Admin stack: Authelia SSO, portal at admin.carr.pub, gated grafana.carr.pub

manifests/admin/authelia.yaml

@@ -0,0 +1,133 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: admin
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authelia-config
+  namespace: admin
+data:
+  configuration.yml: |
+    server:
+      address: tcp://:9091
+    theme: dark
+    log:
+      level: info
+    authentication_backend:
+      file:
+        path: /config/users_database.yml
+    password_policy:
+      standard:
+        enabled: true
+        min_length: 12
+    session:
+      cookies:
+        - domain: carr.pub
+          authelia_url: https://auth.carr.pub
+          default_redirection_url: https://admin.carr.pub
+          same_site: lax
+    storage:
+      local:
+        path: /config/data/db.sqlite3
+    notifier:
+      filesystem:
+        filename: /config/data/notifications.txt
+    totp:
+      issuer: carr.pub
+    webauthn:
+      disable: true
+    access_control:
+      default_policy: one_factor
+      rules: []
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: authelia-users
+  namespace: admin
+stringData:
+  users_database.yml: |
+    users:
+      adamcarr:
+        displayname: "Adam Carr"
+        password: "<argon2-hash from configs/admin-password.txt via deploy script>"
+        groups: ["admins"]
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: authelia-secrets
+  namespace: admin
+stringData:
+  session-secret: <from configs/authelia-session-secret.txt>
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authelia-data
+  namespace: admin
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: local-path
+  resources:
+    requests: {storage: 2Gi}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authelia
+  namespace: admin
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: authelia}
+  template:
+    metadata:
+      labels: {app: authelia}
+    spec:
+      containers:
+        - name: authelia
+          image: authelia/authelia:v4.39.28
+          args: ["--config", "/config/configuration.yml"]
+          env:
+            - name: AUTHELIA_SESSION_SECRET
+              valueFrom: {secretKeyRef: {name: authelia-secrets, key: session-secret}}
+          ports: [{containerPort: 9091}]
+          resources:
+            requests: {cpu: 50m, memory: 64Mi}
+            limits: {memory: 256Mi}
+          volumeMounts:
+            - {name: config, mountPath: /config/configuration.yml, subPath: configuration.yml}
+            - {name: users, mountPath: /config/users_database.yml, subPath: users_database.yml}
+            - {name: data, mountPath: /config/data}
+      volumes:
+        - name: config
+          configMap: {name: authelia-config}
+        - name: users
+          secret: {secretName: authelia-users}
+        - name: data
+          persistentVolumeClaim: {claimName: authelia-data}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authelia
+  namespace: admin
+spec:
+  selector: {app: authelia}
+  ports:
+    - port: 9091
+      targetPort: 9091
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authelia-auth
+  namespace: admin
+spec:
+  forwardAuth:
+    address: "http://authelia.admin.svc:9091/api/verify?rd=https://auth.carr.pub"
+    trustForwardHeader: true
+    authResponseHeaders: [Remote-User, Remote-Groups, Remote-Email, Remote-Name]