feat(apps): Add qbit

feat(apps): Enable network policies for redoost
feat(authentik): Log in with Google only
2026-09-26 20:55:42 +05:30 · 2026-09-26 11:49:21 +05:30 · 2026-09-25 03:20:54 +05:30 · 2026-09-25 03:14:16 +05:30 · 2026-09-25 03:07:31 +05:30 · 2026-09-25 02:35:12 +05:30
22 changed files with 333 additions and 58 deletions
@@ -15,8 +15,22 @@ spec:
      sectionName: websecure
  rules:
    - backendRefs:
-        - name: garage-ui
+        - name: authentik-server
+          namespace: authentik
          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /outpost.goauthentik.io
+    - backendRefs:
+        - name: garage-ui
+          port: 80
+      filters:
+        - extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: authentik
+          type: ExtensionRef
      matches:
        - path:
            type: PathPrefix
@@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - sealed-secret.yaml
+  - middleware.yaml
  - httproute.yaml
@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: authentik
+  namespace: garage
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+    trustForwardHeader: true
@@ -0,0 +1,126 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: qbittorrent
+  namespace: qbit
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: qbittorrent
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: qbittorrent
+    spec:
+      containers:
+        - env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: Etc/UTC
+            - name: WEBUI_PORT
+              value: "8080"
+            - name: TORRENTING_PORT
+              value: "6881"
+          image: lscr.io/linuxserver/qbittorrent:5.2.3_v2.0.15-ls478
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          name: qbittorrent
+          ports:
+            - containerPort: 8080
+              name: http
+          volumeMounts:
+            - mountPath: /config
+              name: config
+            - mountPath: /downloads
+              name: downloads
+      dnsConfig:
+        nameservers:
+          - 127.0.0.1
+      dnsPolicy: None
+      initContainers:
+        - args:
+            - ip rule del table 51820; ip -6 rule del table 51820; exec /gluetun-entrypoint
+          command:
+            - /bin/sh
+            - -c
+          env:
+            - name: VPN_SERVICE_PROVIDER
+              value: custom
+            - name: VPN_TYPE
+              value: wireguard
+            - name: WIREGUARD_IMPLEMENTATION
+              value: kernelspace
+            - name: WIREGUARD_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_PRIVATE_KEY
+                  name: wireguard
+            - name: WIREGUARD_PUBLIC_KEY
