commit ff22a98a8f78810049bb912643795d20db694122
parent 86e97278fd79c6324103b49031e404898bcb0dc5
Author: MTRNord <mtrnord1@gmail.com>
Date: Sat, 28 Dec 2024 00:01:32 +0100
Meow
Diffstat:
3 files changed, 54 insertions(+), 16 deletions(-)
diff --git a/apps/base/authentik/certificates.yaml b/apps/base/authentik/certificates.yaml
@@ -0,0 +1,19 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+ name: ldap-authentik
+ namespace: authentik
+spec:
+ secretName: ldap-authentik
+ privateKey:
+ rotationPolicy: Always
+ issuerRef:
+ name: letsencrypt-dns
+ kind: ClusterIssuer
+ commonName: "ldap.midnightthoughts.space"
+ dnsNames:
+ - "auth.midnightthoughts.space"
+ - "ldap.midnightthoughts.space"
+ additionalOutputFormats:
+ - type: CombinedPEM
+ - type: DER
diff --git a/apps/base/authentik/kustomization.yaml b/apps/base/authentik/kustomization.yaml
@@ -3,4 +3,5 @@ kind: Kustomization
namespace: authentik
resources:
- repository.yaml
+ - certificates.yaml
- release.yaml
diff --git a/apps/base/authentik/release.yaml b/apps/base/authentik/release.yaml
@@ -19,7 +19,7 @@ spec:
retries: 3
values:
authentik:
- secret_key: ENC[AES256_GCM,data:OC8U3Tvfhi/9shzzsJLB2dt8uNJ+rh+hH4/B0jMCIUyMn4qt63iA8arZvg7ajYwHg+vgOuwMfvqHEyVijHbVAQ==,iv:kU11QH+ZrAsk5y07exuKRfKLpSg/lOX659qam485YPI=,tag:4ePPuH/feB1JJlEsoJ6krQ==,type:str]
+ secret_key: ENC[AES256_GCM,data:ZZ4qvaLE1M00xOWloL5wv0Q3iQxsgTeEM9r4giE2DL0mpb6TNmurpYG/4PRQDlR7IGE1wP3hqf5LBfYAp+OZSg==,iv:OxtzLDYcQ3jjfwVLhMd56UosiB73qRjqts+C0KYFfvs=,tag:8bU4tVIcvIf+mP3HTjx+7g==,type:str]
# This sends anonymous usage-data, stack traces on errors and
# performance data to sentry.io, and is fully opt-in
error_reporting:
@@ -28,7 +28,7 @@ spec:
host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local
name: authentik
user: authentik
- password: ENC[AES256_GCM,data:fYkzGIPwywRp/NyxFgB0kGf9zHi5r1ojcRKVsir9nZ9BIiZ0DQfnNWcutU3VX3XnQDiUGNYYhAjoeAT/sl90vg==,iv:HXIR5hbbWUvjEkRbT8Htgs15oMFH7QmaOO3tk94G3os=,tag:MbrV0ZNn5UqbIXa8E6muPA==,type:str]
+ password: ENC[AES256_GCM,data:iNrCWxtcRTCUaAkbAjqXi9EgwTgbO5UrZqpQuDKaQyq0ekro2AGpUOhEKx40cQ8yZX3DYm+vJe3YbCbREkze6g==,iv:ayGxhTXixlvtzpLqHWyGn/p3PumA7Ecmu7Z9rK5aW6o=,tag:F9t/7PXbA6WRL8Jvu3TiiA==,type:str]
email:
# -- SMTP Server emails are sent from, fully optional
host: mail.nordgedanken.dev
@@ -36,7 +36,7 @@ spec:
# -- SMTP credentials, when left empty, no authentication will be done
username: support@nordgedanken.dev
# -- SMTP credentials, when left empty, no authentication will be done
- password: ENC[AES256_GCM,data:Zu2TxF14QVyI,iv:UAcoQyMGiYH731x9Mn5z0QwqGlWbIZyJAjZ6nvW6lFI=,tag:izrYCOv6A/IInDKzywdc8w==,type:str]
+ password: ENC[AES256_GCM,data:9SyHrU90FqyJ,iv:EU8net1Z0eNi7ls0Wrr/2yWXvtsSdIHf4WK7u65o9Hc=,tag:jpWttbP1TCELs14CB80tcA==,type:str]
