPsgXLfp4lHz+d1g==,type:str] + #ENC[AES256_GCM,data:OBr662e8fx6irLEuGV/1/6rsJDCc9CYWSCGsavXPCRoU2txNR+JMOims0qeMcCUi0lvRsaUBLMu6,iv:8mdUKgI4CE7pSAcOiT67iSPKLtu5BCBgEWj6grskBmU=,tag:+R/hFKCU9pc86G6epooiuw==,type:comment] + ADMIN_TOKEN: ENC[AES256_GCM,data:LWnQnvTtIYLHZs4/Bbn1QjrZpFOS+9vK1cdB5BXTjtFurRWJIsfDX8cqa1jxLKUjg4DXEkGxvUzdPN7dOLuRdepp3IFGwyPTERMZEdfWbFdHnEpg6r78Q4jlfVsdUM2i9BlVb9O5yVh9joX62NPUf/RQvNdCyw==,iv:WMb4aHNik++OB/VELj8XHTmHaVpZgh2IYgfgEtHd2OU=,tag:JJn9dL89lexFuaplSIG9Lw==,type:str] sops: age: - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiRGxhQjJ0WktkWkNKai84 - ZHJIbldzVzdnOFJZNlhmRnJRc1pReHA2UGlVCnA4ZVk1SGxnd2ZWZ3prWmZWOFo2 - TUJkVXpseFRiTVpZaGtJS1NyeWszOTAKLS0tIDdyd1c5U2h6ZjRoM1Z0aitVR3hJ - dWM3aFRQRU05dzM5Vk82Vm9Ia05IeVUKxmwCQl5I93tN8e7R5UXRB9TTLNnoVlzy - pnL+nuoIpz3Bx29ejexep1T49PnCEqMm6kFknkwVProouPrytDOg3A== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtbTFUYk9lNmFXRDR4RmhE + RzdjQUE3cG1od05EelBmYnU1MEhDeGlnbVdZCll2UFdrYUJ0RERXaGxCMXdWSGoz + TlhZYy9YN3JEbFp6eUp1a1VlQ0p3dFEKLS0tIHVLTE1oU2UxY0UxY1B1WlJBWU8z + TEpjMGxubTFNYTFLS1pVb1MzM0d2MkkKHc1PWNIDZzfKRlV3Jm9llWGVE+s3vRU3 + CrQKsTi4M0H2DNrpAbmxhDZlk1z7ZL6UQHc6PX/4+Sji/0UKGH4BJA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-26T10:18:56Z" - mac: ENC[AES256_GCM,data:SvPOOWlGMngGujHVmfxtgM3WmLABRUBgH333DqizAVsgjuMJ4qIGuDFwGOaPtNvnlzqaSeURL83zxhJ7/FJr7pPALhz+K3Jv7FQo2GhMfXOkFX3NTu40ofm+7dxNFnysxiDXGjcb2ihEx3EDSr1XpZXaVjGX1g/GVzGdZm+QYRc=,iv:aPQzuksy3K6otDgvVdqhgwkc7wEJxN5bm+/n7Y73euc=,tag:UHKozRWL1ZErnPgYZ/UMdw==,type:str] + lastmodified: "2026-08-26T10:19:00Z" + mac: ENC[AES256_GCM,data:lneSlMUs74GVu0sNcONqamQWXYnOGascxawp1Sztqq/8zZ1ZO9mCCYS3FbLK21IbSn8jeSzqcjBMU9lbbRrj+LcQpp3CTTDX0tnv7+RvSmIU+gDj1rlk4l6eOro9XUL6XQrR+nAODgKQbDGxnT+9wqHK+U4p9cO4zA/CpiVmOUM=,iv:yzTpqtyT3fPaohUwiNIbFwN0T5OwR2pP1ivIFvKJ9ws=,tag:ekV3uO3DLrKsi8g1g8LhSw==,type:str] encrypted_regex: ^(data|stringData)$ version: 3.11.0 diff --git a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml index 54b15e9..8de9ce5 100644 --- a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml +++ b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml @@ -4,19 +4,19 @@ metadata: name: zigbee2mqtt-secrets namespace: zigbee2mqtt stringData: - secret.yaml: ENC[AES256_GCM,data:NcGyDTt8bPtjVXmS5MFrc6L/sFmvQn40/O50M+OduBlxJrtV9xSPdK2sbTPBjLiMcgwudmXYn55JjTtcS/DwIHbKLnSgq+Qkab/LORI1FLlHhV/I+Q6PdWTMPQ96UMCCMhS9JPuZtguZB4OK2BIiGVwzvQX4cC2PSl+g89w=,iv:cLZYkozTif5rpbxQmnDONEAFr1O/nDWCs4umZqg4Ne8=,tag:jjSZH9icAjt2zhXDvp6ufw==,type:str] + secret.yaml: ENC[AES256_GCM,data:EnKjpaEDmBpyC8Y8tOovIr9SK44FD+4MCzL8h2eUYrzK1XZo3QYqGb52ygpU3TdWA6VyxHr+VLEkWXtOyURodQ4Yx8zMCrc5jMbj71yGRjbMvWqungp1rDenz1Ft3ssz19xRrn5iNxo1YHX8M1dq77gRNItl88nta4QEFJc=,iv:Hckga4VNU237I938F48yQ4QiYyr6jW2hWP5IG+te8qc=,tag:LmJXpwZ18kkPyzn5PjHzcg==,type:str] sops: age: - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIbVh1ckJCY1NUbXpqVTRu - RTBnczdtVlpWMkJ6UU5WcnIwQzRMY3Nod0hVClhrS0J2MHgzdzd4eCt1dWtnWDJI - VGF2TG9Tc1VTN01halFRVmNndEc3VjAKLS0tIEZTcWQwQ3A0RmlDeTR2RjdMYW1x - MHZMRnhXR2hTWkxObllWSVMzQ3dkeGMKC2oE6Yhh9SUjhx54SYRxk5d/BFWcXP8x - ptYkUbM0yp64cq2TCmyFWtWL56cBfCs4ORwlCNqpnhWP9s+You/9jw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLbjhYK3RUMENVdUVYZlU1 + alhTNTVFK2hkSVltV2x4TTcwSHlHbGdtbVRFCmlGZ2IzUTBxT2ZDTk5FQmQxOHpT + cUplVFFSMU1rdnRCSHBPeTJ3QVY0NWMKLS0tIGszcThSYlBkaDNYTkU5RlpMM01G + eSsvaXhjWjRvZzYwbXlpT2NWNXE0VVkKHJLBGVwEaoBJgznnAHCau8NdQP3zvNM5 + Hf93ZBq0/+hETieJfwNV1RO7A03SVSK8oaNbMVcCrfLJc/PB9N327Q== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-26T10:18:57Z" - mac: ENC[AES256_GCM,data:OjbwpeCo/lnVpuly+G9GP6ZE5rxqepiRWnw0u/5wp2C+IFdb41gyNw/d+PQRK7jAwHg7onC9jGo5VqNobIzRBqmDgIr6NdHOK4JulqAb0tirQC1t7VUpk9k9nZs5QojTOAEIYdnDGlzebZ1fZTHv3A/ckFVTB2LEcw86cRQJ+bk=,iv:tX26s2RSG6uoUXnIwFAId0voqPNyZkIuImZp3CkMl94=,tag:Kills54oTQ+lSocb5opugg==,type:str] + lastmodified: "2026-08-26T10:19:01Z" + mac: ENC[AES256_GCM,data:eUp9kiDcqUqDu3hExNQE0rC/MjLIeFZ49EvaG/cp2DsP1myMHNaBrvbQAhJOG0j+m0CJyBplBcFiboTmOEMVo0EitGxsKsvIX0m1O8Ko6vT849lWVPd9TCo6PpUZloDDguYzeSoXoI9lREnonTheOmDxWlZbEu2VGX/um9YD0+4=,iv:efk7vL33KUMQrY+kmZyYdq2y0DMs3mawLz7Z9eZEUqs=,tag:CvfV8MhAT3ieE2/vUuTiIQ==,type:str] encrypted_regex: ^(data|stringData)$ version: 3.11.0 diff --git a/clusters/base/namespaces/auth.yaml b/clusters/base/namespaces/auth.yaml new file mode 100644 index 0000000..6b34cab --- /dev/null +++ b/clusters/base/namespaces/auth.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: auth diff --git a/clusters/home/apps/authelia.yaml b/clusters/home/apps/authelia.yaml new file mode 100644 index 0000000..8d777ca --- /dev/null +++ b/clusters/home/apps/authelia.yaml @@ -0,0 +1,21 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: auth + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: flux-system + path: ./clusters/base/apps/auth + prune: true + wait: true + dependsOn: + - name: namespaces + - name: infra + retryInterval: 5s + decryption: + provider: sops + secretRef: + name: sops-age diff --git a/clusters/home/apps/kustomization.yaml b/clusters/home/apps/kustomization.yaml index 7b39097..e82be45 100644 --- a/clusters/home/apps/kustomization.yaml +++ b/clusters/home/apps/kustomization.yaml @@ -4,3 +4,4 @@ resources: - vaultwarden.yaml - zigbee2mqtt.yaml - radicale.yaml + - authelia.yaml diff --git a/clusters/home/namespaces/kustomization.yaml b/clusters/home/namespaces/kustomization.yaml index 848e088..e45868c 100644 --- a/clusters/home/namespaces/kustomization.yaml +++ b/clusters/home/namespaces/kustomization.yaml @@ -5,3 +5,4 @@ resources: - ../../base/namespaces/zigbee2mqtt.yaml - ../../base/namespaces/pim.yaml - ../../base/namespaces/longhorn-system.yaml + - ../../base/namespaces/auth.yaml