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_PUBLIC_KEY
+                  name: wireguard
+            - name: WIREGUARD_ADDRESSES
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_ADDRESSES
+                  name: wireguard
+            - name: WIREGUARD_ENDPOINT_IP
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_ENDPOINT_IP
+                  name: wireguard
+            - name: WIREGUARD_ENDPOINT_PORT
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_ENDPOINT_PORT
+                  name: wireguard
+            - name: WIREGUARD_MTU
+              value: "1280"
+            - name: WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL
+              value: 25s
+            - name: FIREWALL_INPUT_PORTS
+              value: "8080"
+            - name: HEALTH_VPN_DURATION_INITIAL
+              value: 30s
+            - name: TZ
+              value: Etc/UTC
+          image: qmcgaw/gluetun:v3.41.3
+          livenessProbe:
+            exec:
+              command:
+                - /gluetun-entrypoint
+                - healthcheck
+            periodSeconds: 30
+            timeoutSeconds: 10
+          name: gluetun
+          restartPolicy: Always
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+          startupProbe:
+            exec:
+              command:
+                - /gluetun-entrypoint
+                - healthcheck
+            failureThreshold: 30
+            periodSeconds: 5
+            timeoutSeconds: 5
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: qbit-config-pvc
+        - hostPath:
+            path: /srv/media
+          name: downloads
@@ -0,0 +1,37 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: qbittorrent
+  namespace: qbit
+spec:
+  hostnames:
+    - qbit.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: authentik-server
+          namespace: authentik
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /outpost.goauthentik.io
+    - backendRefs:
+        - name: qbittorrent
+          port: 8080
+      filters:
+        - extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: authentik
+          type: ExtensionRef
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - middleware.yaml
+  - httproute.yaml
@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: authentik
+  namespace: qbit
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+    trustForwardHeader: true
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: qbit-config-pvc
+  namespace: qbit
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 500Mi
@@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: wireguard
+  namespace: qbit
+spec:
+  encryptedData:
