cătălin
c98365c722- add scripts/users.py to manage users against lldap - add smtp values for lldap so it can send emails
128 lines
4.2 KiB
YAML
128 lines
4.2 KiB
YAML
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: authelia
|
|
namespace: argo-cd
|
|
spec:
|
|
destination:
|
|
name: ''
|
|
namespace: apps-roboces
|
|
server: https://kubernetes.default.svc
|
|
sources:
|
|
- chart: authelia
|
|
repoURL: https://charts.authelia.com
|
|
targetRevision: 0.11.6
|
|
helm:
|
|
valuesObject:
|
|
|
|
enabled: true
|
|
pod:
|
|
autoscaling:
|
|
enabled: true
|
|
kind: Deployment
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 1
|
|
memory: 1024Mi
|
|
service:
|
|
type: LoadBalancer
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
secret:
|
|
existingSecret: secrets-authelia
|
|
mountPath: /secrets
|
|
additionalSecrets:
|
|
secrets-authelia:
|
|
path: secrets-authelia
|
|
items:
|
|
- key: authentication.ldap.password.txt
|
|
path: authentication.ldap.password.txt
|
|
- key: identity_validation.reset_password.jwt.hmac.key
|
|
path: identity_validation.reset_password.jwt.hmac.key
|
|
- key: session.encryption.key
|
|
path: session.encryption.key
|
|
- key: smtp_password.txt
|
|
path: smtp_password.txt
|
|
- key: storage.encryption.key
|
|
path: storage.encryption.key
|
|
persistence:
|
|
enabled: true
|
|
existingClaim: authelia-data
|
|
configMap:
|
|
log:
|
|
level: info
|
|
session:
|
|
name: authelia_session
|
|
same_site: lax
|
|
expiration: 1 hour
|
|
inactivity: 5 minutes
|
|
remember_me: 1 month
|
|
cookies:
|
|
- domain: roboces.dev
|
|
subdomain: auth
|
|
- domain: auth.fuku
|
|
subdomain: ''
|
|
authentication_backend:
|
|
ldap:
|
|
enabled: true
|
|
implementation: lldap
|
|
address: ldap://lldap.apps-fuku.svc.cluster.local:3890
|
|
base_dn: dc=fuku,dc=local
|
|
additional_users_dn: ou=people
|
|
users_filter: (&({username_attribute}={input})(objectClass=person))
|
|
additional_groups_dn: ou=groups
|
|
groups_filter: (member={dn})
|
|
user: uid=admin,ou=people,dc=fuku,dc=local
|
|
attributes:
|
|
distinguished_name: dn
|
|
username: uid
|
|
display_name: cn
|
|
mail: mail
|
|
member_of: memberOf
|
|
group_name: cn
|
|
password:
|
|
disabled: false
|
|
secret_name: secrets-authelia
|
|
path: authentication.ldap.password.txt
|
|
storage:
|
|
local:
|
|
enabled: true
|
|
path: /config/db.sqlite3
|
|
notifier:
|
|
smtp:
|
|
enabled: true
|
|
address: submissions://mail.fukurokuju.dev:465
|
|
sender: Authelia <auth@fukurokuju.dev>
|
|
subject: "Your verification code is {code}"
|
|
identifier: auth.fuku
|
|
startup_check_address: test@authelia.com
|
|
disable_html_emails: false
|
|
disable_require_tls: false
|
|
disable_starttls: false
|
|
username: auth@fukurokuju.dev
|
|
password:
|
|
disabled: false
|
|
secret_name: secrets-authelia
|
|
path: smtp_password.txt
|
|
tls:
|
|
server_name: mail.fukurokuju.dev
|
|
skip_verify: false
|
|
minimum_version: TLS1.2
|
|
access_control:
|
|
default_policy: two_factor
|
|
- repoURL: https://git.roboces.dev/catalin/fukuops.git
|
|
path: k8s/services/authelia
|
|
targetRevision: feat/authelia
|
|
project: roboces
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|