# Authentik — IdP + embedded outpost (proxy provider forward-auth).
# Draft — do NOT apply as-is:
#   - secret values are placeholders; create them from Vaultwarden/ESO first
#   - requires the authentik user/DB on postgresql.haven (see README.md)
#   - requires DNS record for auth.haven -> ingress IP (user manages DNS)
---
apiVersion: v1
kind: Secret
metadata:
  name: authentik-secrets
  namespace: auth
type: Opaque
stringData:
  postgres_password: "CHANGE_ME" # Vaultwarden -> ESO later
  secret_key: "CHANGE_ME" # `openssl rand -base64 60`
  bootstrap_password: "CHANGE_ME" # initial akadmin password
  bootstrap_token: "CHANGE_ME" # outpost token
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: authentik-media
  namespace: auth
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: nfs-fast-client # verified: exists in cluster (nfs-client is also default)
  resources:
    requests:
      storage: 2Gi
---
# Server (web + API)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: authentik-server
  namespace: auth
spec:
  replicas: 1
  selector:
    matchLabels: { app: authentik, component: server }
  template:
    metadata:
      labels: { app: authentik, component: server }
    spec:
      containers:
        - name: server
          image: ghcr.io/goauthentik/server:2026.8
          args: [server]
          env:
            - name: AUTHENTIK_SECRET_KEY
              valueFrom:
                { secretKeyRef: { name: authentik-secrets, key: secret_key } }
            - name: AUTHENTIK_POSTGRESQL__HOST
              value: postgresql.haven
            - name: AUTHENTIK_POSTGRESQL__NAME
              value: authentik
            - name: AUTHENTIK_POSTGRESQL__USER
              value: authentik
            - name: AUTHENTIK_POSTGRESQL__PASSWORD
              valueFrom:
                {
                  secretKeyRef:
                    { name: authentik-secrets, key: postgres_password },
                }
            - name: AUTHENTIK_BOOTSTRAP_PASSWORD
              valueFrom:
                {
                  secretKeyRef:
                    { name: authentik-secrets, key: bootstrap_password },
                }
            - name: AUTHENTIK_BOOTSTRAP_TOKEN
              valueFrom:
                {
                  secretKeyRef:
                    { name: authentik-secrets, key: bootstrap_token },
                }
            - name: AUTHENTIK_ERROR_REPORTING__ENABLED
              value: "false"
          ports:
            - { containerPort: 9000, name: http }
            - { containerPort: 9443, name: https }
          readinessProbe:
            httpGet: { path: /-/health/ready/, port: 9000 }
            initialDelaySeconds: 20
            periodSeconds: 10
          livenessProbe:
            httpGet: { path: /-/health/live/, port: 9000 }
            initialDelaySeconds: 40
            periodSeconds: 20
          resources:
            requests: { cpu: 250m, memory: 512Mi }
            limits: { memory: 1Gi, cpu: 1000m }
          volumeMounts:
            - { name: media, mountPath: /media }
      volumes:
        - name: media
          persistentVolumeClaim: { claimName: authentik-media }
---
# Worker (policies, outpost management, scheduled tasks)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: authentik-worker
  namespace: auth
spec:
  replicas: 1
  selector:
    matchLabels: { app: authentik, component: worker }
  template:
    metadata:
      labels: { app: authentik, component: worker }
    spec:
      containers:
        - name: worker
          image: ghcr.io/goauthentik/server:2026.8
          args: [worker]
          env: # same env as server; kept duplicated for a flat draft manifest
            - name: AUTHENTIK_SECRET_KEY
              valueFrom:
                { secretKeyRef: { name: authentik-secrets, key: secret_key } }
            - name: AUTHENTIK_POSTGRESQL__HOST
              value: postgresql.haven
            - name: AUTHENTIK_POSTGRESQL__NAME
              value: authentik
            - name: AUTHENTIK_POSTGRESQL__USER
              value: authentik
            - name: AUTHENTIK_POSTGRESQL__PASSWORD
              valueFrom:
                {
                  secretKeyRef:
                    { name: authentik-secrets, key: postgres_password },
                }
            - name: AUTHENTIK_BOOTSTRAP_PASSWORD
              valueFrom:
                {
                  secretKeyRef:
                    { name: authentik-secrets, key: bootstrap_password },
                }
            - name: AUTHENTIK_BOOTSTRAP_TOKEN
              valueFrom:
                {
                  secretKeyRef:
                    { name: authentik-secrets, key: bootstrap_token },
                }
            - name: AUTHENTIK_ERROR_REPORTING__ENABLED
              value: "false"
          resources:
            requests: { cpu: 200m, memory: 512Mi }
            limits: { memory: 1Gi, cpu: 1000m }
---
apiVersion: v1
kind: Service
metadata:
  name: authentik
  namespace: auth
spec:
  selector: { app: authentik, component: server }
  ports:
    - { name: http, port: 80, targetPort: 9000 }
---
# Embedded outpost — runs the proxy providers; this is what ingress-nginx
# calls for /auth/nginx on every use-sso-auth ingress.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: authentik-outpost
  namespace: auth
spec:
  replicas: 1
  selector:
    matchLabels: { app: authentik, component: outpost }
  template:
    metadata:
      labels: { app: authentik, component: outpost }
    spec:
      containers:
        - name: outpost
          image: ghcr.io/goauthentik/proxy:2026.8
          env:
            - name: AUTHENTIK_HOST
              value: http://authentik.auth.svc.cluster.local
            - name: AUTHENTIK_INSECURE
              value: "true"
            - name: AUTHENTIK_TOKEN
              valueFrom:
                {
                  secretKeyRef:
                    { name: authentik-secrets, key: bootstrap_token },
                }
          ports:
            - { containerPort: 9000, name: http }
          readinessProbe:
            httpGet: { path: /outpost.goauthentik.io/ping, port: 9000 }
            initialDelaySeconds: 10
            periodSeconds: 10
          resources:
            requests: { cpu: 200m, memory: 512Mi }
            limits: { memory: 1Gi, cpu: 1000m }
---
apiVersion: v1
kind: Service
metadata:
  name: authentik-outpost
  namespace: auth
spec:
  selector: { app: authentik, component: outpost }
  ports:
    - { name: http, port: 80, targetPort: 9000 }
---
# SSO portal (user-facing login) — auth.haven
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: authentik
  namespace: auth
spec:
  ingressClassName: traefik
  rules:
    - host: auth.haven
      http:
        paths:
          - path: /
            pathType: Prefix
            backend: { service: { name: authentik, port: { number: 80 } } }
---
# Outpost route — the /outpost.goauthentik.io path must resolve on the same
# host the protected apps redirect to. Kept as a separate ingress so it can
# also be attached to other hosts later if needed (do NOT give it
# use-sso-auth — that would create an auth loop).
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: authentik-outpost
  namespace: auth
spec:
  ingressClassName: traefik
  rules:
    - host: auth.haven
      http:
        paths:
          - path: /outpost.goauthentik.io
            pathType: Prefix
            backend:
              { service: { name: authentik-outpost, port: { number: 80 } } }