+    WIREGUARD_ADDRESSES: AgCUjKDTHlj+cDz5QmTdFrQ2uzgf2h7nHIB22Hiy8dNQoHPmpl42IS8pWMM3cC7/RQ620XX3Gvnjt7w3N+cRHsxZONCtBaocM/B4lBxgkrqoBuMISQ90oeqeL16ZWd6yDPmzgJLG0JfWPEuGkXsCkMHKg2cTQwZeIhoI0jiiUIKtY0q3YA19cSaf9gX0buQyu84hy6oi7Y2l0EXqwcbHJP2NEAWmxXuHF1nKtcSnAUlsHGCfomHLtSPoyoR0Ug3CER60oE18JIYmbt+iFL4Oalx4nKFoJbkD+dPLx/Do7kylySVqX5DAj1ivIQjyqZmcsyaigP01OU+poSM0D94mhMt8Dfi+ZOzDemoVDKtJlOYNfskk0hLdbLdGk6DzlONl7KBjduzbSk7BnFlr5bRNeKYFiDpg5I1y2FKROpmFCvV2pzqlLFl0C2BTwZU1dAj2Qk+ouUdhzzxEKqS2Q/CUUIftepqKIYzMJncFDbEjt5gAB0DJOt6FWiNG9TV3v+oSdzqn9UFPTIP1SO3IhyVoICDGmo829ki104ZnvjVciuPLH85l5rSdQI6qJuabLXylqTU8tmebTXDJZw/kBD+hw4ycCgD1kQssZM3djjy/RbMhY4zrpN345jelr9Z5kQsINcDBPfyCjCm/Eo6PM/fiuCkNP/KrKHI6C+NkyFHWk14ZeYODJI8GYakRO6SCRZ1G/SWJxA5DfZcuojweGD0G
+    WIREGUARD_ENDPOINT_IP: AgBKPD8cgNPVl7YTUsKkDRioPFCLNg+q+PGYiN5Qvw5nAvhh8tmUiV3JlkdtUHp/ggC8Fn+bLsNPRjjQoa02F8wZv1oxO1XeThNtxX49xlcLiFsw83wtL/pKQcNShml+HClsiCXN569g9NkcCY4R13tcSZPRbVs+oV95sGeUtfx/Ukh4g/URX1Z0aKzI2RE1ENMLQMXkVrrk7GJdqKBBsW76wHcTHw3DgcshMhlgcDwLiX4b+e5nAOzjlcwEKm6EBxXz2NuHP9PTkzfvK9QSSZJ7GLlac7eqFWj+xir8k1s1bIzB/suNMIzpo0bvOUjpxmoI54Xd4/hZ6fXkEF7lD1DwK7G/RV9+XNePPX+lGSJ9gQMIadmK3P6jHNnl/+RtqUk3mQ35r3Tl1Tmz3mhhK3/YalL6/8zWesNVYt6D4yQkFi3GFnc02Htl7/CyU+r5a3TwE3xUl/VNtkhHklrL8obF/cCORbFlYcwT2tbYl1av/3slJ8UsG+DXEX62+o6Tpt70Mzhcj61mQ2H/Emb5d7FPYlohogM1e37YY6lJhbjZeNHxxKvki8kusPa/eY8ZAdJcpd41/0rrL3uSOOZqqELNuTzqQKRhb6CDUGaoYFqSw9umDqwjdvfFQcYLQepn84HFILAlUfNF/InO6WrNh8jWGKx9SNsDfrJpY/RRyEJK8EoNIuelLdNP3phZhxUcQn/UBZ/M/UOzJZZ2xJPl
+    WIREGUARD_ENDPOINT_PORT: AgCOTc0MMWugdnF6Ou8mGgBGu5VD7zP6O3hGr+4YzW/UvCEARqwuoRXTKggUpFcZC0mNf1CdGCB1iRGCVWjnFJsw6zSudcJiWEVOtqLMfxxwZHhApiMtaHq4ERP4Hhu3jn/QwdwbYgk7rUoqsCRU2JelgPoYIhJh/2BtOz0z8PO+ktMIi5Qaj7m6O0zkxbzvqZaEbgkYsFCtQlaWqvghNk7GZB12KOOr0kU+Uu4vyi2ak7quoMjaQkMrRHOhhw0hk++FCXN9SNpDGyGBcqPtl/8ZRUyomLi76O3nsHX8QtXXj3yzDEwrdfwNzCwJXqI6HI4X2+/xSvnxI09wf5ei6D8gyJX8gkPQiqsXA4dsYvTUstf26Qlh/L6iQjB8RkXixBR1YwrIu/lLNO0FpFPqtLJu5jf1jMjZIn+oPl3GxAXcM+kRsX9YS5oJdD3rFFTz8HGthfOTSpaEgSnN2rF440vfIH8DKvTDH4cyR78C2Z8TWQ2hbDxXOX/NwxvPfidttyC3euLBc4Nkb/VX/DEU9W3QCB9yKuXw2KKSqnWHvIAReYLn5ex9czU+B+8IP2fJzTMDH7gOYqwtxuRMPu5bto0dn/120ZaLDBzGUHL38pBnMsYhssOGQlerpG32nT66IYdaZXTMD2UHsTwnNqu4/J98IY47n60wg3SVOVyZQ/dmS7Dfp8lPr/kE3+xNM8HWayCEKYxW
+    WIREGUARD_PRIVATE_KEY: AgAwJo1zxNRWXAinDWXvLajPWwHeWwAD8zOopE8Z8M5xAUDKWkTwZecR/ODI37bYQ22bb1+qjErBsqUHyT79adOmypY9DLW6YdY2YPkQwef33iXdgC1T7nV4pjI2TahiVab0z+5ot18A/FM9S7VHmRX4L+3ccO/oqcInNz5PFbsXp6U0dZZtiKWg7N5IzdT9dwDCknNFTv10URlHKE0Awff8jA34XGC8Ra/SvF3gSiaYjwd74HEBpnBMM5CsiveOyU1vCNxg93S12yrauC5jmD/ex5oEnJ4J1SziTUlB6e6ALpluA3AD91wuZ+wXeaJ0huNSz4g4sL6jm3OQykyiRx7jx/8FL3no0u3ydGPgYZ5MaEYXBtTk6ODFEhUZ7EGs9w8vip1SY/FijZYC3QT78R5WMim8gi1wf+TwmA8YRIDZW0CMhbtI32Ef2oDmb1Jzl58Igba8zQGTIqT7Htj6f4mpJk8gKSRIzkvLK6o+cynOpQzZBOZb+G7lZst4g+lILLjmfpFGJTVgogfEkuYV6ntuE3dGB2OmRGUW0vpDM4ZCkxYsjh/1kzSyOGVYtL0EHS689ehzUDUJLuJuvuwZIFUjOFCFofGP37rKCcSGouLNj+xWmcbCgx7si05rw8JMeAWE5YETaBbi55DDaUB98G97KM28OlPBDm8PtqdcBD4W2up34nowXdG0tZ38VsTV7xNyp+2A5saPQZ72wM1fQiUwGwoHRKdHB1ptF6u+0zr6tlQoiVE07BMQ8/ykAQ==
