tinyauth

.sops.yaml

@@ -38,3 +38,6 @@ creation_rules:
   - path_regex: woodpecker.*\.enc\.yaml$
     encrypted_regex: ^(data|stringData)$
     age: age13qwkssk8esashln2j3gfv6e9csashr4vddkdav5v38hm5wejl36qd2ew9s
+  - path_regex: tinyauth.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1rvyt7nlnjqeyt6ykwh9fj9d88kjmq9vetcx667ul3ql6fyfz4gqqh9lq9q

clusters/base/apps/tinyauth/helmrelease.yaml

@@ -0,0 +1,74 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: tinyauth
+  namespace: auth
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: tinyauth
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      tinyauth:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/tinyauthapp/tinyauth
+              tag: v5.2.0
+            env:
+              TZ: Europe/Moscow
+              TINYAUTH_APPURL: https://login.aggtaa.com
+              TINYAUTH_UI_TITLE: "Welcome"
+              TINYAUTH_AUTH_USERSFILE: /config/users
+              TINYAUTH_AUTH_SECURECOOKIE: "true"
+              TINYAUTH_LABELPROVIDER: none
+              TINYAUTH_ANALYTICS_ENABLED: "false"
+              TINYAUTH_DATABASE_DRIVER: memory
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 20m
+                memory: 64Mi
+              limits:
+                memory: 256Mi
+
+    service:
+      app:
+        controller: tinyauth
+        ports:
+          http:
+            port: 3000
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: login.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: tinyauth-tls
+            hosts:
+              - login.aggtaa.com
+
+    persistence:
+      users:
+        type: secret
+        name: tinyauth-secrets
+        globalMounts:
+          - path: /config/users
+            subPath: users
+            readOnly: true

clusters/base/apps/tinyauth/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: tinyauth
+  namespace: auth
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/tinyauth/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - middleware.yaml
+  - secret.enc.yaml

clusters/base/apps/tinyauth/middleware.yaml

@@ -0,0 +1,14 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: tinyauth
+  namespace: auth
+spec:
+  forwardAuth:
+    address: http://tinyauth.auth.svc.cluster.local:3000/api/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - Remote-User
+      - Remote-Groups
+      - Remote-Name
+      - Remote-Email

clusters/base/apps/tinyauth/secret.enc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: tinyauth-secrets
+    namespace: auth
+stringData:
+    users: ENC[AES256_GCM,data:C3Dhfymnr+WLWy18EpY9upXn+f7sY6w0cf3oXO9352PTPCP+rLYQTm8eiJtsU8gp/Uea7lMpsRPHSy8CoRdI8DOGT+hyPyK1ovjLdyO7bEiq0TtYOIFlHSR7Kwo0Cm+pZegSN9e1dm/v51+YyFfX3JpLaymYrlmXL3sFPQ0yOzEuMp3zXSV3VAkJe6gZrswIAUNhY0xmaGItr4Vc2isItDuc16lx7tW2wJHI7NgLI98p9FyU8HlXd9MsiPMxDaXSGeAwnjGU+TEvQv9NbhcZO0sUocSi2zgnRbi0i8Zt,iv:5OVryBqH4VNC71QdZkqZsoDrfbT5++Z5xZjgCFNOAu0=,tag:V+OC7Mad6Dw38u91gp6d/Q==,type:str]
+sops:
+    age:
+        - recipient: age1rvyt7nlnjqeyt6ykwh9fj9d88kjmq9vetcx667ul3ql6fyfz4gqqh9lq9q
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJS1llcTdHUmx2ZXdjVFh1
+            ekJheVN2MVBwa0V1a2JOY2pFM1pmYUJrMzFRCllaRnlnTGFVYTlQeXVxNXFsNEZu
+            bWUxd3BWZTlEOWxsZVRnREx6YUJ6em8KLS0tIGNDd1Znb0dlSDZEUE1JUkdWMlBG
+            ajBNVW1pa20zKzhISmFBUmdiazA4T1UK0wyvTMGsyJthx2Py1LITvRePQsjKN/9v
+            jqKjeeCuVutQCo3FvoVrlkkmiD19jqPDoXjWz95sTN6QjWmP7u6AIA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-10-20T07:13:27Z"
+    mac: ENC[AES256_GCM,data:oLDi3nfNcZir32V88C9q7wDH0Dsgt+ik54XJ+N41bYZSX745T1DFpLyUus5Xy0GKfSHXyjxWKoBuQ3ccEC5IrTE/xLM4XBCQfvV6hh/OtGA5TteCBeWII21YDikkIV12c9T7gHmT3hnUR2ICzPI9Ipsc9TpYG1NPHhrgZRuhJOI=,iv:kuXOPZTeOkMzd9jbdprCgsdPx/kIMFwC065sWx4FVIQ=,tag:ktIi29LDEtfCePWoQ3DHBA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/home/apps/kustomization.yaml

@@ -18,3 +18,4 @@ resources:
   - gitea.yaml
   - dev.yaml
   - woodpecker.yaml
+  - tinyauth.yaml

clusters/home/apps/tinyauth.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: tinyauth
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/tinyauth
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age-tinyauth