apiVersion: apps/v1
kind: Deployment
metadata:
  name: authentik-server
  namespace: auth
spec:
  replicas: 1
  selector:
    matchLabels:
      app: authentik-server
  template:
    metadata:
      labels:
        app: authentik-server
    spec:
      containers:
        - name: authentik
          image: ghcr.io/goauthentik/server:2026.5.3
          args: ["server"]
          ports:
            - containerPort: 9000
          env:
            - name: AUTHENTIK_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: authentik-secret
                  key: secret-key
            # PostgreSQL sur storage-01 (hors cluster) — même pattern que Ghostfolio/n8n
            - name: AUTHENTIK_POSTGRESQL__HOST
              value: "192.168.10.1"
            - name: AUTHENTIK_POSTGRESQL__NAME
              value: "authentik"
            - name: AUTHENTIK_POSTGRESQL__USER
              value: "authentik"
            - name: AUTHENTIK_POSTGRESQL__PASSWORD
              valueFrom:
                secretKeyRef:
                  name: authentik-secret
                  key: pg-password
            # Redis (in-cluster)
            - name: AUTHENTIK_REDIS__HOST
              value: "authentik-redis"
            - name: AUTHENTIK_REDIS__PASSWORD
              valueFrom:
                secretKeyRef:
                  name: authentik-secret
                  key: redis-password
            - name: TZ
              value: "Europe/Paris"
          volumeMounts:
            - name: media
              mountPath: /media
          resources:
            requests:
              cpu: 200m
              memory: 700Mi
            limits:
              cpu: 1000m
              memory: 1536Mi
          readinessProbe:
            httpGet:
              path: /-/health/ready/
              port: 9000
            initialDelaySeconds: 30
            periodSeconds: 15
          livenessProbe:
            httpGet:
              path: /-/health/live/
              port: 9000
            initialDelaySeconds: 60
            periodSeconds: 30
      volumes:
        - name: media
          persistentVolumeClaim:
            claimName: authentik-media
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: authentik-worker
  namespace: auth
spec:
  replicas: 1
  selector:
    matchLabels:
      app: authentik-worker
  template:
    metadata:
      labels:
        app: authentik-worker
    spec:
      containers:
        - name: authentik
          image: ghcr.io/goauthentik/server:2026.5.3
          args: ["worker"]
          env:
            - name: AUTHENTIK_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: authentik-secret
                  key: secret-key
            - name: AUTHENTIK_POSTGRESQL__HOST
              value: "192.168.10.1"
            - name: AUTHENTIK_POSTGRESQL__NAME
              value: "authentik"
            - name: AUTHENTIK_POSTGRESQL__USER
              value: "authentik"
            - name: AUTHENTIK_POSTGRESQL__PASSWORD
              valueFrom:
                secretKeyRef:
                  name: authentik-secret
                  key: pg-password
            - name: AUTHENTIK_REDIS__HOST
              value: "authentik-redis"
            - name: AUTHENTIK_REDIS__PASSWORD
              valueFrom:
                secretKeyRef:
                  name: authentik-secret
                  key: redis-password
            - name: TZ
              value: "Europe/Paris"
          volumeMounts:
            - name: media
              mountPath: /media
          resources:
            requests:
              cpu: 100m
              memory: 500Mi
            limits:
              cpu: 500m
              memory: 1Gi
      volumes:
        - name: media
          persistentVolumeClaim:
            claimName: authentik-media