Admin stack: Authelia SSO, portal at admin.carr.pub, gated grafana.carr.pub

scripts/deploy-admin.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Redeploy the admin stack (Authelia SSO + portal). Secrets are regenerated
+# from the gitignored files in configs/ so nothing sensitive is committed.
+# First-time setup: run scripts/gen-admin-secrets.sh before this.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+HASH=$(/tmp/opencode/authelia/authelia crypto hash generate argon2 \
+        --password "$(cat configs/admin-password.txt)" 2>/dev/null | grep -o '\$argon2id\$.*')
+SESSION=$(cat configs/authelia-session-secret.txt)
+JWT=$(cat configs/authelia-jwt-secret.txt)
+ENCKEY=$(openssl rand -base64 24 | tr -d "=+/" | cut -c1-32)
+
+export HASH SESSION JWT ENCKEY
+for f in manifests/admin/*.yaml; do
+  envsubst '\$HASH \$SESSION \$JWT \$ENCKEY' < "$f" | kubectl apply -f -
+done
+
+kubectl -n admin set env deployment/authelia \
+  AUTHELIA_SESSION_SECRET="$SESSION" \
+  AUTHELIA_STORAGE_ENCRYPTION_KEY="$ENCKEY" \
+  AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET="$JWT" \
+  >/dev/null
+echo "admin stack deployed"