apiVersion: v1
kind: Namespace
metadata:
  name: admin
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: authelia-config
  namespace: admin
data:
  configuration.yml: |
    server:
      address: tcp://:9091
    theme: dark
    log:
      level: info
    authentication_backend:
      file:
        path: /config/users_database.yml
    password_policy:
      standard:
        enabled: true
        min_length: 12
    session:
      cookies:
        - domain: carr.pub
          authelia_url: https://auth.carr.pub
          default_redirection_url: https://admin.carr.pub
          same_site: lax
    storage:
      local:
        path: /config/data/db.sqlite3
    notifier:
      filesystem:
        filename: /config/data/notifications.txt
    totp:
      issuer: carr.pub
    webauthn:
      disable: true
    access_control:
      default_policy: one_factor
      rules: []
---
apiVersion: v1
kind: Secret
metadata:
  name: authelia-users
  namespace: admin
stringData:
  users_database.yml: |
    users:
      adamcarr:
        displayname: "Adam Carr"
        password: "<argon2-hash from configs/admin-password.txt via deploy script>"
        groups: ["admins"]
---
apiVersion: v1
kind: Secret
metadata:
  name: authelia-secrets
  namespace: admin
stringData:
  session-secret: <from configs/authelia-session-secret.txt>
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: authelia-data
  namespace: admin
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: local-path
  resources:
    requests: {storage: 2Gi}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: authelia
  namespace: admin
spec:
  replicas: 1
  selector:
    matchLabels: {app: authelia}
  template:
    metadata:
      labels: {app: authelia}
    spec:
      containers:
        - name: authelia
          image: authelia/authelia:v4.39.28
          args: ["--config", "/config/configuration.yml"]
          env:
            - name: AUTHELIA_SESSION_SECRET
              valueFrom: {secretKeyRef: {name: authelia-secrets, key: session-secret}}
          ports: [{containerPort: 9091}]
          resources:
            requests: {cpu: 50m, memory: 64Mi}
            limits: {memory: 256Mi}
          volumeMounts:
            - {name: config, mountPath: /config/configuration.yml, subPath: configuration.yml}
            - {name: users, mountPath: /config/users_database.yml, subPath: users_database.yml}
            - {name: data, mountPath: /config/data}
      volumes:
        - name: config
          configMap: {name: authelia-config}
        - name: users
          secret: {secretName: authelia-users}
        - name: data
          persistentVolumeClaim: {claimName: authelia-data}
---
apiVersion: v1
kind: Service
metadata:
  name: authelia
  namespace: admin
spec:
  selector: {app: authelia}
  ports:
    - port: 9091
      targetPort: 9091
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: authelia-auth
  namespace: admin
spec:
  forwardAuth:
    address: "http://authelia.admin.svc:9091/api/verify?rd=https://auth.carr.pub"
    trustForwardHeader: true
    authResponseHeaders: [Remote-User, Remote-Groups, Remote-Email, Remote-Name]