From 7a495bb6fd7f51576379dc94459a64b91df75f34 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Sun, 15 Mar 2026 00:19:31 +0100
Subject: [PATCH] Add authentik

---
 apps/templates/authentik-helm.yaml | 82 ++++++++++++++++++++++++++++++
 authentik/external-secret.yaml     | 29 +++++++++++
 2 files changed, 111 insertions(+)
 create mode 100644 apps/templates/authentik-helm.yaml
 create mode 100644 authentik/external-secret.yaml

diff --git a/apps/templates/authentik-helm.yaml b/apps/templates/authentik-helm.yaml
new file mode 100644
index 0000000..63e31f2
--- /dev/null
+++ b/apps/templates/authentik-helm.yaml
@@ -0,0 +1,82 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: authentik
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true
+  project: default
+  sources:
+    - chart: authentik
+      repoURL: https://charts.goauthentik.io
+      targetRevision: 2026.2.1
+      helm:
+        values: |
+          authentik:
+            secret_key: ""
+            bootstrap_password: ""
+            bootstrap_token: ""
+            postgresql:
+              password: ""
+          global:
+            env:
+              - name: AUTHENTIK_SECRET_KEY
+                valueFrom:
+                  secretKeyRef:
+                    name: authentik-secrets
+                    key: secret_key
+              - name: AUTHENTIK_BOOTSTRAP_PASSWORD
+                valueFrom:
+                  secretKeyRef:
+                    name: authentik-secrets
+                    key: bootstrap_password
+              - name: AUTHENTIK_BOOTSTRAP_TOKEN
+                valueFrom:
+                  secretKeyRef:
+                    name: authentik-secrets
+                    key: bootstrap_token
+          server:
+            ingress:
+              enabled: true
+              ingressClassName: nginx
+              annotations:
+                cert-manager.io/cluster-issuer: prod-cluster-issuer
+              hosts:
+                - authentik.rubenhensen.nl
+              tls:
+                - secretName: authentik-tls
+                  hosts:
+                    - authentik.rubenhensen.nl
+          postgresql:
+            enabled: true
+            auth:
+              password: ""
+              postgresPassword: ""
+            primary:
+              persistence:
+                storageClass: longhorn
+                size: 8Gi
+              existingSecret: authentik-secrets
+              existingSecretKey: postgres_password
+          redis:
+            enabled: true
+            master:
+              persistence:
+                storageClass: longhorn
+                size: 2Gi
+    - repoURL: https://github.com/rubenhensen/k8scd.git
+      targetRevision: HEAD
+      path: authentik
+      directory:
+        include: "*.yaml"
+        exclude: "authentik-helm.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: authentik
diff --git a/authentik/external-secret.yaml b/authentik/external-secret.yaml
new file mode 100644
index 0000000..b59d496
--- /dev/null
+++ b/authentik/external-secret.yaml
@@ -0,0 +1,29 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: authentik-secrets
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: authentik-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: secret_key
+      remoteRef:
+        key: kv/authentik
+        property: secret_key
+    - secretKey: bootstrap_password
+      remoteRef:
+        key: kv/authentik
+        property: bootstrap_password
+    - secretKey: bootstrap_token
+      remoteRef:
+        key: kv/authentik
+        property: bootstrap_token
+    - secretKey: postgres_password
+      remoteRef:
+        key: kv/authentik
+        property: postgres_password