Nix-Config/modules/k3s/deployments/authentik.nix

{ ... }:
let
  authentik-version = "2026.5.0";
in
{
  authentik.content = [
    {
      apiVersion = "apps/v1";
      kind = "Deployment";
      metadata = {
        name = "authentik";
        labels.app = "authentik";
      };
      spec = {
        selector.matchLabels.app = "authentik";
        template = {
          metadata = {
            labels.app = "authentik";
          };
          spec = {
            securityContext = {
              runAsUser = 1000;
              runAsGroup = 1000;
            };
            containers = [
              {
                name = "authentik-postgres";
                image = "docker.io/library/postgres:16-alpine";
                env = [
                  {
                    name = "POSTGRES_DB";
                    value = "authentik";
                  }
                  {
                    name = "POSTGRES_USER";
                    value = "authentik";
                  }
                  {
                    name = "POSTGRES_PASSWORD";
                    valueFrom.secretKeyRef = {
                      name = "authentik-secrets";
                      key = "pg_pass";
                    };
                  }
                ];
                livenessProbe = {
                  exec.command = [ "pg_isready" "-d" "authentik" "-U" "authentik" ];
                  initialDelaySeconds = 20;
                  failureThreshold = 5;
                  periodSeconds = 30;
                  timeoutSeconds = 5;
                };
                ports = [
                  {
                    name = "test-port";
                    containerPort = 80; 
                  }
                ];
                volumeMounts = [
                  {
                    mountPath = "/var/lib/postgresql/data";
                    name = "iscsi";
                    subPath = "postgres";
                  }
                ];
              }
              {
                name = "authentik-server";
                image = "ghcr.io/goauthentik/server:${authentik-version}";
                args = [ "server" ];
                env = [
                  {
                    name = "AUTHENTIK_POSTGRESQL__HOST";
                    value = "127.0.0.1";
                  }
                  {
                    name = "AUTHENTIK_POSTGRESQL__NAME";
                    value = "authentik";
                  }
                  {
                    name = "AUTHENTIK_POSTGRESQL__USER";
                    value = "authentik";
                  }
                  {
                    name = "AUTHENTIK_POSTGRESQL__PASSWORD";
                    valueFrom.secretKeyRef = {
                      name = "authentik-secrets";
                      key = "pg_pass";
                    };
                  }
                  {
                    name = "AUTHENTIK_SECRET_KEY";
                    valueFrom.secretKeyRef = {
                      name = "authentik-secrets";
                      key = "authentik_secret_key";
                    };
                  }
                ];
                ports = [
                  {
                    name = "authentik-http";
                    containerPort = 9000; 
                  }
                  {
                    name = "authentik-https";
                    containerPort = 9443; 
                  }
                ];
                volumeMounts = [
                  {
                    mountPath = "/data";
                    name = "iscsi";
                    subPath = "server/data";
                  }
                  {
                    mountPath = "/templates";
                    name = "iscsi";
                    subPath = "server/templates";
                  }
                  {
                    mountPath = "/dev/shm";
                    name = "dshm";
                  }
                ];
              }
              {
                name = "authentik-worker";
                image = "ghcr.io/goauthentik/server:${authentik-version}";
                args = [ "worker" ];
                env = [
                  {
                    name = "AUTHENTIK_POSTGRESQL__HOST";
                    value = "127.0.0.1";
                  }
                  {
                    name = "AUTHENTIK_POSTGRESQL__NAME";
                    value = "authentik";
                  }
                  {
                    name = "AUTHENTIK_POSTGRESQL__USER";
                    value = "authentik";
                  }
                  {
                    name = "AUTHENTIK_POSTGRESQL__PASSWORD";
                    valueFrom.secretKeyRef = {
                      name = "authentik-secrets";
                      key = "pg_pass";
                    };
                  }
                  {
                    name = "AUTHENTIK_SECRET_KEY";
                    valueFrom.secretKeyRef = {
                      name = "authentik-secrets";
                      key = "authentik_secret_key";
                    };
                  }
                  {
                    name = "AUTHENTIK_LISTEN__HTTP";
                    value = "0.0.0.0:9001";
                  }
                  {
                    name = "AUTHENTIK_LISTEN__HTTPS";
                    value = "0.0.0.0:9444";
                  }
                  {
                    name = "AUTHENTIK_LISTEN__METRICS";
                    value = "0.0.0.0:9301";
                  }
                ];
                volumeMounts = [
                  {
                    mountPath = "/data";
                    name = "iscsi";
                    subPath = "worker/data";
                  }
                  {
                    mountPath = "/templates";
                    name = "iscsi";
                    subPath = "worker/templates";
                  }
                  {
                    mountPath = "/certs";
                    name = "iscsi";
                    subPath = "worker/certs";
                  }
                  {
                    mountPath = "/dev/shm";
                    name = "dshm";
                  }
                ];
              }
            ];
            volumes = [
              {
                name = "iscsi";
                iscsi = {
                  targetPortal = "10.5.0.2:3260";
                  iqn = "iqn.2026-01.dev.nyxerinys:poseidon.authentik";
                  lun = 0;
                  fsType = "xfs";
                  readOnly = false;
                };
              }
              {
                name = "dshm";
                emptyDir = {
                  medium = "Memory";
                  sizeLimit = "1Gi";
                };
              }
            ];
          };
        };
      };
    }
    {
      apiVersion = "v1";
      kind = "Service";
      metadata.name = "authentik";
      spec = {
        type = "NodePort";
        selector.app = "authentik";
        ports = [
          {
            name = "authentik-http";
            portocol = "TCP";
            port = 9000;
            nodePort = 30000;
          }
          {
            name = "authentik-https";
            portocol = "TCP";
            port = 9443;
            nodePort = 30001;
          }
        ];
      };
    }
  ];
}