Ronni Baslund
406e2ca78b
ci / typecheck (map[dir:apps/booking name:booking]) (push) Has been cancelled
ci / typecheck (map[dir:apps/website name:website]) (push) Has been cancelled
ci / typecheck (map[dir:apps/portal name:portal]) (push) Has been cancelled
ci / typecheck (map[dir:services/platform-api name:platform-api]) (push) Has been cancelled
ci / test (push) Has been cancelled
- Authentik on the in-cluster Postgres/Redis (mirrors the dev compose config: external DB/Redis, error-reporting off, update-check off, bootstrap admin), via the k3s Helm controller; Ingress + cert-manager letsencrypt-prod. Live at https://auth.dezky.eu (image 2026.5.2). Secrets generated on-box (Bitwarden). - Traefik HelmChartConfig: global :80 -> :443 (308) redirect via additionalArguments (to=:443, HTTP-01-safe). - RUNBOOK updated. Deferred (mirror remaining dev bits): OIDC app blueprints (portal/operator with prod URLs) + the cosmetic "Powered by Dezky" rebrand.
56 lines
1.5 KiB
YAML
56 lines
1.5 KiB
YAML
# Authentik via the k3s Helm controller. valuesContent mirrors values.yaml
|
|
# (keep them in sync). Version intentionally unpinned for the first install —
|
|
# PIN the resolved chart version here once it's up (see RUNBOOK.md).
|
|
#
|
|
# The 'authentik-secret' Secret must exist in dezky-auth BEFORE this (it carries
|
|
# AUTHENTIK_SECRET_KEY + the DB/Redis/bootstrap creds via global.envFrom).
|
|
apiVersion: helm.cattle.io/v1
|
|
kind: HelmChart
|
|
metadata:
|
|
name: authentik
|
|
namespace: kube-system
|
|
spec:
|
|
repo: https://charts.goauthentik.io
|
|
chart: authentik
|
|
targetNamespace: dezky-auth
|
|
createNamespace: true
|
|
valuesContent: |-
|
|
image:
|
|
tag: "2026.5.2"
|
|
global:
|
|
envFrom:
|
|
- secretRef:
|
|
name: authentik-secret
|
|
env:
|
|
- name: AUTHENTIK_BOOTSTRAP_EMAIL
|
|
value: admin@dezky.eu
|
|
- name: AUTHENTIK_DISABLE_UPDATE_CHECK
|
|
value: "true"
|
|
authentik:
|
|
error_reporting:
|
|
enabled: false
|
|
postgresql:
|
|
host: postgres.dezky-data
|
|
name: authentik
|
|
user: authentik
|
|
redis:
|
|
host: redis.dezky-data
|
|
postgresql:
|
|
enabled: false
|
|
redis:
|
|
enabled: false
|
|
server:
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: traefik
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
hosts:
|
|
- auth.dezky.eu
|
|
paths:
|
|
- "/"
|
|
tls:
|
|
- hosts:
|
|
- auth.dezky.eu
|
|
secretName: authentik-tls
|