# -- Enable either use_tls or use_ssl, they can't be enabled at the same time.
use_tls: true
# -- Enable either use_tls or use_ssl, they can't be enabled at the same time.
@@ -50,14 +50,32 @@ spec:
resources:
limits: {}
requests:
- cpu: "107m"
- memory: "578Mi"
+ cpu: 107m
+ memory: 578Mi
deploymentStrategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
+ # Mount the ldap certificate to /certs
+ volumes:
+ - name: ldap-cert
+ secret:
+ secretName: ENC[AES256_GCM,data:jezDqAKhwduZ8XCvOcE=,iv:bbixvEeCnAbnE/4draV0dQHyYHrDc5fIWngDYryCJIE=,tag:achnscHtpdmKXuNbkC+JsA==,type:str]
+ # Mount the ldap certificate to /certs
+ volumeMounts:
+ - name: ldap-cert
+ mountPath: /certs/ldap
server:
+ # Mount the ldap certificate to /certs
+ volumes:
+ - name: ldap-cert
+ secret:
+ secretName: ENC[AES256_GCM,data:Ek4HeexOPShRro49vSM=,iv:EX77mKfLsiPd/j+gBWI0fm3nUemMQRgOOwXeB1Lt3nU=,tag:goEbTSoqtU0hC313HbDcyA==,type:str]
+ # Mount the ldap certificate to /certs
+ volumeMounts:
+ - name: ldap-cert
+ mountPath: /certs/ldap
replicas: 2
deploymentStrategy:
type: RollingUpdate
@@ -67,8 +85,8 @@ spec:
resources:
limits: {}
requests:
- cpu: "181m"
- memory: "628Mi"
+ cpu: 181m
+ memory: 628Mi
env:
- name: AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS
value: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fe80::/10,::1/128,10.244.0.0/16,fc00:0::/96,fd00::/7
@@ -99,14 +117,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtQWZ3cFB4OWxCNCtQOTVp
- MitTRS9wWmZiY3RKZzEvSVFSTXozc0xjK0ZFCnZEc3BrWmhwaUdqcDlkTWJYZDdw
- NGN6d0FndGJSODQ3SWNabmViVXdOaTAKLS0tIGtHTVhJR3lZYU96d0VLZkcwR3Jv
- Ungya0pOS1JISGJrNzcwK09hR2E4WXcKf1+r1WaHGBNWjgt+OKhHG1YAa9pYB3nr
- Jw/5FPvQY4m/dQDUZFs9KzaKKQTxznirsdwkQj5jE97cGsK18Z4AZA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRXA3VEdvYytyWjNxcURl
+ SklXNGNhYkJHU1BuT1AxNWJ4RmRQNkVmSENzCk5aMlhUWG5MazBLVWQ5TlpBQXNI
+ Z0ZYbXlOQXQwSHVUZ0RCZWgramxFR2cKLS0tIE9OR2xqeHk1aC82T0V0WVpOMGp1
+ ZmVhU2VlRkM0bFhEaDEvQ1dDOXU2Z1EKG1SxgOEoxMyMrb7y42Hay2/HwZmtY97N
+ a43EwpiTAHgWn9hPo74gWOGipMZTdWOI0Zxd0Lp9z4plHoQ057mF4A==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2024-05-06T08:54:49Z"
- mac: ENC[AES256_GCM,data:2sYjrfoR1bJcmdAeXZJp04uKxLH5VJ/i2pvzCx2Isrwbz23LH1FDG5AHzcrSHVGAerqM5ATN46MtBM2QmUAAZHYWGsiPMMF536gNn/a2o+ya4s2fSmgq4CA4oMSFFrQxGQaGv3s0MgwXywuo5VpaBkbjijgQ0CYx0zkjcTrjA0Q=,iv:K+ojcISi7yC9VeDSW74rwsyV0dIKSPaMrkjixV+aPuA=,tag:8FDYWedZ86vpWP71/C+gLQ==,type:str]
+ lastmodified: "2024-12-27T23:01:27Z"
+ mac: ENC[AES256_GCM,data:3Kfrwuqv7Kb+1NdMhX0GxYO5DAsexcpCtOAZ52BvmU0CVX8i1dn0/0XrU+ypfVVs0z4z3zrgUKDJxg80AqNApfSzdT+YN7m+vjlpOQYszVk/7BygRCqv3CqE1AMKbdXLkhFMbBfVwA8Z/2mV/s3zsA+Rxna4SeOOX6pe+fAj/0A=,iv:i1B7LsQ9MeZrhwK3Q+1GsF1T3y9L9GG0aeeKafJI5X8=,tag:mm0ySZCaUNNRRZI8NIQDZA==,type:str]
pgp: []
- encrypted_regex: ^(clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|PASSWD|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
- version: 3.8.1
+ encrypted_regex: ^(jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