+    WIREGUARD_PUBLIC_KEY: AgBAElHBgsQNQ3l8CGLlKMmi9dMTLmgp4gseMgbEMW4sjOvhsAIeLGsuv+HuStvH+bfAp7U9Fh6pAlEZKPOdN5pbpoFjkTDC5VU8aKJcdO/+iZWURbULYBDyGK32Ss/0eCwIsdO7lFcSFy2T7XJFPn656lBx8gocBp9PMHRSoL2dELP9q8JyNr3nb84vZ8hwiBP3Gy8BITeeE4J7+DnF2SUg+4pc92gMOgmWL4LO25pI39Q1yKBw4tCOf4f4ETgmjRHv17WsFw2JZTgb1rmXFvvKWGzTPZbA1gajcRgTKY7DrzWFjFi/o84qjGC4feQ9vb5ZwnLN1MzU1yByQmxQiAOSCK+1SMrvUJ9dF2kE3zJw0fSGjU83iXcorpbe4YYFr4Y8k6mKSSthchYyQZp5FuB9N9J7vm4vv4kUbTGOtwHQFrKRNiB5PVVFqzUVYWs9CfFcodAu7JaCBHKzLj1X7xBLiQoWYpx7/LVTjoR/R9j/+bfblKlid+H322Oh4ReSuxVKfMmNiOGeueMOrGX+DhHtYFbGHmdc3aprjBkYanq71MV9kFRVAZd834IX4wWykQWWgmYtx+eZJs6DZRWhAaVbBQ9IY0vS4IjAInTpMN9yqNxJkZ+w1MJIeTG5S9NnB3xUjnOgSCow9r/IEVNFbT4CbsEXbMECQ3S0OIby8r3Zwt8J7NEphFYkLtsR+brtMLsWRHIw23mtSTZajLMaSHOG6fooZyNKYgYJGr0Spura2M6TjhW+f1csYKrkxA==
+    wgcf-account.toml: AgAaSo7eZz/CvAN1reUDhHzFWIcmQMopYloYitAYq5Zu6gXE+65ogq0Jr/S7WLTqdgL3KWWhSmlG+jpepC8cpomVrnPfydlw6or227dm0ND5XNEO1MwNOtzeGNS3q7ayB8NoC7qZVR33KqutGOZLbFawyTZUi4ItjW74SdvL/Ftd4VvqrG7hQtAd/2PP37mL0unw2DesL8hFUXTkvlzAdKHZGQMaYNcH73JWJwvlf95L6ncKdZXWEM0uJnjhAVE+sCpUEQK67mQcX4RrYairr1wwux2YYjwweAriXw7wzBDvOXnHqg3Ldmat0V7FMK0MeIzHhezy15AGLtYRonFcYzEznIl7P2FjjG4Yz0EAk0t1rJpQgV35NAybseQ8t/92+vPa7LaPcjUUKZ5Kx1a2SdihljtLEjzuIdvYN/tKPcselzehWWrbDl/qeQuwZABxj8z24moJmBqJcXpAigvX4XlDcWp0jHWQxbLDozKtYHKUEPmhAklVaDuVr+bY2jOxU4Nki3ybLYpi834CsifcSc7RAaruJIlnITZUR2VG7PMIoTObqfeYnSyZKabHadWHHdkoyYsJmSiWjadvlvBXtW+RTHVU8UsD8GdVS9wBpA6ZcRsegFiEAoMzdyZQNRabYjUeAxpA/lOtt/PH1FnIV588Of/lhypBdUF4rRYcCvVT0gFQjoe7ITsvEf/P+fLb3TO47fQtBqOmKqoD21yhtb8Y4GQ21XVmB1gJT+/oYjny9/YL5CuhJif0XoarJZHtvTb5Ubs716PRSmSvAoXI6jBMKVSssWtfMIedL03X+RAxyT3jvL/W/SEuN5D5a2RpjIswAIN5LQ3b9f7F/JgDIQKdIHUEm+Z430lS83RDsMpJ13SmRVoXzbAededT7r08DHu++sOvDfHeMy+lTD0aTaskbPWY5PLve7g7PWat9q+NMepgRC3z26JCw/08O4SGX/fUhxg709F5A8hf/LUSTNGRlQ==
+  template:
+    metadata:
+      name: wireguard
+      namespace: qbit
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: qbittorrent
+  namespace: qbit
+spec:
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: qbittorrent
@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: argocd-repos
-  namespace: argocd
-spec:
-  destination:
-    namespace: argocd
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    path: infra/argocd-repos
-    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
@@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - argocd-dashboard.yaml
