feat: add k8s/argo-apps/authelia

- add scripts/users.py to manage users against lldap - add smtp values for lldap so it can send emails
2026-08-18 19:05:02 +02:00 · 2026-08-18 19:05:02 +02:00 · c9fcd56bda
commit c9fcd56bda
parent 98c165897d
8 changed files with 465 additions and 1 deletions
--- a/k8s/argo-apps/authelia.yaml
+++ b/k8s/argo-apps/authelia.yaml
@ -0,0 +1,128 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: authelia
+  namespace: argo-cd
+spec:
+  destination:
+    name: ''
+    namespace: apps-roboces
+    server: https://kubernetes.default.svc
+  sources:
+    - chart: authelia
+      repoURL: https://charts.authelia.com
+      targetRevision: 0.11.6
+      helm:
+        valuesObject:
+
+          enabled: true
+          pod:
+            autoscaling:
+              enabled: true
+            kind: Deployment
+            resources:
+              requests:
+                cpu: 100m
+                memory: 128Mi
+              limits:
+                cpu: 1
+                memory: 1024Mi
+          service:
+            type: LoadBalancer
+          ingress:
+            enabled: true
+            className: traefik
+            annotations:
+              traefik.ingress.kubernetes.io/router.entrypoints: websecure
+              traefik.ingress.kubernetes.io/router.tls: "true"
+          secret:
+            existingSecret: secrets-authelia
+            mountPath: /secrets
+            additionalSecrets:
+              secrets-authelia:
+                path: secrets-authelia
+                items:
+                  - key: authentication.ldap.password.txt
+                    path: authentication.ldap.password.txt
+                  - key: identity_validation.reset_password.jwt.hmac.key
+                    path: identity_validation.reset_password.jwt.hmac.key
+                  - key: session.encryption.key
+                    path: session.encryption.key
+                  - key: smtp_password.txt
+                    path: smtp_password.txt
+                  - key: storage.encryption.key
+                    path: storage.encryption.key
+          persistence:
+            enabled: true
+            existingClaim: authelia-data
+          configMap:
+            log:
+              level: info
+            session:
+              name: authelia_session
+              same_site: lax
+              expiration: 1 hour
+              inactivity: 5 minutes
+              remember_me: 1 month
+              cookies:
+                - domain: roboces.dev
+                  subdomain: auth
+                - domain: auth.fuku
+                  subdomain: ''
+            authentication_backend:
+              ldap:
+                enabled: true
+                implementation: lldap
+                address: ldap://lldap.apps-fuku.svc.cluster.local:3890
+                base_dn: dc=fuku,dc=local
+                additional_users_dn: ou=people
+                users_filter: (&({username_attribute}={input})(objectClass=person))
+                additional_groups_dn: ou=groups
+                groups_filter: (member={dn})
