authentik: deploy

flux/cluster/apps/authentik/external-secret.yaml

@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: authentik
+  namespace: authentik
+spec:
+  refreshInterval: "5m"
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: authentik
+  data:
+  - secretKey: secret_key
+    remoteRef:
+      key: authentik/authentik
+      property: secret_key

flux/cluster/apps/authentik/helm-release.yaml

@@ -0,0 +1,44 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: authentik
+  namespace: identity-system
+spec:
+  interval: 1m0s
+  chart: 
+    spec:
+      # renovate: registryUrl=https://charts.goauthentik.io
+      chart: authentik
+      version: 2022.4.3
+      sourceRef:
+        kind: HelmRepository
+        name: authentik-charts
+        namespace: flux-system
+      interval: 5m
+  valuesFrom:
+    - kind: Secret
+      name: authentik
+      valuesKey: secret_key
+      targetPath: authentik.secret_key
+      optional: false
+  values:
+    authentik:
+      error_reporting:
+        enabled: true
+      postgresql:
+        host: "database.olympus"
+        name: "authentik"
+        user: "authentik"
+    redis:
+      enabled: true
+      architecture: standalone
+      auth:
+        enabled: false
+    ingress:
+      enabled: true
+      ingressClassName: "traefik"
+      hosts:
+        - host: id.0x76.dev
+          paths:
+            - path: "/"
+              pathType: Prefix

flux/cluster/apps/authentik/kustomization.yaml

@@ -1,2 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+resources:
+  - external-secret.yaml
+  - helm-release.yaml

nixos/hosts/nginx/configuration.nix

@@ -45,6 +45,7 @@ in
 
     # Kubernetes endpoints
     virtualHosts."0x76.dev" = k8s_proxy;
+    virtualHosts."id.0x76.dev" = k8s_proxy;
     virtualHosts."zookeeper.0x76.dev" = k8s_proxy;
     virtualHosts."wooloofan.club" = k8s_proxy;
     virtualHosts."whoami.wooloofan.club" = k8s_proxy;