# Authentik homelab deployment

This directory contains only the homelab values and cluster integrations for
the maintained upstream Authentik chart. The chart owns the Authentik server,
worker, PostgreSQL, Services, Ingress, RBAC, probes, and persistent volume
claim. The local resources retain the existing media route, embedded-outpost
path, Ceph object user, and an alert for the three Authentik-managed outposts.

## Secrets and recovery boundary

The public repository never contains credentials. The deployment references
the existing `authentik/authentik-runtime` and
`authentik/authentik-postgresql` Secrets. The existing `argocd/argocd-oidc`
Secret is also retained outside Git and must contain the same OIDC client
secret as `ARGOCD_OIDC_CLIENT_SECRET` in `authentik-runtime`.

Restore those Secrets before synchronizing Authentik into an empty cluster.
PostgreSQL password rotation must update the database role and both Secret
references together during a maintenance window.

## Managed outposts

Authentik, not Argo CD, creates the `ak-outpost-ldap`,
`ak-outpost-radius`, and `ak-outpost-rac` Deployments. Their database
`container_image` overrides are intentionally null so Authentik uses its
upstream `ghcr.io/goauthentik/%(type)s:%(version)s` template. That keeps each
outpost on the same version as the server after a chart upgrade without a
second version list in Git.

After every Authentik upgrade, verify that all three Deployments use the chart
application version and report one updated, ready, and available replica. The
`AuthentikManagedOutpostsUnavailable` alert detects missing or unavailable
generated outposts, which are outside Argo CD's direct resource inventory.
Run `apps/authentik/verify-outposts.sh` for the version, database-pin, image,
and replica checks; it derives the expected version from the Argo Application.

The Kubernetes Dashboard provider is attached to the embedded outpost in the
Authentik database. This avoids a blueprint replacing the embedded outpost's
complete provider list, because other applications also own providers there.