-  - argocd-repos.yaml
  - authentik.yaml
  - cert-manager.yaml
  - cnpg.yaml
@@ -27,9 +27,7 @@ spec:
                name: garage-ui-secrets
            auth:
              admin:
-                enabled: true
-                existingSecret:
-                  name: garage-ui-secrets
+                enabled: false
              jwt_private_key_secret:
                name: garage-ui-secrets
            cors:
@@ -11,8 +11,8 @@ spec:
    server: https://kubernetes.default.svc
  project: default
  source:
-    path: qbit
-    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops-private.git
+    path: apps/qbit
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
    targetRevision: main
  syncPolicy:
    automated:
@@ -39,6 +39,19 @@ spec:
            websiteUpstream: garage.garage.svc.cluster.local:3902
            bucket: redoost-sites
            existingSecret: redoost-s3
+          networkPolicy:
+            enabled: true
+            gateway:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: traefik
+            s3:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: garage
+                podSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: garage
    - path: apps/redoost
      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
      targetRevision: main
@@ -8,6 +8,7 @@ data:
    issuer: https://auth.whyredfire.dev/application/o/argocd/
    clientID: argocd
    clientSecret: $argocd-oidc:clientSecret
+    enablePKCEAuthentication: true
    requestedScopes:
      - openid
      - profile
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - repo-sealed-secret.yaml
@@ -1,17 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: repo-gitops-private
-  namespace: argocd
-spec:
-  encryptedData:
-    password: AgCYFWUZmqWTYbutOvQr0GJ87zvVwW/GYanXC4Qdlqo1nkYC0u/ve88UonB0UklJPfMq59/jefbrl80fg4JUMLJMBnNUiIfUIJ2gN07n5P1UqQGTFwo8iHFD4XwKlCfSD75wQXBhccWO1zS1lVZEIzbUdom7rI45bG2Q+u5NQBC/bs3NxrrzYqrHFsbE2jEeu0hG33JOoikvLOwih96Xxgadrvbdw/WpY2bbqM/BSA35u8fzeDF4ZZ98x7LPzflP04DxKJZLh5U3H1//RjWaKeNkDwp/dtNm63NPJrh7+rD+EOHu4undBwNHIW4vrv4bRQeP4xBERNFquiwwmQsi2Wwd4kpD+kgbGhezYMDgk8FOBwS04DJJJpvYdJdGTZoCwML1C+iwMoKhwk7WFvg4vkW3DBpRh+w9Otdq4odsklqgwp1o8OXL1hcd/iQqp8TiuwUFlmJhTs841xvqRMuCBQ0SnAwQ/u9kEsY6C6r/EvdaOciRoEWa0pMk3zvkaCrSkoAElYtXh30MhGfd1rbWT09Xvh/ACRjarBvLHUa7fPSc9Po9t+6eRuFR1cqT2jwUtHMuAqFA4XDC+oHkLsz8WD8qm4K9dwfOXME1rT2OoByaSdlSDsV6uKWRlMxxrzBGzihUBp1TSI8X+ux90hp5vQ30BKqGCC0Y3aRHprndDcHvdP4ASJ6++uu3ZkD6cY/he87w21ETl9+zxo8=
