reorganized and started adding authentik

.envs/.identity/.authentik-postgresql.template

@@ -0,0 +1 @@
+password=

.envs/.identity/.authentik-secret-key.template

@@ -0,0 +1 @@
+key=

stages/base/helmfile.yaml

@@ -7,8 +7,6 @@ repositories:
     url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
   - name: jetstack
     url: https://charts.jetstack.io
-  - name: argocd
-    url: https://argoproj.github.io/argo-helm
   - name: mojo2600
     url: https://mojo2600.github.io/pihole-kubernetes/
   - name: bitnami
@@ -35,12 +33,6 @@ releases:
     version: v1.16.2
     values:
       - ./values/cert-manager.values.yaml
-  - name: argocd
-    namespace: argocd
-    chart: argocd/argo-cd
-    version: 7.7.21
-    values:
-      - ./values/argocd.values.yaml
   - name: pihole
     namespace: pihole
     chart: mojo2600/pihole

stages/base/kustomization.yaml

@@ -10,11 +10,11 @@ resources:
 secretGenerator:
   - name: cert-manager-cloudflare
     envs:
-      - .envs/.cloudflare
+      - ../../.envs/.cloudflare
     namespace: cert-manager
   - name: pihole-admin
     envs:
-      - .envs/.pihole
+      - ../../.envs/.pihole
     namespace: pihole
     options:
       disableNameSuffixHash: true

stages/delivery/helmfile.yaml

@@ -0,0 +1,13 @@
+repositories:
+  - name: argocd
+    url: https://argoproj.github.io/argo-helm
+
+---
+
+releases:
+  - name: argocd
+    namespace: argocd
+    chart: argocd/argo-cd
+    version: 7.7.21
+    values:
+      - ./values/argocd.values.yaml

stages/delivery/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+labels:
+- includeSelectors: true
+  pairs:
+    app.kubernetes.io/managed-by: Kustomize

stages/delivery/values/argocd.values.yaml

@@ -0,0 +1,33 @@
+global:
+  domain: argo.kropcloud.net
+
+configs:
+  params:
+    server.insecure: true
+
+redis-ha:
+  enabled: true
+
+controller:
+  replicas: 1
+
+server:
+  replicas: 2
+  ingress:
+    enabled: true
+    ingressClassName: nginx
+    annotations:
+        nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+        nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+        cert-manager.io/cluster-issuer: cloudflare-issuer
+    extraTls:
+      - hosts:
+          - argo.kropcloud.net
+        secretName: argocd-tls
+
+
+repoServer:
+  replicas: 2
+
+applicationSet:
+  replicas: 2

stages/identity/helmfile.yaml

@@ -0,0 +1,11 @@
+repositories:
+  - name: authentik
+    url: https://charts.goauthentik.io/
+---
+releases:
+  - name: authentik
+    namespace: identity--authentik
+    chart: authentik/authentik
+    version: 2024.12.3
+    values:
+      - ./values/authentik.values.yaml

stages/identity/kustomization.yaml

@@ -0,0 +1,23 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+
+secretGenerator:
+  - name: authentik-db-password
+    namespace: identity--authentik
+    envs:
+      - ../../.envs/.identity/.authentik-postgresql
+    options:
+      disableNameSuffixHash: true
+  - name: authentik-secret-key
+    namespace: identity--authentik
+    envs:
+      - ../../.envs/.identity/.authentik-secret-key
+    options:
+      disableNameSuffixHash: true
+
+
+labels:
+- includeSelectors: true
+  pairs:
+    app.kubernetes.io/managed-by: Kustomize

stages/identity/values/authentik.values.yaml

@@ -0,0 +1,36 @@
+postgresql:
+  enabled: true
+  auth:
+    existingSecret: authentik-db-password
+    secretKeys:
+      userPasswordKey: password
+
+global:
+  env:
+    - name: AUTHENTIK_POSTGRESQL__PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: authentik-db-password
+          key: password
+    - name: AUTHENTIK_SECRET_KEY
+      valueFrom:
+        secretKeyRef:
+          name: authentik-secret-key
+          key: key
+
+redis:
+  enabled: true
+
+server:
+  ingress:
+    enabled: true
+    hosts:
+      - idp.kropcloud.net
+    annotations:
+      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+      nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+      cert-manager.io/cluster-issuer: cloudflare-issuer
+    tls:
+      - hosts: 
+        - idp.kropcloud.net
+        secretName: authentik-tls