From 6de089b26f162cf04e7c86f0720a83076bf43c7a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?c=C4=83t=C4=83lin?= <catalin@roboces.dev>
Date: Tue, 18 Aug 2026 11:11:23 +0200
Subject: [PATCH] feat: deploy authelia under auth.roboces.dev and auth.fuku

- Add ArgoCD app for official authelia helm chart under roboces project

- Add PVC, sealed secrets, and users database for authelia

- Add auth.fuku DNS rewrite in adguard tofu config
---
 k8s/argo-apps/authelia.yaml              | 79 ++++++++++++++++++++++++
 k8s/services/authelia/pvc.yaml           | 13 ++++
 k8s/services/authelia/sealedsecrets.yaml | 33 ++++++++++
 tofu/adguard/main.tf                     |  5 ++
 4 files changed, 130 insertions(+)
 create mode 100644 k8s/argo-apps/authelia.yaml
 create mode 100644 k8s/services/authelia/pvc.yaml
 create mode 100644 k8s/services/authelia/sealedsecrets.yaml

diff --git a/k8s/argo-apps/authelia.yaml b/k8s/argo-apps/authelia.yaml
new file mode 100644
index 0000000..a6207a8
--- /dev/null
+++ b/k8s/argo-apps/authelia.yaml
@@ -0,0 +1,79 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: authelia
+  namespace: argo-cd
+spec:
+  destination:
+    name: ''
+    namespace: apps-roboces
+    server: https://kubernetes.default.svc
+  sources:
+    - chart: authelia
+      repoURL: https://charts.authelia.com
+      targetRevision: 0.11.6
+      helm:
+        valuesObject:
+          enabled: true
+          pod:
+            kind: Deployment
+            replicas: 1
+          service:
+            type: ClusterIP
+          ingress:
+            enabled: true
+            className: traefik
+            annotations:
+              traefik.ingress.kubernetes.io/router.entrypoints: websecure
+              traefik.ingress.kubernetes.io/router.tls: "true"
+          secret:
+            existingSecret: secrets-authelia
+            additionalSecrets:
+              authelia-users:
+                path: users
+                items:
+                  - key: users_database.yml
+                    path: users_database.yml
+          persistence:
+            enabled: true
+            existingClaim: authelia-data
+          configMap:
+            log:
+              level: info
+            session:
+              name: authelia_session
+              same_site: lax
+              expiration: 1 hour
+              inactivity: 5 minutes
+              remember_me: 1 month
+              cookies:
+                - domain: roboces.dev
+                  subdomain: auth
+                  default_redirection_url: https://auth.roboces.dev
+                - domain: fuku
+                  subdomain: auth
+                  default_redirection_url: https://auth.fuku
+            authentication_backend:
+              file:
+                enabled: true
