feat: add audiobookshelf argo app

k8s/argo-apps/audiobookshelf.yaml

@@ -0,0 +1,78 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: audiobookshelf
+  namespace: argo-cd
+spec:
+  destination:
+    name: ''
+    namespace: apps-roboces
+    server: https://kubernetes.default.svc
+  sources:
+    - chart: audiobookshelf
+      repoURL: https://charts.christianhuth.de
+      targetRevision: 2.4.0
+      helm:
+        valuesObject:
+          service:
+            type: LoadBalancer
+          ingress:
+            enabled: true
+            className: traefik
+            annotations:
+              traefik.ingress.kubernetes.io/router.entrypoints: websecure
+              traefik.ingress.kubernetes.io/router.tls: "true"
+            hosts:
+              - host: audiobooks.roboces.dev
+                paths:
+                  - path: /
+                    pathType: Prefix
+              - host: audiobooks.fuku
+                paths:
+                  - path: /
+                    pathType: Prefix
+            tls: []
+          audiobookshelf:
+            timezone: Europe/Madrid
+            config:
+              persistence:
+                enabled: true
+                storageClassName: truenas-nfs-csi
+                accessModes:
+                  - ReadWriteMany
+                resources:
+                  requests:
+                    storage: 5Gi
+            metadata:
+              persistence:
+                enabled: true
+                storageClassName: truenas-nfs-csi
+                accessModes:
+                  - ReadWriteMany
+                resources:
+                  requests:
+                    storage: 20Gi
+            backup:
+              persistence:
+                enabled: true
+                storageClassName: truenas-nfs-csi
+                accessModes:
+                  - ReadWriteMany
+                resources:
+                  requests:
+                    storage: 20Gi
+            library:
+              persistence:
+                enabled: true
+                storageClassName: truenas-nfs-csi
+                accessModes:
+                  - ReadWriteMany
+                resources:
+                  requests:
+                    storage: 500Gi
+  project: roboces
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

k8s/argo-apps/authelia.yaml

@@ -53,6 +53,10 @@ spec:
                     path: smtp_password.txt
                   - key: storage.encryption.key
                     path: storage.encryption.key
+                  - key: oidc.audiobookshelf.client_secret
+                    path: oidc.audiobookshelf.client_secret
+                  - key: identity_providers.oidc.jwks.key.pem
+                    path: identity_providers.oidc.jwks.key.pem
           persistence:
             enabled: true
             existingClaim: authelia-data
@@ -118,9 +122,51 @@ spec:
                   minimum_version: TLS1.2
             access_control:
               default_policy: two_factor
+            identity_providers:
+              oidc:
+                enabled: true
+                hmac_secret:
+                  path: identity_providers.oidc.hmac.key
+                jwks:
+                  - key_id: authelia
+                    algorithm: RS256
+                    use: sig
+                    key:
+                      path: /secrets/secrets-authelia/identity_providers.oidc.jwks.key.pem
+                clients:
+                  - client_id: audiobookshelf
+                    client_name: Audiobookshelf
+                    client_secret:
+                      path: /secrets/secrets-authelia/oidc.audiobookshelf.client_secret
+                    public: false
+                    authorization_policy: two_factor
+                    require_pkce: true
+                    pkce_challenge_method: S256
+                    redirect_uris:
+                      - https://audiobooks.roboces.dev/auth/openid/callback
+                      - https://audiobooks.roboces.dev/auth/openid/mobile-redirect
+                      - https://audiobooks.roboces.dev/audiobookshelf/auth/openid/callback
+                      - https://audiobooks.roboces.dev/audiobookshelf/auth/openid/mobile-redirect
+                      - https://audiobooks.fuku/auth/openid/callback
+                      - https://audiobooks.fuku/auth/openid/mobile-redirect
+                      - https://audiobooks.fuku/audiobookshelf/auth/openid/callback
+                      - https://audiobooks.fuku/audiobookshelf/auth/openid/mobile-redirect
+                      - audiobookshelf://oauth
+                    scopes:
+                      - openid
+                      - profile
+                      - groups
+                      - email
+                    response_types:
+                      - code
+                    grant_types:
+                      - authorization_code
+                    access_token_signed_response_alg: none
+                    userinfo_signed_response_alg: none
+                    token_endpoint_auth_method: client_secret_basic
     - repoURL: https://git.roboces.dev/catalin/fukuops.git
       path: k8s/services/authelia
-      targetRevision: feat/authelia
+      targetRevision: main
   project: roboces
   syncPolicy:
     automated: