homelab-v/k8s/infra/auth/authelia/values.yaml

# https://github.com/authelia/chartrepo/blob/master/charts/authelia/values.yaml
image:
  registry: ghcr.io
  repository: authelia/authelia
  tag: 4.39.10 # renovate: docker=ghcr.io/authelia/authelia
  pullPolicy: IfNotPresent

pod:
  kind: Deployment
  env:
    - name: TZ
      value: Europe/Oslo
    - name: AUTHELIA_NOTIFIER_SMTP_USERNAME
      valueFrom:
        secretKeyRef: { name: smtp-credentials, key: username }
  extraVolumeMounts:
    - name: consent
      mountPath: /config/assets/locales/en/consent.json
      subPath: consent.json
  extraVolumes:
    - name: consent
      configMap:
        defaultMode: 0644
        name: consent

configMap:
  default_2fa_method: totp
  theme: dark
  log:
    level: info

  telemetry:
    metrics:
      enabled: true
      port: 9959
      serviceMonitor:
        enabled: true

  access_control:
    default_policy: deny
    rules:
      - domain_regex: ^.*\.stonegarden.dev$
        policy: two_factor

  session:
    cookies: [ { domain: stonegarden.dev } ]

  server:
    asset_path: /config/assets/

  storage:
    postgres:
      enabled: true
      deploy: false
      address: tcp://authelia-postgres-rw:5432
      database: authelia
      username: authelia
      password: { secret_name: authelia-postgres-app }

  notifier:
    smtp:
      enabled: true
      address: smtp://smtp.mailersend.net:587
      sender: Authelia <[email protected]>
      disable_html_emails: false
      password: { secret_name: smtp-credentials }

  authentication_backend:
    ldap:
      enabled: true
      implementation: lldap
      address: ldaps://lldap.stonegarden.dev
      base_dn: DC=stonegarden,DC=dev
      user: UID=authelia,OU=people,DC=stonegarden,DC=dev
      password: { secret_name: lldap-credentials }
      attributes:
        extra:
          argocd: { multi_valued: true, value_type: string }
          audiobookshelf: { multi_valued: true, value_type: string }
          grafana: { multi_valued: true, value_type: string }

  identity_providers:
    oidc:
      ## Currently in beta stage. See https://www.authelia.com/r/openid-connect/
      enabled: true
      jwks:
        - key_id: default
          algorithm: RS256
          use: sig
          key: { path: /secrets/jwk-rsa/tls.key }
          certificate_chain: { path: /secrets/jwk-rsa/tls.crt }
        - key_id: ecdsa256
          algorithm: ES256
          use: sig
          key: { path: /secrets/jwk-ecdsa/tls.key }
          certificate_chain: { path: /secrets/jwk-ecdsa/tls.crt }
      cors:
        allowed_origins_from_client_redirect_uris: true
        endpoints: [ userinfo, authorization, token, revocation, introspection ]
      claims_policies:
        argocd_policy:
          custom_claims: { argocd_claim: { attribute: argocd } }
          # Argo CD requires the claims other than `groups` to be in the ID Token https://github.com/argoproj/argo-cd/issues/23768
          id_token: [ email, email_verified, alt_emails, name, preferred_username, argocd_claim ]
        audiobookshelf:
          custom_claims: { audiobookshelf: { attribute: audiobookshelf } }
        grafana:
          custom_claims: { grafana: { attribute: grafana } }
        legacy:
          # https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter
          id_token: [ email, email_verified, alt_emails, name, preferred_username, groups ]
        username_email:
          id_token: [ email, email_verified, alt_emails, name, preferred_username ]
      scopes:
        argocd_scope:
          claims: [ argocd_claim ]
        audiobookshelf:
          claims: [ audiobookshelf ]
        grafana:
          claims: [ grafana ]
      clients:
        - client_id: argocd
          client_secret: { path: /secrets/client-argocd/client_secret.txt }
          client_name: Argo CD
          public: false
          authorization_policy: two_factor
          claims_policy: argocd_policy
          pre_configured_consent_duration: 3 months
          require_pkce: false
          redirect_uris:
            - https://argocd.stonegarden.dev/auth/callback
            - https://argocd.stonegarden.dev/applications
          scopes: [ openid, email, profile, offline_access, argocd_scope ]
          grant_types: [ authorization_code, refresh_token ]
          userinfo_signed_response_alg: none
          id_token_signed_response_alg: ES256
          access_token_signed_response_alg: ES256

