add authentik

modules/k3s/default.nix

@@ -33,11 +33,23 @@ in
       openiscsi
     ];
     
-    sops.secrets.k3s_token = {
+    sops.secrets = {
-      format = "json";
+      k3s_token = {
-      key = "token";
+        format = "json";
-      sopsFile = "${inputs.secrets}/k3s.json";
+        key = "token";
-    };
+        sopsFile = "${inputs.secrets}/cluster/k3s.json";
+      };
+      pg_pass = {
+        format = "json";
+        key = "pg-pass";
+        sopsFile = "${inputs.secrets}/cluster/authentik.json";
+      };
+      authentik_secret_key = {
+        format = "json";
+        key = "authentik-secret-key";
+        sopsFile = "${inputs.secrets}/cluster/authentik.json";
+      };
+    }
     
     services.rpcbind.enable = true;
     services.k3s = {
@@ -49,14 +61,6 @@ in
       disable = [];
     };
 
-    # services.udev.packages = with pkgs; [
-    #   openiscsi
-    # ];
-
-    # services.udev.extraRules = ''
-    #   ACTION=="add", SUBSYSTEM=="scsi_host", KERNEL=="host*", RUN+="${pkgs.bash}/bin/sh -c 'echo - - - > /sys/class/scsi_host/%k/scan'"
-    # '';
-
     systemd.services.k3s = {
       restartTriggers = [
         (builtins.toJSON config.services.k3s.manifests)
@@ -66,10 +70,6 @@ in
       wants = [ "rpcbind.service" ];
       path = with pkgs; [
         openiscsi
-        # util-linux
-        # kmod
-        # systemd
-        # udev
       ];
     };
     

modules/k3s/deployments/authentik.nix

@@ -1,31 +1,225 @@
-{ ... }:
+{ config, ... }:
+let
+  authentik-version = "2026.5.0"
+in
 {
   authentik.content = [
     {
-      apiVersion = "v1";
+      apiVersion = "apps/v1";
-      kind = "Pod";
+      kind = "Deployment";
-      metadata.name = "ubuntu-test";
+      metadata = {
+        name = "authentik";
+        labels.app = "authentik";
+      };
       spec = {
-        containers = [
+        selector.matchLabels.app = "authentik";
-          {
+        template = {
-            name = "ubuntu-test";
+          metadata = {
-            image = "ubuntu:latest";
+            labels.app = "authentik";
-            command = [ "tail" "-f" "/dev/null" ];
+          };
-            volumeMounts = [
+          spec = {
+            securityContext = {
+              runAsUser = 1000;
+              runAsGroup = 1000;
+            };
+            containers = [
               {
-                mountPath = "/test";
+                name = "authentik-postgres";
-                name = "test";
+                image = "docker.io/library/postgres:16-alpine";
-                subPath = "ubuntu-test";
+                env = [
+                  {
+                    name = "POSTGRES_DB";
+                    value = "authentik";
+                  }
+                  {
+                    name = "POSTGRES_USER";
+                    value = "authentik";
+                  }
+                  {
+                    name = "POSTGRES_PASSWORD";
+                    valueFrom.secretKeyRef = {
+                      name = "authentik-secrets";
+                      key = "pg_pass";
+                    };
+                  }
+                ];
+                livenessProbe = {
+                  exec.command = [ "pg_isready" "-d" "authentik" "-U" "authentik" ];
+                  initialDelaySeconds = 20;
+                  failureThreshold = 5;
+                  periodSeconds = 30;
+                  timeoutSeconds = 5;
+                };
+                ports = [
+                  {
+                    name = "test-port";
+                    containerPort = 80; 
+                  }
+                ];
+                volumeMounts = [
+                  {
+                    mountPath = "/var/lib/postgresql/data";
+                    name = "iscsi";
+                    subPath = "postgres";
+                  }
+                ];
+              }
+              {
+                name = "authentik-server";
+                image = "ghcr.io/goauthentik/server:${authentik-version}";
+                args = "server";
+                env = [
+                  {
+                    name = "AUTHENTIK_POSTGRESQL__HOST";
+                    value = "127.0.0.1";
+                  }
+                  {
+                    name = "AUTHENTIK_POSTGRESQL__NAME";
+                    value = "authentik";
+                  }
+                  {
+                    name = "AUTHENTIK_POSTGRESQL__USER";
+                    value = "authentik";
+                  }
+                  {
+                    name = "AUTHENTIK_POSTGRESQL__PASSWORD";
+                    valueFrom.secretKeyRef = {
+                      name = "authentik-secrets";
+                      key = "pg_pass";
+                    };
+                  }
+                  {
+                    name = "AUTHENTIK_SECRET_KEY";
+                    valueFrom.secretKeyRef = {
+                      name = "authentik-secrets";
+                      key = "authentik_secret_key";
+                    };
+                  }
+                ];
+                ports = [
+                  {
+                    name = "server-http";
+                    containerPort = 9000; 
+                  }
+                  {
+                    name = "server-https";
+                    containerPort = 9443; 
+                  }
+                ];
+                volumeMounts = [
+                  {
+                    mountPath = "/data";
+                    name = "iscsi";
+                    subPath = "server/data";
+                  }
+                  {
+                    mountPath = "/templates";
+                    name = "iscsi";
+                    subPath = "server/templates";
+                  }
+                  {
+                    mountPath = "/dev/shm";
+                    name = "dshm";
+                  }
+                ];
+              }
+              {
+                name = "authentik-server";
+                image = "ghcr.io/goauthentik/server:${authentik-version}";
+                args = "worker";
+                env = [
+                  {
+                    name = "AUTHENTIK_POSTGRESQL__HOST";
+                    value = "127.0.0.1";
+                  }
+                  {
+                    name = "AUTHENTIK_POSTGRESQL__NAME";
+                    value = "authentik";
+                  }
+                  {
+                    name = "AUTHENTIK_POSTGRESQL__USER";
+                    value = "authentik";
+                  }
+                  {
+                    name = "AUTHENTIK_POSTGRESQL__PASSWORD";
+                    valueFrom.secretKeyRef = {
+                      name = "authentik-secrets";
+                      key = "pg_pass";
+                    };
+                  }
+                  {
+                    name = "AUTHENTIK_SECRET_KEY";
+                    valueFrom.secretKeyRef = {
+                      name = "authentik-secrets";
+                      key = "authentik_secret_key";
+                    };
+                  }
+                ];
+                volumeMounts = [
+                  {
+                    mountPath = "/data";
+                    name = "iscsi";
+                    subPath = "worker/data";
+                  }
+                  {
+                    mountPath = "/templates";
+                    name = "iscsi";
+                    subPath = "worker/templates";
+                  }
+                  {
+                    mountPath = "/certs";
+                    name = "iscsi";
+                    subPath = "worker/certs";
+                  }
+                  {
+                    mountPath = "/dev/shm";
+                    name = "dshm";
+                  }
+                ];
               }
             ];
-          }
+            volumes = [
-        ];
+              {
-        volumes = [
+                name = "iscsi";
+                iscsi = {
+                  targetPortal = "10.5.0.2:3260";
+                  iqn = "iqn.2026-01.dev.nyxerinys:poseidon.authentik";
+                  lun = 0;
+                  fsType = "xfs";
+                  readOnly = false;
+                };
+              }
+              {
+                name = "dshm";
+                emptyDir = {
+                  medium = "Memory";
+                  sizeLimit = "1Gi";
+                };
+              }
+            ];
+          };
+        };
+      };
+    }
+    {
+      apiVersion = "v1";
+      kind = "Service";
+      metadata.name = "authentik";
+      spec = {
+        type = "NodePort";
+        selector.app = "authentik";
+        ports = [
           {
-            name = "test";
+            name = "authentik-http";
-            persistentVolumeClaim = {
+            portocol = "TCP";
-              claimName = "nfs-main-pvc";
+            port = 9000;
-            };
+            nodePort = 30000;
+          }
+          {
+            name = "authentik-https";
+            portocol = "TCP";
+            port = 9443;
+            nodePort = 30001;
           }
         ];
       };

