feat: add k8s/argo-apps/authelia

- add scripts/users.py to manage users against lldap
- add smtp values for lldap so it can send emails

k8s/argo-apps/authelia.yaml

@@ -0,0 +1,128 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: authelia
+  namespace: argo-cd
+spec:
+  destination:
+    name: ''
+    namespace: apps-roboces
+    server: https://kubernetes.default.svc
+  sources:
+    - chart: authelia
+      repoURL: https://charts.authelia.com
+      targetRevision: 0.11.6
+      helm:
+        valuesObject:
+
+          enabled: true
+          pod:
+            autoscaling:
+              enabled: true
+            kind: Deployment
+            resources:
+              requests:
+                cpu: 100m
+                memory: 128Mi
+              limits:
+                cpu: 1
+                memory: 1024Mi
+          service:
+            type: LoadBalancer
+          ingress:
+            enabled: true
+            className: traefik
+            annotations:
+              traefik.ingress.kubernetes.io/router.entrypoints: websecure
+              traefik.ingress.kubernetes.io/router.tls: "true"
+          secret:
+            existingSecret: secrets-authelia
+            mountPath: /secrets
+            additionalSecrets:
+              secrets-authelia:
+                path: secrets-authelia
+                items:
+                  - key: authentication.ldap.password.txt
+                    path: authentication.ldap.password.txt
+                  - key: identity_validation.reset_password.jwt.hmac.key
+                    path: identity_validation.reset_password.jwt.hmac.key
+                  - key: session.encryption.key
+                    path: session.encryption.key
+                  - key: smtp_password.txt
+                    path: smtp_password.txt
+                  - key: storage.encryption.key
+                    path: storage.encryption.key
+          persistence:
+            enabled: true
+            existingClaim: authelia-data
+          configMap:
+            log:
+              level: info
+            session:
+              name: authelia_session
+              same_site: lax
+              expiration: 1 hour
+              inactivity: 5 minutes
+              remember_me: 1 month
+              cookies:
+                - domain: roboces.dev
+                  subdomain: auth
+                - domain: auth.fuku
+                  subdomain: ''
+            authentication_backend:
+              ldap:
+                enabled: true
+                implementation: lldap
+                address: ldap://lldap.apps-fuku.svc.cluster.local:3890
+                base_dn: dc=fuku,dc=local
+                additional_users_dn: ou=people
+                users_filter: (&({username_attribute}={input})(objectClass=person))
+                additional_groups_dn: ou=groups
+                groups_filter: (member={dn})
+                user: uid=admin,ou=people,dc=fuku,dc=local
+                attributes:
+                  distinguished_name: dn
+                  username: uid
+                  display_name: cn
+                  mail: mail
+                  member_of: memberOf
+                  group_name: cn
+                password:
+                  disabled: false
+                  secret_name: secrets-authelia
+                  path: authentication.ldap.password.txt
+            storage:
+              local:
+                enabled: true
+                path: /config/db.sqlite3
+            notifier:
+              smtp:
+                enabled: true
+                address: submissions://mail.fukurokuju.dev:465
+                sender: Authelia <auth@fukurokuju.dev>
+                subject: "Your verification code is {code}"
+                identifier: auth.fuku
+                startup_check_address: test@authelia.com
+                disable_html_emails: false
+                disable_require_tls: false
+                disable_starttls: false
+                username: auth@fukurokuju.dev
+                password:
+                  disabled: false
+                  secret_name: secrets-authelia
+                  path: smtp_password.txt
+                tls:
+                  server_name: mail.fukurokuju.dev
+                  skip_verify: false
+                  minimum_version: TLS1.2
+            access_control:
+              default_policy: two_factor
+    - repoURL: https://git.roboces.dev/catalin/fukuops.git
+      path: k8s/services/authelia
+      targetRevision: feat/authelia
+  project: roboces
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true