From b91cc2409c6c0e33ad9e9b4674ede8abf1e3a378 Mon Sep 17 00:00:00 2001
From: Karan Parashar <whyredfire@gmail.com>
Date: Fri, 25 Sep 2026 02:35:12 +0530
Subject: [PATCH] feat(apps): Put garage-ui behind authentik forward-auth

---
 apps/garage-ui/httproute.yaml       | 16 +++++++++++++++-
 apps/garage-ui/kustomization.yaml   |  1 +
 apps/garage-ui/middleware.yaml      | 17 +++++++++++++++++
 argocd-apps/services/garage-ui.yaml |  4 +---
 infra/authentik/kustomization.yaml  |  1 +
 infra/authentik/referencegrant.yaml | 17 +++++++++++++++++
 6 files changed, 52 insertions(+), 4 deletions(-)
 create mode 100644 apps/garage-ui/middleware.yaml
 create mode 100644 infra/authentik/referencegrant.yaml

diff --git a/apps/garage-ui/httproute.yaml b/apps/garage-ui/httproute.yaml
index ed82bb9..e4b923d 100644
--- a/apps/garage-ui/httproute.yaml
+++ b/apps/garage-ui/httproute.yaml
@@ -15,8 +15,22 @@ spec:
       sectionName: websecure
   rules:
     - backendRefs:
-        - name: garage-ui
+        - name: authentik-server
+          namespace: authentik
           port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /outpost.goauthentik.io
+    - backendRefs:
+        - name: garage-ui
+          port: 80
+      filters:
+        - extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: authentik
+          type: ExtensionRef
       matches:
         - path:
             type: PathPrefix
diff --git a/apps/garage-ui/kustomization.yaml b/apps/garage-ui/kustomization.yaml
index 9407f06..8af86c7 100644
--- a/apps/garage-ui/kustomization.yaml
+++ b/apps/garage-ui/kustomization.yaml
@@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
+  - middleware.yaml
   - httproute.yaml
diff --git a/apps/garage-ui/middleware.yaml b/apps/garage-ui/middleware.yaml
new file mode 100644
index 0000000..78050be
--- /dev/null
+++ b/apps/garage-ui/middleware.yaml
@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: authentik
+  namespace: garage
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+    trustForwardHeader: true
diff --git a/argocd-apps/services/garage-ui.yaml b/argocd-apps/services/garage-ui.yaml
index 588eddb..81cc62c 100644
--- a/argocd-apps/services/garage-ui.yaml
+++ b/argocd-apps/services/garage-ui.yaml
@@ -27,9 +27,7 @@ spec:
                 name: garage-ui-secrets
             auth:
               admin:
-                enabled: true
-                existingSecret:
-                  name: garage-ui-secrets
+                enabled: false
               jwt_private_key_secret:
                 name: garage-ui-secrets
             cors:
diff --git a/infra/authentik/kustomization.yaml b/infra/authentik/kustomization.yaml
index 750911f..4aa473b 100644
--- a/infra/authentik/kustomization.yaml
+++ b/infra/authentik/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
   - sealed-secret.yaml
   - blueprints.yaml
   - httproute.yaml
+  - referencegrant.yaml
diff --git a/infra/authentik/referencegrant.yaml b/infra/authentik/referencegrant.yaml
new file mode 100644
index 0000000..bf1d8a0
--- /dev/null
+++ b/infra/authentik/referencegrant.yaml
@@ -0,0 +1,17 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: outpost
+  namespace: authentik
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: garage
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: qbit
+  to:
+    - group: ""
+      kind: Service
+      name: authentik-server