NyxErinys/Nix-Config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add authentik

Browse source
This commit is contained in:
NyxErinys 2026-06-13 03:27:22 -05:00
parent 1b2b582c80
commit 59f75e7d71
5 changed files with 252 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

234
modules/k3s/deployments/authentik.nix
View file

@ -1,31 +1,225 @@
{ ... }:
{ config, ... }:
let
authentik-version = "2026.5.0"
in
{
authentik.content = [
{
apiVersion = "v1";
kind = "Pod";
metadata.name = "ubuntu-test";
apiVersion = "apps/v1";
kind = "Deployment";
metadata = {
name = "authentik";
labels.app = "authentik";
};
spec = {
containers = [
{
name = "ubuntu-test";
image = "ubuntu:latest";
command = [ "tail" "-f" "/dev/null" ];
volumeMounts = [
selector.matchLabels.app = "authentik";
template = {
metadata = {
labels.app = "authentik";
};
spec = {
securityContext = {
runAsUser = 1000;
runAsGroup = 1000;
};
containers = [
{
mountPath = "/test";
name = "test";
subPath = "ubuntu-test";
name = "authentik-postgres";
image = "docker.io/library/postgres:16-alpine";
env = [
{
name = "POSTGRES_DB";
value = "authentik";
}
{
name = "POSTGRES_USER";
value = "authentik";
}
{
name = "POSTGRES_PASSWORD";
valueFrom.secretKeyRef = {
name = "authentik-secrets";
key = "pg_pass";
};
}
];
livenessProbe = {
exec.command = [ "pg_isready" "-d" "authentik" "-U" "authentik" ];
initialDelaySeconds = 20;
failureThreshold = 5;
periodSeconds = 30;
timeoutSeconds = 5;
};
ports = [
{
name = "test-port";
containerPort = 80;
}
];
volumeMounts = [
{
mountPath = "/var/lib/postgresql/data";
name = "iscsi";
subPath = "postgres";
}
];
}
{
name = "authentik-server";
image = "ghcr.io/goauthentik/server:${authentik-version}";
args = "server";
env = [
{
name = "AUTHENTIK_POSTGRESQL__HOST";
value = "127.0.0.1";
}
{
name = "AUTHENTIK_POSTGRESQL__NAME";
value = "authentik";
}
{
name = "AUTHENTIK_POSTGRESQL__USER";
value = "authentik";
}
{
name = "AUTHENTIK_POSTGRESQL__PASSWORD";
valueFrom.secretKeyRef = {
name = "authentik-secrets";
key = "pg_pass";
};
}
{
name = "AUTHENTIK_SECRET_KEY";
valueFrom.secretKeyRef = {
name = "authentik-secrets";
key = "authentik_secret_key";
};
}
];
ports = [
{
name = "server-http";
containerPort = 9000;
}
{
name = "server-https";
containerPort = 9443;
}
];
volumeMounts = [
{
mountPath = "/data";
name = "iscsi";
subPath = "server/data";
}
{
mountPath = "/templates";
name = "iscsi";
subPath = "server/templates";
}
{
mountPath = "/dev/shm";
name = "dshm";
}
];
}
{
name = "authentik-server";
image = "ghcr.io/goauthentik/server:${authentik-version}";
args = "worker";
env = [
{
name = "AUTHENTIK_POSTGRESQL__HOST";
value = "127.0.0.1";
}
{
name = "AUTHENTIK_POSTGRESQL__NAME";
value = "authentik";
}
{
name = "AUTHENTIK_POSTGRESQL__USER";
value = "authentik";
}
{
name = "AUTHENTIK_POSTGRESQL__PASSWORD";
valueFrom.secretKeyRef = {
name = "authentik-secrets";
key = "pg_pass";
};
}
{
name = "AUTHENTIK_SECRET_KEY";
valueFrom.secretKeyRef = {
name = "authentik-secrets";
key = "authentik_secret_key";
};
}
];
volumeMounts = [
{
mountPath = "/data";
name = "iscsi";
subPath = "worker/data";
}
{
mountPath = "/templates";
name = "iscsi";
subPath = "worker/templates";
}
{
mountPath = "/certs";
name = "iscsi";
subPath = "worker/certs";
}
{
mountPath = "/dev/shm";
name = "dshm";
}
];
}
];
}
];
volumes = [
volumes = [
{
name = "iscsi";
iscsi = {
targetPortal = "10.5.0.2:3260";
iqn = "iqn.2026-01.dev.nyxerinys:poseidon.authentik";
lun = 0;
fsType = "xfs";
readOnly = false;
};
}
{
name = "dshm";
emptyDir = {
medium = "Memory";
sizeLimit = "1Gi";
};
}
];
};
};
};
}
{
apiVersion = "v1";
kind = "Service";
metadata.name = "authentik";
spec = {
type = "NodePort";
selector.app = "authentik";
ports = [
{
name = "test";
persistentVolumeClaim = {
claimName = "nfs-main-pvc";
};
name = "authentik-http";
portocol = "TCP";
port = 9000;
nodePort = 30000;
}
{
name = "authentik-https";
portocol = "TCP";
port = 9443;
nodePort = 30001;
}
];
};