feat: add Authelia OIDC provider (lldap backend, Immich client)

gitops/apps/authelia.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: authelia
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: git@github.com:swares/HomeLab.git
+    targetRevision: main
+    path: gitops/workloads/authelia
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: authelia
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

gitops/workloads/authelia/configmap.yaml

@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authelia-config
+  namespace: authelia
+data:
+  configuration.yml: |
+    server:
+      address: 'tcp://0.0.0.0:9091'
+
+    log:
+      level: info
+
+    authentication_backend:
+      ldap:
+        implementation: lldap
+        address: ldap://192.168.1.70:3890
+        base_dn: DC=lab,DC=home,DC=arpa
+        user: uid=admin,ou=people,dc=lab,dc=home,dc=arpa
+
+    session:
+      cookies:
+        - name: authelia_session
+          domain: lab.home.arpa
+          authelia_url: https://authelia.apps.lab.home.arpa
+          default_redirection_url: https://immich.apps.lab.home.arpa
+          expiration: 1h
+          inactivity: 5m
+
+    storage:
+      local:
+        path: /data/db.sqlite3
+
+    notifier:
+      filesystem:
+        filename: /data/notification.txt
+
+    access_control:
+      default_policy: one_factor
+
+    identity_providers:
+      oidc:
+        jwks:
+          - key_id: main
+            algorithm: RS256
+            use: sig
+            key: {{ secret "/run/secrets/oidc_private_key" | mindent 12 "|" | msquote }}
+        clients:
+          - client_id: immich
+            client_name: Immich
+            client_secret: {{ secret "/run/secrets/immich_client_secret" | msquote }}
+            redirect_uris:
+              - https://immich.apps.lab.home.arpa/auth/login
+              - https://immich.apps.lab.home.arpa/user-settings
+            scopes: [openid, profile, email]
+            response_types: [code]
+            grant_types: [authorization_code]
+            userinfo_signed_response_alg: none

gitops/workloads/authelia/deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authelia
+  namespace: authelia
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: authelia
+  template:
+    metadata:
+      labels:
+        app: authelia
+    spec:
+      containers:
+        - name: authelia
+          image: ghcr.io/authelia/authelia:4.38  # pin to a specific patch before shipping
+          args: [--config, /config/configuration.yml]
+          env:
+            - name: AUTHELIA_JWT_SECRET_FILE
+              value: /run/secrets/jwt_secret
+            - name: AUTHELIA_SESSION_SECRET_FILE
+              value: /run/secrets/session_secret
+            - name: AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE
+              value: /run/secrets/storage_encryption_key
+            - name: AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE
+              value: /run/secrets/oidc_hmac_secret
+            - name: AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE
+              value: /run/secrets/ldap_password
+          ports:
+            - containerPort: 9091
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: secrets
+              mountPath: /run/secrets
+              readOnly: true
+            - name: data
+              mountPath: /data
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 9091
+            initialDelaySeconds: 10
+            periodSeconds: 10
+      volumes:
+        - name: config
+          configMap:
+            name: authelia-config
+        - name: secrets
+          secret:
+            secretName: authelia-secrets
+        - name: data
+          persistentVolumeClaim:
+            claimName: authelia-data

gitops/workloads/authelia/ingress.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: authelia
+  namespace: authelia
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    cert-manager.io/cluster-issuer: lab-ca
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - authelia.apps.lab.home.arpa
+      secretName: authelia-tls
+  rules:
+    - host: authelia.apps.lab.home.arpa
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: authelia
+                port:
+                  number: 9091

gitops/workloads/authelia/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: authelia

gitops/workloads/authelia/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authelia-data
+  namespace: authelia
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 1Gi

gitops/workloads/authelia/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authelia
+  namespace: authelia
+spec:
+  selector:
+    app: authelia
+  ports:
+    - name: http
+      port: 9091
+      targetPort: 9091