From cc39cb513dcf091c3fd4351346b2f3821ba2d52c Mon Sep 17 00:00:00 2001 From: Scott Wares Date: Sun, 28 Jun 2026 22:00:09 +0000 Subject: [PATCH] feat: add Authelia OIDC provider (lldap backend, Immich client) --- gitops/apps/authelia.yaml | 20 ++++++++ gitops/workloads/authelia/configmap.yaml | 58 +++++++++++++++++++++++ gitops/workloads/authelia/deployment.yaml | 56 ++++++++++++++++++++++ gitops/workloads/authelia/ingress.yaml | 26 ++++++++++ gitops/workloads/authelia/namespace.yaml | 4 ++ gitops/workloads/authelia/pvc.yaml | 11 +++++ gitops/workloads/authelia/service.yaml | 12 +++++ 7 files changed, 187 insertions(+) create mode 100644 gitops/apps/authelia.yaml create mode 100644 gitops/workloads/authelia/configmap.yaml create mode 100644 gitops/workloads/authelia/deployment.yaml create mode 100644 gitops/workloads/authelia/ingress.yaml create mode 100644 gitops/workloads/authelia/namespace.yaml create mode 100644 gitops/workloads/authelia/pvc.yaml create mode 100644 gitops/workloads/authelia/service.yaml diff --git a/gitops/apps/authelia.yaml b/gitops/apps/authelia.yaml new file mode 100644 index 0000000..b447824 --- /dev/null +++ b/gitops/apps/authelia.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: authelia + namespace: argocd +spec: + project: default + source: + repoURL: git@github.com:swares/HomeLab.git + targetRevision: main + path: gitops/workloads/authelia + destination: + server: https://kubernetes.default.svc + namespace: authelia + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops/workloads/authelia/configmap.yaml b/gitops/workloads/authelia/configmap.yaml new file mode 100644 index 0000000..646989d --- /dev/null +++ b/gitops/workloads/authelia/configmap.yaml @@ -0,0 +1,58 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: authelia-config + namespace: authelia +data: + configuration.yml: | + server: + address: 'tcp://0.0.0.0:9091' + + log: + level: info + + authentication_backend: + ldap: + implementation: lldap + address: ldap://192.168.1.70:3890 + base_dn: DC=lab,DC=home,DC=arpa + user: uid=admin,ou=people,dc=lab,dc=home,dc=arpa + + session: + cookies: + - name: authelia_session + domain: lab.home.arpa + authelia_url: https://authelia.apps.lab.home.arpa + default_redirection_url: https://immich.apps.lab.home.arpa + expiration: 1h + inactivity: 5m + + storage: + local: + path: /data/db.sqlite3 + + notifier: + filesystem: + filename: /data/notification.txt + + access_control: + default_policy: one_factor + + identity_providers: + oidc: + jwks: + - key_id: main + algorithm: RS256 + use: sig + key: {{ secret "/run/secrets/oidc_private_key" | mindent 12 "|" | msquote }} + clients: + - client_id: immich + client_name: Immich + client_secret: {{ secret "/run/secrets/immich_client_secret" | msquote }} + redirect_uris: + - https://immich.apps.lab.home.arpa/auth/login + - https://immich.apps.lab.home.arpa/user-settings + scopes: [openid, profile, email] + response_types: [code] + grant_types: [authorization_code] + userinfo_signed_response_alg: none diff --git a/gitops/workloads/authelia/deployment.yaml b/gitops/workloads/authelia/deployment.yaml new file mode 100644 index 0000000..e912236 --- /dev/null +++ b/gitops/workloads/authelia/deployment.yaml @@ -0,0 +1,56 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: authelia + namespace: authelia +spec: + replicas: 1 + selector: + matchLabels: + app: authelia + template: + metadata: + labels: + app: authelia + spec: + containers: + - name: authelia + image: ghcr.io/authelia/authelia:4.38 # pin to a specific patch before shipping + args: [--config, /config/configuration.yml] + env: + - name: AUTHELIA_JWT_SECRET_FILE + value: /run/secrets/jwt_secret + - name: AUTHELIA_SESSION_SECRET_FILE + value: /run/secrets/session_secret + - name: AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE + value: /run/secrets/storage_encryption_key + - name: AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE + value: /run/secrets/oidc_hmac_secret + - name: AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE + value: /run/secrets/ldap_password + ports: + - containerPort: 9091 + volumeMounts: + - name: config + mountPath: /config + - name: secrets + mountPath: /run/secrets + readOnly: true + - name: data + mountPath: /data + readinessProbe: + httpGet: + path: /api/health + port: 9091 + initialDelaySeconds: 10 + periodSeconds: 10 + volumes: + - name: config + configMap: + name: authelia-config + - name: secrets + secret: + secretName: authelia-secrets + - name: data + persistentVolumeClaim: + claimName: authelia-data diff --git a/gitops/workloads/authelia/ingress.yaml b/gitops/workloads/authelia/ingress.yaml new file mode 100644 index 0000000..150bfff --- /dev/null +++ b/gitops/workloads/authelia/ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: authelia + namespace: authelia + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: web,websecure + traefik.ingress.kubernetes.io/router.tls: "true" + cert-manager.io/cluster-issuer: lab-ca +spec: + ingressClassName: traefik + tls: + - hosts: + - authelia.apps.lab.home.arpa + secretName: authelia-tls + rules: + - host: authelia.apps.lab.home.arpa + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: authelia + port: + number: 9091 diff --git a/gitops/workloads/authelia/namespace.yaml b/gitops/workloads/authelia/namespace.yaml new file mode 100644 index 0000000..6c48a0b --- /dev/null +++ b/gitops/workloads/authelia/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: authelia diff --git a/gitops/workloads/authelia/pvc.yaml b/gitops/workloads/authelia/pvc.yaml new file mode 100644 index 0000000..54855f6 --- /dev/null +++ b/gitops/workloads/authelia/pvc.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: authelia-data + namespace: authelia +spec: + accessModes: [ReadWriteOnce] + storageClassName: local-path + resources: + requests: + storage: 1Gi diff --git a/gitops/workloads/authelia/service.yaml b/gitops/workloads/authelia/service.yaml new file mode 100644 index 0000000..47ee1e4 --- /dev/null +++ b/gitops/workloads/authelia/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: authelia + namespace: authelia +spec: + selector: + app: authelia + ports: + - name: http + port: 9091 + targetPort: 9091