From 02af027e43692e17546f8b9e26e70ed85c77be63 Mon Sep 17 00:00:00 2001
From: James Allenby <JamesAllenby@protonmail.com>
Date: Sun, 5 Jul 2026 22:18:43 +0100
Subject: [PATCH] feat: add authentik role

---
 .../kubernetes_authentik/defaults/main.yaml   | 28 +++++++++++++++++++
 .../kubernetes_authentik/tasks/main.yaml      | 14 ++++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 ansible/roles/kubernetes_authentik/defaults/main.yaml
 create mode 100644 ansible/roles/kubernetes_authentik/tasks/main.yaml

diff --git a/ansible/roles/kubernetes_authentik/defaults/main.yaml b/ansible/roles/kubernetes_authentik/defaults/main.yaml
new file mode 100644
index 0000000..94caada
--- /dev/null
+++ b/ansible/roles/kubernetes_authentik/defaults/main.yaml
@@ -0,0 +1,28 @@
+kubernetes_authentik_chart_version: "2026.5.3"
+kubernetes_authentik_hostname: auth.solidish.dev
+kubernetes_authentik_secret_key: "{{ lookup('proton_pass', item_title='Authentik', vault_name='Home Lab', field='Secret key') }}"
+kubernetes_authentik_db_password: "{{ lookup('proton_pass', item_title='Authentik', vault_name='Home Lab', field='Database password') }}"
+
+kubernetes_authentik_values:
+  authentik:
+    secret_key: "{{ kubernetes_authentik_secret_key }}"
+    error_reporting:
+      enabled: false
+    postgresql:
+      password: "{{ kubernetes_authentik_db_password }}"
+  server:
+    ingress:
+      enabled: true
+      ingressClassName: traefik
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt
+      hosts:
+        - "{{ kubernetes_authentik_hostname }}"
+      tls:
+        - secretName: auth-solidish-dev-tls
+          hosts:
+            - "{{ kubernetes_authentik_hostname }}"
+  postgresql:
+    enabled: true
+    auth:
+      password: "{{ kubernetes_authentik_db_password }}"
diff --git a/ansible/roles/kubernetes_authentik/tasks/main.yaml b/ansible/roles/kubernetes_authentik/tasks/main.yaml
new file mode 100644
index 0000000..f458844
--- /dev/null
+++ b/ansible/roles/kubernetes_authentik/tasks/main.yaml
@@ -0,0 +1,14 @@
+- name: Ensure Authentik repository exists
+  kubernetes.core.helm_repository:
+    name: authentik
+    url: https://charts.goauthentik.io
+
+- name: Ensure Authentik is installed
+  kubernetes.core.helm:
+    release_name: authentik
+    release_namespace: authentik
+    chart_ref: authentik/authentik
+    chart_version: "{{ kubernetes_authentik_chart_version }}"
+    create_namespace: true
+    values: "{{ kubernetes_authentik_values }}"
+  run_once: true