+                user: uid=admin,ou=people,dc=fuku,dc=local
+                attributes:
+                  distinguished_name: dn
+                  username: uid
+                  display_name: cn
+                  mail: mail
+                  member_of: memberOf
+                  group_name: cn
+                password:
+                  disabled: false
+                  secret_name: secrets-authelia
+                  path: authentication.ldap.password.txt
+            storage:
+              local:
+                enabled: true
+                path: /config/db.sqlite3
+            notifier:
+              smtp:
+                enabled: true
+                address: submissions://mail.fukurokuju.dev:465
+                sender: Authelia <auth@fukurokuju.dev>
+                subject: "Your verification code is {code}"
+                identifier: auth.fuku
+                startup_check_address: test@authelia.com
+                disable_html_emails: false
+                disable_require_tls: false
+                disable_starttls: false
+                username: auth@fukurokuju.dev
+                password:
+                  disabled: false
+                  secret_name: secrets-authelia
+                  path: smtp_password.txt
+                tls:
+                  server_name: mail.fukurokuju.dev
+                  skip_verify: false
+                  minimum_version: TLS1.2
+            access_control:
+              default_policy: two_factor
+    - repoURL: https://git.roboces.dev/catalin/fukuops.git
+      path: k8s/services/authelia
+      targetRevision: feat/authelia
+  project: roboces
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
--- a/k8s/services/authelia/pvc.yaml
+++ b/k8s/services/authelia/pvc.yaml
@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authelia-data
+  namespace: apps-roboces
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: truenas-nfs-csi
+  resources:
+    requests:
+      storage: 1Gi
--- a/k8s/services/authelia/sealedsecrets.yaml
+++ b/k8s/services/authelia/sealedsecrets.yaml
@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: secrets-authelia
+  namespace: apps-roboces
+spec:
+  encryptedData:
+    authentication.ldap.password.txt: AgBwsqdgEOQ8r/yUOD82Cwr44jxqV9RPDTzMYju8IfWx7b4iDKtZVidLK4RxBCp1+MPyWmLs7H4jec3Xsr10da/V+LaS1Elib+Sp2CkFZPGj1/XAcu5w3k/BnMcsRWJEJtzU251NVon6IVEzszcGOaVsPqf6aIvnKgOJEmp1boMlnemkvtaeXVS0TuSLXCQEMDfGMh9X8D9je315Sdqpczo8YLz6jyj6RxlgXeygRXkXANd2KFOyfLNUAnzm4Tl6PMjULnXvsxLhlc35+am6IsZGVLcdRMPY12UpHeZyVIgJBZSdo/gLTJS/hLhL2sPJv8HksL6YfvDnIWqu3PxVwI3BGtW2znBQaEIFXtOIXL9EDG0NMAZSBYCRpjrPNHP7xj7ruqjg4eU1iUj6yJpIv9322L/qhFWViK9wXc3+0L2n2q4qVBgrZxcacgqtHrCYj5Uo9iluVPWwagcKFYRXBupqaUUTso7LtSsv4WbOrJzYzE9mZk+feH1ZNvBp13JfWNdRiso5rpl0tZFJ7oW4G/CJuWg2MmL3UNViYB/ntwFWZWT8dxCEq2LI3UxeawHntzvk82kFyZduLUwhLvY4WfQB4yb//gBOpc0OyHa+djwECIyy3Jh+70LG+1YeVc8yQm52eu9+mzRSwDlqspKZYfwbMPCCiQj6AiSfg9Ho5+ITq1PgEt3oo9b0JkYFmEAgT88Y6z0DRQrM9YOXCfazMg==