+                path: /secrets/users/users_database.yml
+                watch: false
+            storage:
+              local:
+                enabled: true
+                path: /config/db.sqlite3
+            notifier:
+              filesystem:
+                enabled: true
+                filename: /config/notification.txt
+            access_control:
+              default_policy: two_factor
+    - repoURL: https://git.roboces.dev/catalin/fukuops.git
+      path: k8s/services/authelia
+      targetRevision: feat/authelia
+  project: roboces
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
diff --git a/k8s/services/authelia/pvc.yaml b/k8s/services/authelia/pvc.yaml
new file mode 100644
index 0000000..84f9fee
--- /dev/null
+++ b/k8s/services/authelia/pvc.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authelia-data
+  namespace: apps-roboces
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: truenas-nfs-csi
+  resources:
+    requests:
+      storage: 1Gi
diff --git a/k8s/services/authelia/sealedsecrets.yaml b/k8s/services/authelia/sealedsecrets.yaml
new file mode 100644
index 0000000..284d75e
--- /dev/null
+++ b/k8s/services/authelia/sealedsecrets.yaml
@@ -0,0 +1,33 @@
+# yamllint disable rule:line-length
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp:
+  name: secrets-authelia
+  namespace: apps-roboces
+spec:
+  encryptedData:
+    identity_validation.reset_password.jwt.hmac.key: AgA/AUNGTlrmX3Zqv4jGo8bA5IeP+S9X+YviRx4GL/BMqQ/o+N9zes5AGTJ7/6WenEC2Q4uqAI+FvHv2nyrgxlfAXWPVnNn22Gxcg4RrxKLku6OjtzxMj37DCeaX/tX/f4wu6vWAyLWd4eaNFH7HD9o2i4gNPjGlU4elGiZBLdp0BzK3Xg5DAsyT6uuLybZc5SCtPgWjQWJTGIX5VnzdxkTULiJiI6rMWiY6gGfY5rFgdCgk2mBvcZJiOTXVnvalo2yyLvL4y8nqKGyQsxggsKxFIWz0iH4j96UDV93k+HfNJloBXgRgkHtf0l8USkyQF+Lk0p0qs5SIuUwfc+Q2s6dBPQwwIuXai42ZCsRINqTxlGWwFN9X/q8QbDDaosYgIsyUo9o9Nvr/yauqdkaoNsJsmM+/pjC3FWXXmfxRtuxYswKDGiV5RfUCz5nwcCuYSWzU0l+x4aohQ7TyfrnWzg519BpMqDcIXRx+j0kzmXznWMKrOPgDz3aHSU2hqilwX9Ty56vdD0Dp1jqTw9BgTgNmWqG28mVKYyHvEIgA3q1ipEiZhnrU71fy1mArAOE4ZEwK753vLIxjFBiXSCcum/gndQPNEa2E7e5ROzT/Z65mvcOr9NzW3/prCiKTe4PnhMKLB0Bb0dcJDt4n8ySEWkg4xGK2uwXd4B4p9cKEPv5NjFmCW1sEiNFX9YUBXH/tpV431weHQBhhb0QQv6cmlkPE2lRm5/9Rx8ycuCx1SmWNE8Xedi66zeyIdXiH6g==
+    session.encryption.key: AgCz2fGN8W6vQkK3+0buvzg1X60b5oi5EPzX6x+l2PGFbwsvGr2Xp4Yg2nQx82EovzUXSO9rTVDrGMgK4nvYoG9fIBmw9ZeYrdrJgxKPpU1zdL+nHLJX9x0mYGkFS0x/WDnhUX2w4/RBJBdIfOSDQCqE/eo79g/RyHfoLuUn+JEAnLVEy4JE9ODNGllqQGjni11/O7i/5eBsln2vSrOlyxR6RHr1I3oJ7EVoI+57MPO64kOsf5lW54EOn7GtVXWKiRgbhbAJC73ASagSGzE6eJwwlNlHQID1dGv0aS3fbQWfVluqrkLxmGKqEtflxrw3M/H+VNklRqrNNfoJ74lcIuLCTYFqttJfmZC3UufBVCkDfW4Hz2rE25u2KdmZpsEGemJVh1GFOWtByKuXnxOvGCKLtmacO83zG/4zdCv5wtKmD1n5FkL8FYV8c/C5oXZ7uozyNMczCyt2S/+M+3pWHdOJSLSRl1i9z0NnhbZr2yUF5p9O3cs/Ey6XC2qThr0tyrxRKbtGq9uos7ywovZpfy6vGGdf4tSyBK9lGK1MQqj4nko7SArRB8r6os3WbqHpNnLQnjUlSBTkdh94W8sbnPqs+Nzv1uRJT03R/Tfb0NG+Nudj03gF5jDSaT7MysKXMgsWjfQWt3lBmhLIZvNyvlTRnoGEuBtU1KlialPF9Ufn9j6L9lJR8px+uELqr1DccKDmJuj2nObfSUtLIaRMW4pmtq7LNVD/2S2yL32AGvNUmVUUoMrL7+SP8KL/ng==
