feat: Added authelia

apps/artifacts.yaml

@@ -19,3 +19,8 @@ spec:
       copy:
         - from: "@foundation/apps/lldap/**"
           to: "@artifact/"
+    - name: authelia
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/apps/authelia/**"
+          to: "@artifact/"

apps/authelia/authelia.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: authelia
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  dependsOn:
+    - name: cnpg
+    - name: lldap-controller
+    - name: dragonfly-operator
+  sourceRef:
+    kind: ExternalArtifact
+    name: authelia
+  path: ./${cluster_env}
+  prune: true
+  wait: true

apps/authelia/base/cluster-restore.yaml

@@ -0,0 +1,16 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+spec:
+  bootstrap:
+    recovery:
+      source: source
+  externalClusters:
+    - name: source
+      plugin:
+        name: barman-cloud.cloudnative-pg.io
+        parameters:
+          barmanObjectName: garage-store
+          serverName: db
+  plugins: []

apps/authelia/base/cluster.yaml

@@ -0,0 +1,15 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+  namespace: authelia
+  # TODO: Add labels?
+spec:
+  storage:
+    size: 8Gi
+    storageClass: local-path
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: garage-store

apps/authelia/base/helm-release.yaml

@@ -0,0 +1,29 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: authelia
+  namespace: authelia
+spec:
+  interval: 12h
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 2m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 3m
+  chart:
+    spec:
+      chart: authelia
+      version: "0.10.x"
+      sourceRef:
+        kind: HelmRepository
+        name: authelia
+      interval: 24h
+  valuesFrom:
+    - kind: ConfigMap
+      name: values-base
+    - kind: ConfigMap
+      name: values-overlay
+      optional: true

apps/authelia/base/helm-repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: authelia
+  namespace: authelia
+spec:
+  interval: 24h
+  url: https://charts.authelia.com

apps/authelia/base/kustomization.yaml

@@ -0,0 +1,25 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - cluster.yaml
+  - service-user.yaml
+  - helm-repository.yaml
+  - helm-release.yaml
+  - secret-s3-garage.yaml
+  - object-store.yaml
+
+configurations:
+  - name-reference.yaml
+
+configMapGenerator:
+  - name: values-base
+    namespace: authelia
+    files:
+      - values.yaml
+
+# Uncomment to restore database from backup
+# patches:
+#   - path: cluster-restore.yaml
+#     target:
+#       kind: Cluster

apps/authelia/base/name-reference.yaml

@@ -0,0 +1,6 @@
+nameReference:
+  - kind: ConfigMap
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

apps/authelia/base/namespace.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: authelia
+  namespace: authelia

apps/authelia/base/object-store.yaml

@@ -0,0 +1,20 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: garage-store
+  namespace: authelia
+spec:
+  configuration:
+    destinationPath: s3://cnpg-backup/authelia
+    s3Credentials:
+      accessKeyId:
+        name: s3-garage
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: s3-garage
+        key: ACCESS_SECRET_KEY
+      region:
+        name: s3-garage
+        key: REGION
+    wal:
+      compression: gzip

apps/authelia/base/secret-s3-garage.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-garage
+  namespace: authelia
+  annotations:
+    reflector.v1.k8s.emberstack.com/reflects: "cnpg-system/s3-garage"
+type: Opaque
+data: {}

apps/authelia/base/service-user.yaml

@@ -0,0 +1,6 @@
+apiVersion: lldap.huizinga.dev/v1
+kind: ServiceUser
+metadata:
+  name: authelia
+  namespace: authelia
+spec: {}

apps/authelia/base/values.yaml

@@ -0,0 +1,61 @@
+pod:
+  kind: Deployment
+  replicas: 2
+ingress:
+  enabled: true
+  gatewayAPI:
+    enabled: true
+    parentRefs:
+      - name: gateway
+        namespace: default
+
+secret:
+  additionalSecrets:
+    db-app:
+      key: db-app
+    authelia-lldap-credentials:
+      key: authelia-lldap-credentials
+
+configMap:
+  authentication_backend:
+    ldap:
+      enabled: true
+      implementation: lldap
+      address: ldap://lldap.lldap.svc.cluster.local:3890
+      base_dn: dc=huizinga,dc=dev
+      additional_users_dn: ou=people
+      users_filter: "(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))"
+      additional_groups_dn: ou=groups
+      groups_filter: "(member={dn})"
+      attributes:
+        display_name: displayName
+        username: uid
+        group_name: cn
+        mail: mail
+      user: uid=authelia.authelia,ou=people,dc=huizinga,dc=dev
+      password:
+        secret_name: authelia-lldap-credentials
+        path: password
+
+  session:
+    redis:
+      enabled: true
+      host: dragonfly.authelia
+
+  storage:
+    postgres:
+      enabled: true
+      address: tcp://db-rw.authelia:5432
+      database: app
+      username: app
+      password:
+        secret_name: db-app
+        path: password
+
+  notifier:
+    filesystem:
+      enabled: true
+
+  # access_control:
+  #   secret:
+  #     existingSecret: authelia-acl

apps/authelia/production/cluster.yaml

@@ -0,0 +1,6 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+spec:
+  instances: 2

apps/authelia/production/dragonfly.yaml

@@ -0,0 +1,6 @@
+apiVersion: dragonflydb.io/v1alpha1
+kind: Dragonfly
+metadata:
+  name: dragonfly
+spec:
+  replicas: 2

apps/authelia/production/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - dragonfly.yaml
+
+patches:
+  - path: cluster.yaml
+    target:
+      kind: Cluster
+
+configMapGenerator:
+  - name: values-overlay
+    namespace: authelia
+    files:
+      - values.yaml

apps/authelia/production/values.yaml

@@ -0,0 +1,8 @@
+pod:
+  replicas: 2
+
+configMap:
+  session:
+    cookies:
+      - subdomain: auth
+        domain: huizinga.dev

apps/authelia/staging/cluster.yaml

@@ -0,0 +1,6 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+spec:
+  instances: 1

apps/authelia/staging/dragonfly.yaml

@@ -0,0 +1,6 @@
+apiVersion: dragonflydb.io/v1alpha1
+kind: Dragonfly
+metadata:
+  name: dragonfly
+spec:
+  replicas: 1

apps/authelia/staging/kustomization.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - dragonfly.yaml
+
+patches:
+  - path: cluster.yaml
+    target:
+      kind: Cluster
+  - path: object-store.yaml
+    target:
+      kind: ObjectStore
+
+configMapGenerator:
+  - name: values-overlay
+    namespace: authelia
+    files:
+      - values.yaml

apps/authelia/staging/object-store.yaml

@@ -0,0 +1,8 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: garage-store
+  namespace: lldap
+spec:
+  configuration:
+    endpointURL: http://192.168.1.1:3900

apps/authelia/staging/values.yaml

@@ -0,0 +1,11 @@
+pod:
+  replicas: 1
+
+configMap:
+  log:
+    level: debug
+
+  session:
+    cookies:
+      - subdomain: auth
+        domain: staging.huizinga.dev

clusters/testing/kustomization.yaml

@@ -22,3 +22,4 @@ resources:
   - ../../apps/artifacts.yaml
   - ../../apps/spegel/spegel.yaml
   - ../../apps/lldap/lldap.yaml
+  - ../../apps/authelia/authelia.yaml