# Authentik configuration
authentik:
  secret_key: env://AUTHENTIK_SECRET_KEY
  postgresql:
    host: env://AUTHENTIK_POSTGRESQL__HOST
    port: 5432
    name: env://AUTHENTIK_POSTGRESQL__NAME
    user: env://AUTHENTIK_POSTGRESQL__USER
    password: env://AUTHENTIK_POSTGRESQL__PASSWORD

global:
  envFrom:
    # First secret: Authentik-specific settings (AUTHENTIK_SECRET_KEY)
    - secretRef:
        name: authentik
    # Second secret: Database credentials from CNPG
    - secretRef:
        name: pg-authentik-app
      prefix: AUTHENTIK_POSTGRESQL__
  env:
    # Configure external URL for proper OIDC discovery responses
    - name: AUTHENTIK_URL
      value: "https://auth.kube.huskypup.net"
    # Override to use the correct field names from pg-authentik-app
    - name: AUTHENTIK_POSTGRESQL__HOST
      valueFrom:
        secretKeyRef:
          name: pg-authentik-app
          key: host
    - name: AUTHENTIK_POSTGRESQL__NAME
      valueFrom:
        secretKeyRef:
          name: pg-authentik-app
          key: dbname
    - name: AUTHENTIK_POSTGRESQL__USER
      valueFrom:
        secretKeyRef:
          name: pg-authentik-app
          key: username
    - name: AUTHENTIK_POSTGRESQL__PASSWORD
      valueFrom:
        secretKeyRef:
          name: pg-authentik-app
          key: password
    - name: AUTHENTIK_POSTGRESQL__PORT
      value: "5432"

# Blueprints - Mount ConfigMaps for auto-discovery
blueprints:
  configMaps:
    - authentik-blueprints-gitlab
    - authentik-blueprints-nextcloud
    - authentik-blueprints-argocd
    - authentik-blueprints-grafana
    - authentik-blueprints-forward-auth
    - authentik-blueprints-prometheus
    - authentik-blueprints-n8n
    - authentik-blueprints-ceph
    - authentik-blueprints-home-assistant
    - authentik-blueprints-guacamole
    - authentik-blueprints-percona-everest
    - authentik-blueprints-rancher
    - authentik-blueprints-netbird

# Enable Prometheus metrics
server:
  # Single replica required: the embedded outpost stores forward-auth sessions
  # in-memory (no Redis). Multiple replicas cause callback failures because
  # the session created during ext_authz check is only on one pod.
  replicas: 1

  containerSecurityContext:
    runAsNonRoot: true
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
    seccompProfile:
      type: RuntimeDefault

  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
      labels:
        release: prometheus
  
  # Resource limits to prevent OOM
  resources:
    requests:
      cpu: 50m
      memory: 512Mi
    limits:
      memory: 1Gi
  
  # Health probes - removed invalid 'enabled' fields
  startupProbe:
    initialDelaySeconds: 10
    periodSeconds: 5
    timeoutSeconds: 3
    failureThreshold: 24  # 120 seconds for Authentik startup

  readinessProbe:
    initialDelaySeconds: 5
    periodSeconds: 5
    timeoutSeconds: 3
    failureThreshold: 2

  livenessProbe:
    initialDelaySeconds: 10
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  
  # Spread across nodes
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: authentik
              app.kubernetes.io/component: server
          topologyKey: kubernetes.io/hostname

worker:
  containerSecurityContext:
    runAsNonRoot: true
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
    seccompProfile:
      type: RuntimeDefault

  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
      labels:
        release: prometheus
  
  # Resource limits to prevent OOM
  resources:
    requests:
      cpu: 50m
      memory: 512Mi
    limits:
      memory: 1Gi
  
  # Spread across nodes
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: authentik
              app.kubernetes.io/component: worker
          topologyKey: kubernetes.io/hostname

  # Mount cert-manager secret for auto-import of Let's Encrypt cert
  volumeMounts:
    - name: certs
      mountPath: /certs
      readOnly: true
  volumes:
    - name: certs
      secret:
        secretName: authentik-tls
        optional: true

# Disable bundled Postgres
postgresql:
  enabled: false