modules/k3s/deployments/ubuntu-test.nix

@@ -32,15 +32,6 @@
                     name = "test";
                     subPath = "ubuntu-test";
                   }
-                  {
-                    mountPath = "/test2";
-                    name = "iscsi";
-                  }
-                  {
-                    mountPath = "/test3";
-                    name = "iscsi";
-                    subPath = "test";
-                  }
                 ];
               }
             ];
@@ -51,16 +42,6 @@
                   claimName = "nfs-main-pvc";
                 };
               }
-              {
-                name = "iscsi";
-                iscsi = {
-                  targetPortal = "10.5.0.2:3260";
-                  iqn = "iqn.2026-01.dev.nyxerinys:poseidon.authentik";
-                  lun = 0;
-                  fsType = "xfs";
-                  readOnly = false;
-                };
-              }
             ];
           };
         };

modules/k3s/secrets.nix

@@ -0,0 +1,19 @@
+{ config, ... }:
+{
+  sops.templates = {
+     "authentik-secrets.yaml" = {
+      content = ''
+        apiVersion: v1
+        kind: Secret
+        metadata:
+          name: authentik-secrets
+          namespace: default
+        type: Opaque
+        stringData:
+          pg_pass: ${config.sops.placeholder."pg_pass"}
+          authentik_secret_key: ${config.sops.placeholder."authentik_secret_key"}
+      '';
+      path = "/var/lib/rancher/k3s/server/manifests/authentik-secrets.yaml";
+     }
+  };
+}

modules/nginx.nix

@@ -3,12 +3,12 @@
 {
   sops.secrets."CF_DNS_API_TOKEN" = {
     format = "json";
-    sopsFile = "${inputs.secrets}/nginx.json";
+    sopsFile = "${inputs.secrets}/mirror/nginx.json";
   };
 
   sops.secrets."CF_ZONE_API_TOKEN" = {
     format = "json";
-    sopsFile = "${inputs.secrets}/nginx.json";
+    sopsFile = "${inputs.secrets}/mirror/nginx.json";
   };
 
   sops.templates."ACME.env".content = ''