mirror of
https://github.com/outbackdingo/homelab-v.git
synced 2026-08-25 14:53:19 +00:00
renovate[bot]andVegard Hagen
132df0aeda
chore(deps): update netbird chore(deps): update keycloak docker tag to v24.3.2 chore(deps): update ghcr.io/authelia/authelia docker tag to v4.38.18 chore(deps): update proxmox-csi-plugin docker tag to v0.3.1 chore(deps): update helm release argo-cd to v7.7.12
135 lines
4.0 KiB
YAML
135 lines
4.0 KiB
YAML
# https://github.com/authelia/chartrepo/blob/master/charts/authelia/values.yaml
|
|
image:
|
|
registry: ghcr.io
|
|
repository: authelia/authelia
|
|
tag: 4.38.18 # renovate: docker=ghcr.io/authelia/authelia
|
|
pullPolicy: IfNotPresent
|
|
|
|
pod:
|
|
kind: 'Deployment'
|
|
|
|
configMap:
|
|
default_2fa_method: totp
|
|
theme: 'dark'
|
|
|
|
identity_validation:
|
|
reset_password:
|
|
secret: { secret_name: crypto }
|
|
|
|
access_control:
|
|
default_policy: 'two_factor'
|
|
rules:
|
|
- domain_regex: '^.*\.stonegarden.dev$'
|
|
policy: 'two_factor'
|
|
|
|
session:
|
|
encryption_key: { secret_name: crypto }
|
|
cookies:
|
|
- subdomain: authelia
|
|
domain: stonegarden.dev
|
|
|
|
storage:
|
|
encryption_key: { secret_name: crypto }
|
|
postgres:
|
|
enabled: false
|
|
address: 'tcp://postgres.databases.svc.cluster.local:5432'
|
|
# Switch to Postgres later
|
|
local:
|
|
enabled: true
|
|
|
|
notifier:
|
|
filesystem:
|
|
enabled: true
|
|
|
|
authentication_backend:
|
|
ldap:
|
|
enabled: true
|
|
implementation: 'lldap'
|
|
address: 'ldap://lldap.lldap.svc.cluster.local'
|
|
base_dn: 'dc=stonegarden,dc=dev'
|
|
users_filter: '(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))'
|
|
additional_users_dn: 'ou=people'
|
|
groups_filter: '(member={dn})'
|
|
additional_groups_dn: 'ou=groups'
|
|
user: 'UID=authelia,OU=people,DC=stonegarden,DC=dev'
|
|
password: { secret_name: 'lldap-auth' }
|
|
|
|
identity_providers:
|
|
oidc:
|
|
## Currently in beta stage. See https://www.authelia.com/r/openid-connect/
|
|
enabled: true
|
|
hmac_secret: { secret_name: crypto }
|
|
jwks:
|
|
- key_id: 'default'
|
|
algorithm: 'RS256'
|
|
use: 'sig'
|
|
key: { path: /secrets/rsa-jwk/tls.key }
|
|
certificate_chain: { path: /secrets/rsa-jwk/tls.crt }
|
|
- key_id: 'ecdsa256'
|
|
algorithm: 'ES256'
|
|
use: 'sig'
|
|
key: { path: /secrets/ecdsa-jwk/tls.key }
|
|
certificate_chain: { path: /secrets/ecdsa-jwk/tls.crt }
|
|
cors:
|
|
allowed_origins_from_client_redirect_uris: true
|
|
clients:
|
|
- client_id: 'argocd'
|
|
client_secret:
|
|
path: '/secrets/oidc-argocd/clientSecret'
|
|
client_name: 'Argo CD'
|
|
public: false
|
|
authorization_policy: 'two_factor'
|
|
redirect_uris:
|
|
- 'https://argocd.stonegarden.dev/auth/callback'
|
|
- 'https://argocd.stonegarden.dev/applications'
|
|
scopes: [ 'openid', 'groups', 'email', 'profile' ]
|
|
userinfo_signed_response_alg: 'none'
|
|
id_token_signed_response_alg: 'ES256'
|
|
- client_id: 'argocd-cli'
|
|
client_name: 'Argo CD (CLI)'
|
|
public: true
|
|
authorization_policy: 'two_factor'
|
|
redirect_uris: [ 'http://localhost:8085/auth/callback' ]
|
|
scopes: [ 'openid', 'groups', 'email', 'profile', 'offline_access' ]
|
|
userinfo_signed_response_alg: 'none'
|
|
- client_id: kubectl
|
|
client_name: kubectl
|
|
public: true
|
|
authorization_policy: one_factor
|
|
redirect_uris: [ 'http://localhost:8000', 'http://localhost:18000' ]
|
|
scopes: [ 'openid', 'groups', 'email', 'profile', 'offline_access' ]
|
|
userinfo_signed_response_alg: 'none'
|
|
|
|
secret:
|
|
additionalSecrets:
|
|
lldap-auth:
|
|
items:
|
|
- key: password
|
|
path: authentication.ldap.password.txt
|
|
crypto:
|
|
items:
|
|
- key: identity_providers.oidc.hmac.key
|
|
path: identity_providers.oidc.hmac.key
|
|
- key: identity_validation.reset_password.jwt.hmac.key
|
|
path: identity_validation.reset_password.jwt.hmac.key
|
|
- key: session.encryption.key
|
|
path: session.encryption.key
|
|
- key: storage.encryption.key
|
|
path: storage.encryption.key
|
|
rsa-jwk:
|
|
items:
|
|
- key: tls.key
|
|
path: tls.key
|
|
- key: tls.crt
|
|
path: tls.crt
|
|
ecdsa-jwk:
|
|
items:
|
|
- key: tls.key
|
|
path: tls.key
|
|
- key: tls.crt
|
|
path: tls.crt
|
|
oidc-argocd:
|
|
items:
|
|
- key: clientSecret
|
|
path: clientSecret
|