akadmin/Funk-lab
1
0
Fork 0
mirror of https://github.com/Alkatrazz24/Funk-lab.git synced 2026-07-10 18:24:42 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(auth): annuaire Authentik + portail consoles Guacamole

Browse source 
- k8s/apps/authentik : IdP OIDC (auth.lab.local), namespace auth —
  server + worker 2026.5.3, Redis in-cluster, PG sur storage-01, PVC media
- k8s/apps/guacamole : portail consoles SSH web s01/g01 (portail.lab.local) —
  guacd + webapp 1.6.0, SSO OIDC vers Authentik, Job initdb idempotent
- ansible : rôle console_user (user sans sudo pour les consoles, s01 + g01),
  bases PG authentik/guacamole, secrets vault (mdp PG + clé SSH console)
- doc : admin/k8s/auth-portal.md (déploiement, config initiale, pièges)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
alkatrazz 2026-07-06 21:19:23 +02:00
parent 09ca0be469
commit edf4a6294d
21 changed files with 775 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

135
k8s/apps/authentik/deployment.yaml Normal file
View file

@ -0,0 +1,135 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: authentik-server
namespace: auth
spec:
replicas: 1
selector:
matchLabels:
app: authentik-server
template:
metadata:
labels:
app: authentik-server
spec:
containers:
- name: authentik
image: ghcr.io/goauthentik/server:2026.5.3
args: ["server"]
ports:
- containerPort: 9000
env:
- name: AUTHENTIK_SECRET_KEY
valueFrom:
secretKeyRef:
name: authentik-secret
key: secret-key
# PostgreSQL sur storage-01 (hors cluster) — même pattern que Ghostfolio/n8n
- name: AUTHENTIK_POSTGRESQL__HOST
value: "192.168.10.1"
- name: AUTHENTIK_POSTGRESQL__NAME
value: "authentik"
- name: AUTHENTIK_POSTGRESQL__USER
value: "authentik"
- name: AUTHENTIK_POSTGRESQL__PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secret
key: pg-password
# Redis (in-cluster)
- name: AUTHENTIK_REDIS__HOST
value: "authentik-redis"
- name: AUTHENTIK_REDIS__PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secret
key: redis-password
- name: TZ
value: "Europe/Paris"
volumeMounts:
- name: media
mountPath: /media
resources:
requests:
cpu: 200m
memory: 700Mi
limits:
cpu: 1000m
memory: 1536Mi
readinessProbe:
httpGet:
path: /-/health/ready/
port: 9000
initialDelaySeconds: 30
periodSeconds: 15
livenessProbe:
httpGet:
path: /-/health/live/
port: 9000
initialDelaySeconds: 60
periodSeconds: 30
volumes:
- name: media
persistentVolumeClaim:
claimName: authentik-media
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: authentik-worker
namespace: auth
spec:
replicas: 1
selector:
matchLabels:
app: authentik-worker
template:
metadata:
labels:
app: authentik-worker
spec:
containers:
- name: authentik
image: ghcr.io/goauthentik/server:2026.5.3
args: ["worker"]
env:
- name: AUTHENTIK_SECRET_KEY
valueFrom:
secretKeyRef:
name: authentik-secret
key: secret-key
- name: AUTHENTIK_POSTGRESQL__HOST
value: "192.168.10.1"
- name: AUTHENTIK_POSTGRESQL__NAME
value: "authentik"
- name: AUTHENTIK_POSTGRESQL__USER
value: "authentik"
- name: AUTHENTIK_POSTGRESQL__PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secret
key: pg-password
- name: AUTHENTIK_REDIS__HOST
value: "authentik-redis"
- name: AUTHENTIK_REDIS__PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secret
key: redis-password
- name: TZ
value: "Europe/Paris"
volumeMounts:
- name: media
mountPath: /media
resources:
requests:
cpu: 100m
memory: 500Mi
limits:
cpu: 500m
memory: 1Gi
volumes:
- name: media
persistentVolumeClaim:
claimName: authentik-media

14
k8s/apps/authentik/ingress.yaml Normal file
View file

@ -0,0 +1,14 @@
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: authentik
namespace: auth
spec:
entryPoints:
- web
routes:
- match: Host(`auth.lab.local`)
kind: Rule
services:
- name: authentik
port: 9000

13
k8s/apps/authentik/pvc.yaml Normal file
View file

@ -0,0 +1,13 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: authentik-media
namespace: auth
spec:
# RWX : partagé entre server et worker (icônes, templates)
accessModes:
- ReadWriteMany
storageClassName: nfs
resources:
requests:
storage: 1Gi

57
k8s/apps/authentik/redis.yaml Normal file
View file

@ -0,0 +1,57 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: authentik-redis
namespace: auth
spec:
replicas: 1
selector:
matchLabels:
app: authentik-redis
template:
metadata:
labels:
app: authentik-redis
spec:
containers:
- name: redis
image: redis:7-alpine
args:
- "--requirepass"
- "$(REDIS_PASSWORD)"
- "--maxmemory"
- "128mb"
- "--maxmemory-policy"
- "allkeys-lru"
ports:
- containerPort: 6379
env:
- name: REDIS_PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secret
key: redis-password
resources:
requests:
cpu: 50m
memory: 64Mi
limits:
cpu: 250m
memory: 192Mi
readinessProbe:
exec:
command: ["sh", "-c", "redis-cli -a \"$REDIS_PASSWORD\" ping | grep -q PONG"]
initialDelaySeconds: 5
periodSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
name: authentik-redis
namespace: auth
spec:
selector:
app: authentik-redis
ports:
- port: 6379
targetPort: 6379

11
k8s/apps/authentik/service.yaml Normal file
View file

@ -0,0 +1,11 @@
apiVersion: v1
kind: Service
metadata:
name: authentik
namespace: auth
spec:
selector:
app: authentik-server
ports:
- port: 9000
targetPort: 9000