+    storage.encryption.key: AgAO+MVcF4rrXTYGeKeRrShblkdYlr+RgPC3C2VABOCMgdncoxX04u0i5R7hUNSEWdATr33Rgw1zoFC6oWAjIA1vUAt1PXUfrRXV0/zXkn2Jt0SP39Gn9qMMT/8mBfnodc/kKWEvlQBPtrtbjldm8Nwkzlf4ho4XpDrQDuKmCwSZzq9JVtxc6B6o8iww5LGS7zNr0PPrkmAJHwGvqCZJ6oTO6Tz3RT78pe6qy9EdzBf2u4r5TQuMY5Q3Z+UDgkkHFOIdb5GfMq1S+pauUJwTWU45Y5iBgtnftu4qP4mEqlNXkmjypIX/QFCEh5mKAhOhNbY2cFj8PIcpuT9jaHKDEwYFMeYsDioR7VWLx0sSL19HjBphKvsngrVnS0tNfv+/Fmpay4ry9QmTDA0b8/bQsBcMpoiMHt83r6UtS+uGABxRd5lvBlMVNQqNiBhu0UsBBjl1kORDFhLDXBdoMZ00aYclL2rbzUZ23XRpptmuWmbFcJ4mTDTBjKndlzRb9DE7PQNETgHC2l4dW46yStV+aW3RgtNBfc10SuUQTgIwRm5PXsfzW9UfjfyyZhAgr+ilK63t7ezi+KXuXePJBdK/XSO8/RnKWvbZgn0L+kblrFJh2a9XrTOtweac5g1JlChFzDI8cVSpGh33ZNtHm1TLPLZnlWE2wTxDJQAnVMPvI3RmGSExYKZaswOrBHMZZp2rdPN4F5p0AupKyP8xXiRq8bebpJrDz1Ml6wCFEXijifndQH4RHi9ck2ajAhXGRw==
+  template:
+    metadata:
+      creationTimestamp:
+      name: secrets-authelia
+      namespace: apps-roboces
+    type: Opaque
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: authelia-users
+  namespace: apps-roboces
+spec:
+  encryptedData:
+    users_database.yml: AgBRURS/UJZutePGB/HkhuCXLeNDNa8BNKXbO2s96CuAZNW16MWWzwTYhuERhCnGTpctouLzYn1exg/ohKaf8R+OS6EGg9T45zBn4Nh510IQEIH+32EFg/9fC4AtLang9PPKVXmrSWvdFp6eS3k9PmlsaVA6AycxD6rNcBUpoQ89RYK3k/zRjsxm7Bb5aUIgrWLR5pc6QR/aOFMPBuXNLSSWs+WYYGSMcpw2qzsgwoQlpkP0U/7+gW1Tux/H52d6sj7Gxs2kni75EWpkK0hLs7FyYBDwXLKm/vWSfmWKQlE28RdnKyAl9R+rHc3JUXG1mWq76vRIYXfEtwHY0Scj8SGJgkORtpcBYlGBaocXpk9gz5zTfAgnQdUiRH1Ku9QF0jb6pgF9ZfYmJ9EpW7EpXPRa5SNAsZubuODTfYamRPftRBYETqplbmkR1quHsYDTXH3mD4OtSG0btRtFykZWk2+d6HsoBajy3Wc4srdI5xiXbjwCX2fUoRIpga7euYtlYaX7OJqpl1rNVqZtTLZ/S14ydXdjm7hFSe1vBiyMUVpj9qn38ZLD51MZC4pvkjcbIEJTC/bN9HCjgUxTUnr/BF5a3/XMa+GKn9G8VKCqQx7nKblCkYtgv8/StGmRPPnhqVwm5KH2GgJ8snjQFX5kNGcftwk2Za/7FSlGEO+Wbj6avUUvuIhUtt9g8Z7NqHfGsA31fJDhrKcE65vtkzuCpArE1BR9qe1FHkg/5tKtoacoeVWb2d//iWzyehAAGLHJJD5m8xSnCgQTZ/AhMhnopK26a4SLpmwnGsX6ASgXk/c5GMCOImjvhZ7nG8duXA43lQByE0EsidkwNt9D5lSIyJLSjZZf4wOFlvjV5HvXHkug3sMZMplhvV4KcY3dXJ6lRxN0+dfor14ggnXQ7O7x0H0nF16va28eOE3q6vpyMRj0ONMHaI5FG2/7353+AYSFfobRUkAo0Di2NDcfSPeYHxW3rrbV33iI8dDobQvY6L8IfnsiXE5BNYRJuGILMwklm1LiZ3Q/PNGByw==
+  template:
+    metadata:
+      name: authelia-users
+      namespace: apps-roboces
+    type: Opaque
diff --git a/tofu/adguard/main.tf b/tofu/adguard/main.tf
index 47f397b..29d4ac9 100644
--- a/tofu/adguard/main.tf
+++ b/tofu/adguard/main.tf
@@ -119,6 +119,11 @@ resource "adguard_rewrite" "pocketid" {
   answer = "192.168.1.12"
 }
 
+resource "adguard_rewrite" "authelia" {
+  domain = "auth.fuku"
+  answer = "192.168.1.12"
+}
+
 resource "adguard_rewrite" "dns" {
   domain = "dns.fuku"
   answer = "192.168.1.12"