-    type: AgBWyIT44g9RaY/2dyznsXqQ3lVS0q/zJ5MeQhqkREsCn37U8ZxUrVqrmYq+RJU+cPVDWSl2tnmnfjvzV6+SEroVPAaTduRSFYxP6X4xsFuarJ21GSOAvt4Zc1ODZXYxCKfEAB+K7djc+g4+WOp/RihxKue9sevsM2krxnBXouNn7gXOog2Vd7mHbenuuGNVzV6ROJU7tw3uzZ/KETqr+5Jr1bKf64URkcN1njxb9lJHmK+VJbWPLcIbaGCfel07QqX0+EQXjIMwvpHoiWF25dJfPtbADlF/UIjWRXRRh5pCoppXpte39S4nrkkyOKCe2l7IctYF6+pvg5xNOmPeYnqIxpgZwWlWg2TcI5pn4aTxyXA+COJs5VQYgGDxPyNmm2lqh77hzHFceTxlFjtS5u5UQBzjagClXg2lYi2YRcnMTLUHDJyisT9Gr7bpgRK1BU19yxMg5f+vhzL5GmPMtOE6r9dZXwbi5660Okrn7x1MEgHb7poiXbG920yEC3mqVB6+1HLzoY5603b44VafDCTh2AtslSEW8n4Dt1gBm8DAOcDvq1e3NMn8Aq7cyGF5L7x0WwXLjgjr26nf6XiyZ9NAOD2upyJDCZvvVqcFypqOFsFOyhZXU86vuRW35tNqq6N3ppL2OFmm84ies04InHGTJHS3ps8KCyXWow1PgGhn/spB73JSjW4nsUztQPThOQ2c2JY=
-    url: AgDV+GO2ccs/uj87TNXbhSA18Y8amZiqmasZcijd/Zpjv8LPw94f9PORC1v9DhautblXF+Y39MnBjQm3pYLEbIU7FBDpx/Kkk34+F/tTfJqmQOcvGjEZLs73I7kvvy9Uy2Wme/uJt4PpR3UyJEAwJKNudC2NAJz2gfS7lsk+6AUpc+Z6MBoETdUQuaYlk/cxliWnPbJx8EYOS0TEaLezZ27w1OeN2kYEtnZ+qRd/+6g68MpM6UeoL53kOwNOcXN67+IdPE17zD05I0SPIKJy760Ukw/S1sphUpfQgOueHpmgpQanzJWZDCyudLpgnWS/cVWmZY0tDcgmiWCVJwYVFML8Qse3oXWRixIIunhMSS8jFk8Sa/v0agY8SOeIEWIx7n6G6jGkBLK5QZ8Y689UqsfsuKy3aUxno3gqzz4WibjdwAJfNsWCb3P6ZH2AfeTw7gz9HD/AiMRGuSTlzZpGS4acyltwbkKKz1WwLZF/qXtL0hi7QrYIPK82hKF7s458s0KQG2lE+bWOUG0WGjMWys6FwEbe5p3OTT2ea45+OyL0BlFQFkXHeIlxpq86Iz2KVxy4age5SghpSBn3+S3NM4voo9QDIeLXF++EOLCQXRXHgp4vOnb/nAVkbfQ6cvs2HBVg4lSYaNlBlznkPORiUNvXuu2JKHeKzXEJWhwIvmXrnac629MEaCCONEiBaTAy3B08WjSzvWUkxXYuBrRvrcm/JOP8K2yNgtJTRGGbH9SbMTJ8RoqgMC+GjokIFvlButxh0MeXlQLk0huV
-    username: AgBB0XO+j5xoMAgvbIKEf0/ghe9rPwoTnzZvm4lbakuCc4BEKl1Zm5bkNQilEBpxl/TsfnxdhhGnNvF9DXbIJjoEfEU8wzX5LpBMXt5qWC1Oquul4qvEHw6kMCu3oJ7hQ54yBVIhM5W9n1c6UWhJ6ttwZJ/ymqGLFWh1r/3KhoiInfU2EkPJ7bte085rUuyT524mwH9pfGEwte6VjuHPXBQt22i4fP+BBT3pV443PISshGfQC28bpt8vMi83kE/ICkwg21AQUImvfcHXojUJE5dks4mbrA49532R4uDVseVxCrW5fCtevQmgHbkyOke3FQG1AspXx7gdLldKVeW7QBgDP6O9DuEZgNzrxY6T4jf2dNUi1y5W00A4hJVMvIyBy4wENGIj1JJto6D1pRbYPzugKzUhb529UHS6Oxy3H2GqoE5L+mTbrQ2Nm8OhLeaSXUqQtJreZg9GYDZ3sjTe5tlqmcRisM43D5Aw/vV9wu40pRB0OTKM6nIHw1emg/Bq7ZAlZ9S8OpJYitO4SU9J1sOjnI1K3O1QLWB3buGoMnH/1k+Tt7rvYajWyqBM4ODV9O3yN1G9zEEXxzK7sz84JPGAevNJo7fiu8YdaMXhxVywhN43q6PpPQqTdqwQ0muJ5FqJbAzmOiDSQtF18OfpORrKJXVOwD/iFUS4V/6WKqn9HDAc1Dff1CgqJ8IOqxO43Jj4gpvkH2Owzdyf
-  template:
-    metadata:
-      labels:
-        argocd.argoproj.io/secret-type: repository
-      name: repo-gitops-private
-      namespace: argocd
@@ -4,18 +4,11 @@ metadata:
  name: authentik-blueprints
  namespace: authentik
 data:
-  # Google is the only way in: its source has no enrollment flow, so a Google
-  # account can only log in when a user with the same email already exists.
  google-login.yaml: |
    version: 1
    metadata:
      name: Google login
    entries:
-      - model: authentik_blueprints.metaapplyblueprint
-        attrs:
-          identifiers:
-            path: default/flow-default-authentication-flow.yaml