        - client_id: argocd-cli
          client_name: Argo CD (CLI)
          public: true
          authorization_policy: two_factor
          claims_policy: argocd_policy
          pre_configured_consent_duration: 3 months
          redirect_uris: [ http://localhost:8085/auth/callback ]
          scopes: [ openid, email, profile, offline_access, argocd_scope ]
          id_token_signed_response_alg: ES256
          access_token_signed_response_alg: ES256
          revocation_endpoint_auth_method: none
          introspection_endpoint_auth_method: none
          pushed_authorization_request_endpoint_auth_method: none

        - client_id: audiobookshelf
          client_secret: { path: /secrets/client-audiobookshelf/client_secret.txt }
          client_name: Audiobookshelf
          public: false
          authorization_policy: one_factor
          claims_policy: audiobookshelf
          pre_configured_consent_duration: 3 months
          require_pkce: true
          redirect_uris:
            - https://abs.stonegarden.dev/audiobookshelf/auth/openid/callback
            - https://abs.stonegarden.dev/audiobookshelf/auth/openid/mobile-redirect
            - audiobookshelf://oauth
          scopes: [ openid, email, profile, offline_access, audiobookshelf ]
          grant_types: [ authorization_code, refresh_token ]
          id_token_signed_response_alg: ES256
          access_token_signed_response_alg: ES256

        - client_id: grafana
          client_secret: { path: /secrets/client-grafana/client_secret.txt }
          client_name: Grafana
          public: false
          authorization_policy: two_factor
          claims_policy: grafana
          pre_configured_consent_duration: 3 months
          require_pkce: true
          pkce_challenge_method: S256
          redirect_uris: [ https://grafana.stonegarden.dev/login/generic_oauth ]
          scopes: [ openid, email, profile, offline_access, grafana ]
          response_types: [ code ]
          grant_types: [ authorization_code, refresh_token ]
          userinfo_signed_response_alg: none
          id_token_signed_response_alg: ES256
          access_token_signed_response_alg: ES256
          token_endpoint_auth_method: client_secret_basic

        - client_id: kubectl
          client_name: kubectl
          public: true
          authorization_policy: two_factor
          claims_policy: legacy
          pre_configured_consent_duration: 3 months
          require_pkce: true
          redirect_uris: [ http://localhost:8000, http://localhost:18000 ]
          scopes: [ openid, email, profile, offline_access, groups ]
          grant_types: [ authorization_code, refresh_token ]
          revocation_endpoint_auth_method: none
          introspection_endpoint_auth_method: none
          pushed_authorization_request_endpoint_auth_method: none

        - client_id: netbird
          client_secret: { path: /secrets/client-netbird/client_secret.txt }
          client_name: NetBird
          public: false
          authorization_policy: two_factor
          claims_policy: username_email
          pre_configured_consent_duration: 3 months
          require_pkce: true
          pkce_challenge_method: S256
          audience: [ netbird ]
          redirect_uris:
            - http://localhost:53000
            - https://netbird.stonegarden.dev/callback
            - https://netbird.stonegarden.dev/silent-callback
          scopes: [ openid, profile, email, offline_access ]
          grant_types: [ authorization_code, refresh_token ]
          token_endpoint_auth_method: client_secret_post

secret:
  existingSecret: crypto
  additionalSecrets:
    authelia-postgres-app:
      items: [ { key: password, path: storage.postgres.password.txt } ]
    lldap-credentials:
      items: [ { key: password, path: authentication.ldap.password.txt } ]
    smtp-credentials:
      items: [ { key: password, path: notifier.smtp.password.txt } ]
    jwk-rsa:
      items:
        - { key: tls.key, path: tls.key }
        - { key: tls.crt, path: tls.crt }
    jwk-ecdsa:
      items:
        - { key: tls.key, path: tls.key }
        - { key: tls.crt, path: tls.crt }
    client-argocd:
      items: [ { key: clientSecret, path: client_secret.txt } ]
    client-audiobookshelf:
      items: [ { key: clientSecret, path: client_secret.txt } ]
    client-grafana:
      items: [ { key: clientSecret, path: client_secret.txt } ]
    client-netbird:
      items: [ { key: clientSecret, path: client_secret.txt } ]