134 lines
3.1 KiB
YAML
134 lines
3.1 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: admin
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: authelia-config
|
|
namespace: admin
|
|
data:
|
|
configuration.yml: |
|
|
server:
|
|
address: tcp://:9091
|
|
theme: dark
|
|
log:
|
|
level: info
|
|
authentication_backend:
|
|
file:
|
|
path: /config/users_database.yml
|
|
password_policy:
|
|
standard:
|
|
enabled: true
|
|
min_length: 12
|
|
session:
|
|
cookies:
|
|
- domain: carr.pub
|
|
authelia_url: https://auth.carr.pub
|
|
default_redirection_url: https://admin.carr.pub
|
|
same_site: lax
|
|
storage:
|
|
local:
|
|
path: /config/data/db.sqlite3
|
|
notifier:
|
|
filesystem:
|
|
filename: /config/data/notifications.txt
|
|
totp:
|
|
issuer: carr.pub
|
|
webauthn:
|
|
disable: true
|
|
access_control:
|
|
default_policy: one_factor
|
|
rules: []
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: authelia-users
|
|
namespace: admin
|
|
stringData:
|
|
users_database.yml: |
|
|
users:
|
|
adamcarr:
|
|
displayname: "Adam Carr"
|
|
password: "<argon2-hash from configs/admin-password.txt via deploy script>"
|
|
groups: ["admins"]
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: authelia-secrets
|
|
namespace: admin
|
|
stringData:
|
|
session-secret: <from configs/authelia-session-secret.txt>
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: authelia-data
|
|
namespace: admin
|
|
spec:
|
|
accessModes: [ReadWriteOnce]
|
|
storageClassName: local-path
|
|
resources:
|
|
requests: {storage: 2Gi}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: authelia
|
|
namespace: admin
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels: {app: authelia}
|
|
template:
|
|
metadata:
|
|
labels: {app: authelia}
|
|
spec:
|
|
containers:
|
|
- name: authelia
|
|
image: authelia/authelia:v4.39.28
|
|
args: ["--config", "/config/configuration.yml"]
|
|
env:
|
|
- name: AUTHELIA_SESSION_SECRET
|
|
valueFrom: {secretKeyRef: {name: authelia-secrets, key: session-secret}}
|
|
ports: [{containerPort: 9091}]
|
|
resources:
|
|
requests: {cpu: 50m, memory: 64Mi}
|
|
limits: {memory: 256Mi}
|
|
volumeMounts:
|
|
- {name: config, mountPath: /config/configuration.yml, subPath: configuration.yml}
|
|
- {name: users, mountPath: /config/users_database.yml, subPath: users_database.yml}
|
|
- {name: data, mountPath: /config/data}
|
|
volumes:
|
|
- name: config
|
|
configMap: {name: authelia-config}
|
|
- name: users
|
|
secret: {secretName: authelia-users}
|
|
- name: data
|
|
persistentVolumeClaim: {claimName: authelia-data}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: authelia
|
|
namespace: admin
|
|
spec:
|
|
selector: {app: authelia}
|
|
ports:
|
|
- port: 9091
|
|
targetPort: 9091
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: authelia-auth
|
|
namespace: admin
|
|
spec:
|
|
forwardAuth:
|
|
address: "http://authelia.admin.svc:9091/api/verify?rd=https://auth.carr.pub"
|
|
trustForwardHeader: true
|
|
authResponseHeaders: [Remote-User, Remote-Groups, Remote-Email, Remote-Name]
|