-          required: true
      - model: authentik_blueprints.metaapplyblueprint
        attrs:
          identifiers:
@@ -48,8 +41,29 @@ data:
          provider_type: google
          user_matching_mode: email_link
      - model: authentik_stages_identification.identificationstage
+        id: google-identification
        identifiers:
-          name: default-authentication-identification
+          name: google-identification
        attrs:
          sources:
            - !KeyOf google
+          user_fields: []
+      - model: authentik_flows.flow
+        id: google-flow
+        identifiers:
+          slug: google-login
+        attrs:
+          authentication: require_unauthenticated
+          designation: authentication
+          name: Google login
+          title: Welcome!
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          order: 10
+          stage: !KeyOf google-identification
+          target: !KeyOf google-flow
+      - model: authentik_brands.brand
+        identifiers:
+          domain: authentik-default
+        attrs:
+          flow_authentication: !KeyOf google-flow
@@ -14,6 +14,20 @@ spec:
      namespace: traefik
      sectionName: websecure
  rules:
+    # The ArgoCD Android app posts to the token endpoint without its trailing slash
+    - backendRefs:
+        - name: authentik-server
+          port: 80
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              replaceFullPath: /application/o/token/
+              type: ReplaceFullPath
+      matches:
+        - path:
+            type: Exact
+            value: /application/o/token
    - backendRefs:
        - name: authentik-server
          port: 80
@@ -4,3 +4,4 @@ resources:
  - sealed-secret.yaml
  - blueprints.yaml
  - httproute.yaml
+  - referencegrant.yaml
@@ -0,0 +1,17 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: outpost
+  namespace: authentik
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: garage
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: qbit
+  to:
+    - group: ""
+      kind: Service
+      name: authentik-server
Author	SHA1	Message	Date
whyredfire	6452a8efcc	feat(apps): Add qbit	2026-09-26 20:55:42 +05:30
whyredfire	96db9b3511	feat(apps): Enable network policies for redoost	2026-09-26 11:49:21 +05:30
whyredfire	7b94d671e4	feat(authentik): Log in with Google only	2026-09-25 03:20:54 +05:30
whyredfire	f553fd3cd9	fix(authentik): Accept token requests without trailing slash	2026-09-25 03:14:16 +05:30
whyredfire	ca90f591bd	feat(argocd): Use PKCE for OIDC login	2026-09-25 03:07:31 +05:30
whyredfire	b91cc2409c	feat(apps): Put garage-ui behind authentik forward-auth	2026-09-25 02:35:12 +05:30