+    identity_validation.reset_password.jwt.hmac.key: AgAQRknTOoC5tbCitLZkRtcIs3VOaubEvlhRmGtHh/OS0v6lgU2Gcl5C6jisu/+MqQba4euzMACLVgSMiEkERY2GrMijecfVf5LOkKKwQ0Xjiw4a+MlSVs5KR1Ovlz414//3GfUCttunnDRnH6xQbsQjWLCI6lv6Umb40TQHOnRmb83wmSkBa/P9WR35EQ6IcES3q7Ad4ZpNtLaavEnB8NuLZg3yaJpN+1yuZPeMgTPUtTG/e9FLdBs3S8AYFIcrUnDLViUo9DfXumMs1DlTsmABpjyIgjIeywOmCxMYZYvQCJrRGYlKZRdoCoafhAPxt67hdUYOe56cq3kqlTNTdURMbYup7cIkW2hQ8ZiyPvYk++RIhV/cPWOSjh6CLxMq26Si1c2Lg3aAVFxQcDiXbdprjHzbKzFfKO/5LVnhT7O651BqkCguPC2vVoaeuxblHjqouBD7ZmPazIQ9J/uDUmvm5UPjEN+Ln+enrLXdoJN9HMor410/PJ+9xPAHXhdrXRS6j5TlN5q1pz0gj2Qmnv3cunsyLo+ZJ97F3EkSYPVoK3sMXGn2fdKy/lc9vPMMvtH/tLdhWefxd25APahStZHv4Mb7O6Z+A4uFiP9Qao64jeLj08LWBbJPefT7Y+KthugN6cW4y/xQN4UFvpPHhGB36yb+45eIBzOJHltOqZ+wldjUHeBgMdkODAQYYbCzhDuVVm2iMGQqUi/Vk+EayaV70prcAELgRskseME2MwfrhYMAKS91tfMbL2dGTQ==
+    session.encryption.key: AgCjw3K7solE1INH+VIwEeP2U70HCaY25Iu6sq5C7j8nuW8JzbSCBPeY+qTS76l4sIyLlLekk7ke5kCPpZo+Jsz62UQJMGaSASRy0FKQIxgn5UIkObB+qziGjC8WNj6y/JmbvPNiIp+aw0Nd3OmVLRkvIjJDkyMf/iW1oGeLctwRop9Y+wi7lDPyEHH+CaNPCLYidhAJFG785qibqY8jTxtHsEts2T+hSXz75v5abYS+lTFtFV7RDWudkWG6dPjUKwYGw7l/yQm5p2qzzvhoyCrQItdNuEvGrZQsnXZlq4ik0C7t977uiU+fumYKFQvHzVuQTMjjo9G5AlhUG/4w2olMqOMZoJ0u+hHFBX1K1uYCUr1hd2343jd+y86iObZzTazlTGdP142lXk9+CT+akpQIVX0Mk5mwtemCYG+64ebSQm+SVB9Ffgxx3Ips6BOhqwIO0fLB1iz4BFVUp+87juyHZOP/5uC+KeV3+DHaQDrHRo6DxF5D5CRXBCcHXeWBLkDXSENgD4kvRee7fEQf60ajvi9VFTPjk86KXCbOZVlZPPrqWG7Dh+kaYOjWCQXQvFzYAq6/Dr5ZDRPJ/X989zHjPFFGRQ7Ol9uyjT/7I/2IBfdQB1Ep5BWty50PBVIqbYKRzQN0g0x5BAj5/2J9mOX/0BNGExVCNn53rfc8yDurfP0q1nbYk1t+fv0T9oI7RTPYIVWtUnshG8fwYK1PARNYBbKrGwjWtTdVxzV+ocunmmOHQhvOFrTnsfupGQ==
+    smtp_password.txt: AgB8pRbQxScSBRty04Z5oen7F52Y7PnwF9gJ6fdbUTRobE7j2fWiHMQk4l1FTztW3Muz3B/MQZBgBEzulpkDJ1TrvTe5I7JFdANr3lmlKjy0CG2NcQ7Vma7Bqu2SVnL8wxi/3IBTGxVa6bplGrkUCsIr/qWLhkVknOpAaUvOUuECT8PVxUZq/s4UMddkEf4N3IQW7j/60xwzomMp4e5eZ8YTH0/ZGcuw9JOQSOoJDzvJ5B+wZF7q7j9LQc4gBPHQiFFMVlZrhHA0fdjfPxbb7QEiGdMBxeZ0JqaaFBnr4FG7hRY5/H9RS9iZCFH9QY6X86ul9ZgiJYVyrvZFKSBsW+THlLZ7MACLvOs/zdXhpc2SthccoK8ykGC/inWTnfodQpH7N4zJq7akXxFy9/em4ssjWul4coeLNc+xhyi5VauLQQfRpgijc1kVJeQbrUrMe+aE1tlRdgRx76OKiFym1t47+zN3eqRf+NegNBGPSdAtKEBKfNPrcFQmlZVR6fRZqiBxG0wE90nfq9fuw3RDnVU/0LsuxwTz99gWMWl8ySuo+EAhf+JmB26/Pi1hnByeNeD8FsVkUiC6XnwAVC+ytnaVEfatrKmSJyzRhTSuFUoFxD5YV0aQgILks4+CpQwn300s0bqkLOP0etigZCCPq4cR+t+FFYAkuVjr+xPsoww0UOgokHsZKoXYi0n96UjbT0w+zoHhqQTBrPPWhPjDogZBKBCnth5eUtgrhSA2
+    storage.encryption.key: AgBt8lTRtRqn+PiTNjgmJ97/rEqKEE70KZLuVtyvBM2ek70E555vx16BsCN3ATvwcr5dw+nAwYKpHJzS+mgTloLWmz6L2HqtxhlnaKC7elFeOza7tPKmKeKV3zXQ8YEA9eWjKdUN2TzO5s10iPCp4esUy5asO5DS/QVyPHMUfufu3iwHCDgnDEGlQ0pO1LMT2FwJ2QYX4Cub+OjUVrkBm8VbNdFqIw3OBtahRX2gx+o1d55psfi08ylEMKUwkHXYtkBheDvYL7SRv8xHKHGrN1loWHZOby1GOTzOnOpL6mjJoU+4nlvEzVwxzuPOHDq24cfey7engu0IfrZ+9Fs+icFjInY7cpowlNl0CXIWQm++ljtKVOUGUB2Bp6IwY1iwu3NVlwYVoZRCfSw5rLhccXnODYjXGMAwHF1cau4K8mkx1mD48dJnQE+y6AfrOPH+tCJ0dSDyuebNNlcE9HDmJseIGDP37Z3E/S9CCGprvLCdUYeOhXERyTevm5VJoboYq1/mhonPvY0bU4w3zVV3mXgr3Xi4SOupneUL+XfuQASRz1eGoQpAGxI8h4qWkgA66f8uPTh0hdM1JfLus9oXCtFsiYJzd+VtIZE+0JtI4ztGtm2JtgH80t2eiJTQolQihfpAXazg9fQSPH6NHsFcRplqC7emxdBZnI2F+TSjqcoX+RA78z+J2OP4ISs4ngF8USmm9/rJIRUq26XNLMjktSREBh/IwrpZWgiZqU/QzMhNriClH3n4vDHWJ03Xiw==
+  template:
+    metadata:
+      name: secrets-authelia
+      namespace: apps-roboces
+    type: Opaque