# fleet/authentik — identity provider (auth.dezky.eu)

Authentik, mirroring the dev docker-compose service but pointed at the
in-cluster data tier. Deployed via the k3s Helm controller (`helmchart.yaml`,
which mirrors `values.yaml`). Live at **https://auth.dezky.eu** (Let's Encrypt).

- External **Postgres** (`postgres.dezky-data`, db/user `authentik`) + **Redis**
  (`redis.dezky-data`) — chart's bundled subcharts disabled.
- Secrets via `global.envFrom` → the `authentik-secret` Secret (generated
  on-box; see `secret.example.yaml`). DB/Redis passwords match the dezky-data
  secrets.
- Ingress: Traefik + cert-manager `letsencrypt-prod`.
- `error_reporting` off, update-check off, bootstrap email `admin@dezky.eu`.

## Deploy
```bash
# 1. secret (reads DB/Redis pw from dezky-data so they match; rest generated)
ADB=$(kubectl -n dezky-data get secret postgres-secret -o jsonpath='{.data.AUTHENTIK_DB_PASSWORD}' | base64 -d)
RDB=$(kubectl -n dezky-data get secret redis-secret    -o jsonpath='{.data.REDIS_PASSWORD}'        | base64 -d)
kubectl create namespace dezky-auth --dry-run=client -o yaml | kubectl apply -f -
kubectl -n dezky-auth create secret generic authentik-secret \
  --from-literal=AUTHENTIK_SECRET_KEY=$(openssl rand -hex 50) \
  --from-literal=AUTHENTIK_POSTGRESQL__PASSWORD="$ADB" \
  --from-literal=AUTHENTIK_REDIS__PASSWORD="$RDB" \
  --from-literal=AUTHENTIK_BOOTSTRAP_PASSWORD=$(openssl rand -hex 16) \
  --from-literal=AUTHENTIK_BOOTSTRAP_TOKEN=$(openssl rand -hex 32)
# 2. install
kubectl apply -f helmchart.yaml
kubectl -n dezky-auth rollout status deploy/authentik-server --timeout=300s
```

## First login
```bash
# akadmin password (store in Bitwarden):
kubectl -n dezky-auth get secret authentik-secret -o jsonpath='{.data.AUTHENTIK_BOOTSTRAP_PASSWORD}' | base64 -d; echo
```
Log in at https://auth.dezky.eu as **akadmin** / that password.

## TODO (mirror the rest of dev — not yet applied)
- **OIDC app blueprints.** Dev provisions the operator app + a
  `dezky-platform-admins` access policy via a blueprint
  (`infrastructure/docker-compose/configs/authentik/blueprints/`). For prod,
  mount the equivalent at `/blueprints/custom` with **prod** redirect URLs
  (`operator.dezky.eu`, `app.dezky.eu`) + the matching client IDs/secrets.
  The portal OIDC client (hand-made in dev) also needs creating.
- **Rebrand** ("Powered by authentik" → "Powered by Dezky"): dev runs
  `rebrand-web.sh` as a root lifecycle script. Replicating in k8s needs a
  root-capable initContainer/command override — cosmetic, deferred.
- Pin the **chart version** (currently latest → app `2026.5.2`).