---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: authelia
  namespace: argo-cd
spec:
  destination:
    name: ''
    namespace: apps-roboces
    server: https://kubernetes.default.svc
  sources:
    - chart: authelia
      repoURL: https://charts.authelia.com
      targetRevision: 0.11.6
      helm:
        valuesObject:

          enabled: true
          pod:
            autoscaling:
              enabled: true
            kind: Deployment
            resources:
              requests:
                cpu: 100m
                memory: 128Mi
              limits:
                cpu: 1
                memory: 1024Mi
          service:
            type: LoadBalancer
          ingress:
            enabled: true
            className: traefik
            annotations:
              traefik.ingress.kubernetes.io/router.entrypoints: websecure
              traefik.ingress.kubernetes.io/router.tls: "true"
          secret:
            existingSecret: secrets-authelia
            mountPath: /secrets
            additionalSecrets:
              secrets-authelia:
                path: secrets-authelia
                items:
                  - key: authentication.ldap.password.txt
                    path: authentication.ldap.password.txt
                  - key: identity_validation.reset_password.jwt.hmac.key
                    path: identity_validation.reset_password.jwt.hmac.key
                  - key: session.encryption.key
                    path: session.encryption.key
                  - key: smtp_password.txt
                    path: smtp_password.txt
                  - key: storage.encryption.key
                    path: storage.encryption.key
          persistence:
            enabled: true
            existingClaim: authelia-data
          configMap:
            log:
              level: info
            session:
              name: authelia_session
              same_site: lax
              expiration: 1 hour
              inactivity: 5 minutes
              remember_me: 1 month
              cookies:
                - domain: roboces.dev
                  subdomain: auth
                - domain: auth.fuku
                  subdomain: ''
            authentication_backend:
              ldap:
                enabled: true
                implementation: lldap
                address: ldap://lldap.apps-fuku.svc.cluster.local:3890
                base_dn: dc=fuku,dc=local
                additional_users_dn: ou=people
                users_filter: (&({username_attribute}={input})(objectClass=person))
                additional_groups_dn: ou=groups
                groups_filter: (member={dn})
                user: uid=admin,ou=people,dc=fuku,dc=local
                attributes:
                  distinguished_name: dn
                  username: uid
                  display_name: cn
                  mail: mail
                  member_of: memberOf
                  group_name: cn
                password:
                  disabled: false
                  secret_name: secrets-authelia
                  path: authentication.ldap.password.txt
            storage:
              local:
                enabled: true
                path: /config/db.sqlite3
            notifier:
              smtp:
                enabled: true
                address: submissions://mail.fukurokuju.dev:465
                sender: Authelia <auth@fukurokuju.dev>
                subject: "Your verification code is {code}"
                identifier: auth.fuku
                startup_check_address: test@authelia.com
                disable_html_emails: false
                disable_require_tls: false
                disable_starttls: false
                username: auth@fukurokuju.dev
                password:
                  disabled: false
                  secret_name: secrets-authelia
                  path: smtp_password.txt
                tls:
                  server_name: mail.fukurokuju.dev
                  skip_verify: false
                  minimum_version: TLS1.2
            access_control:
              default_policy: two_factor
    - repoURL: https://git.roboces.dev/catalin/fukuops.git
      path: k8s/services/authelia
      targetRevision: feat/authelia
  project: roboces
  syncPolicy:
    automated:
      prune: true
      selfHeal: true