feat(argocd): Disable local admin account

apps/garage-ui/httproute.yaml

@@ -14,23 +14,9 @@ spec:
       namespace: traefik
       sectionName: websecure
   rules:
-    - backendRefs:
-        - name: authentik-server
-          namespace: authentik
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /outpost.goauthentik.io
     - backendRefs:
         - name: garage-ui
           port: 80
-      filters:
-        - extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: authentik
-          type: ExtensionRef
       matches:
         - path:
             type: PathPrefix

apps/garage-ui/kustomization.yaml

@@ -2,5 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
-  - middleware.yaml
   - httproute.yaml

apps/garage-ui/middleware.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: authentik
-  namespace: garage
-spec:
-  forwardAuth:
-    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-    trustForwardHeader: true

apps/qbit/deployment.yaml

@@ -1,126 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: qbittorrent
-  namespace: qbit
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: qbittorrent
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: qbittorrent
-    spec:
-      containers:
-        - env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: Etc/UTC
-            - name: WEBUI_PORT
-              value: "8080"
-            - name: TORRENTING_PORT
-              value: "6881"
-          image: lscr.io/linuxserver/qbittorrent:5.2.3_v2.0.15-ls478
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          name: qbittorrent
-          ports:
-            - containerPort: 8080
-              name: http
-          volumeMounts:
-            - mountPath: /config
-              name: config
-            - mountPath: /downloads
-              name: downloads
-      dnsConfig:
-        nameservers:
-          - 127.0.0.1
-      dnsPolicy: None
-      initContainers:
-        - args:
-            - ip rule del table 51820; ip -6 rule del table 51820; exec /gluetun-entrypoint
-          command:
-            - /bin/sh
-            - -c
-          env:
-            - name: VPN_SERVICE_PROVIDER
-              value: custom
-            - name: VPN_TYPE
-              value: wireguard
-            - name: WIREGUARD_IMPLEMENTATION
-              value: kernelspace
-            - name: WIREGUARD_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_PRIVATE_KEY
-                  name: wireguard
-            - name: WIREGUARD_PUBLIC_KEY
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_PUBLIC_KEY
-                  name: wireguard
-            - name: WIREGUARD_ADDRESSES
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_ADDRESSES
-                  name: wireguard
-            - name: WIREGUARD_ENDPOINT_IP
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_ENDPOINT_IP
-                  name: wireguard
-            - name: WIREGUARD_ENDPOINT_PORT
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_ENDPOINT_PORT
-                  name: wireguard
-            - name: WIREGUARD_MTU
-              value: "1280"
-            - name: WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL
-              value: 25s
-            - name: FIREWALL_INPUT_PORTS
-              value: "8080"
-            - name: HEALTH_VPN_DURATION_INITIAL
-              value: 30s
-            - name: TZ
-              value: Etc/UTC
-          image: qmcgaw/gluetun:v3.41.3
-          livenessProbe:
-            exec:
-              command:
-                - /gluetun-entrypoint
-                - healthcheck
-            periodSeconds: 30
-            timeoutSeconds: 10
-          name: gluetun
-          restartPolicy: Always
-          securityContext:
-            capabilities:
-              add:
-                - NET_ADMIN
-          startupProbe:
-            exec:
-              command:
-                - /gluetun-entrypoint
-                - healthcheck
-            failureThreshold: 30
-            periodSeconds: 5
-            timeoutSeconds: 5
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: qbit-config-pvc
-        - hostPath:
-            path: /srv/media
-          name: downloads

apps/qbit/httproute.yaml

@@ -1,37 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: qbittorrent
-  namespace: qbit
-spec:
-  hostnames:
-    - qbit.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    - backendRefs:
-        - name: authentik-server
-          namespace: authentik
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /outpost.goauthentik.io
-    - backendRefs:
-        - name: qbittorrent
-          port: 8080
-      filters:
-        - extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: authentik
-          type: ExtensionRef
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/qbit/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - sealed-secret.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - middleware.yaml
-  - httproute.yaml

apps/qbit/middleware.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: authentik
-  namespace: qbit
-spec:
-  forwardAuth:
-    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-    trustForwardHeader: true

apps/qbit/pvc.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: qbit-config-pvc
-  namespace: qbit
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 500Mi

apps/qbit/sealed-secret.yaml

@@ -1,17 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: wireguard
-  namespace: qbit
-spec:
-  encryptedData:
-    WIREGUARD_ADDRESSES: AgCUjKDTHlj+cDz5QmTdFrQ2uzgf2h7nHIB22Hiy8dNQoHPmpl42IS8pWMM3cC7/RQ620XX3Gvnjt7w3N+cRHsxZONCtBaocM/B4lBxgkrqoBuMISQ90oeqeL16ZWd6yDPmzgJLG0JfWPEuGkXsCkMHKg2cTQwZeIhoI0jiiUIKtY0q3YA19cSaf9gX0buQyu84hy6oi7Y2l0EXqwcbHJP2NEAWmxXuHF1nKtcSnAUlsHGCfomHLtSPoyoR0Ug3CER60oE18JIYmbt+iFL4Oalx4nKFoJbkD+dPLx/Do7kylySVqX5DAj1ivIQjyqZmcsyaigP01OU+poSM0D94mhMt8Dfi+ZOzDemoVDKtJlOYNfskk0hLdbLdGk6DzlONl7KBjduzbSk7BnFlr5bRNeKYFiDpg5I1y2FKROpmFCvV2pzqlLFl0C2BTwZU1dAj2Qk+ouUdhzzxEKqS2Q/CUUIftepqKIYzMJncFDbEjt5gAB0DJOt6FWiNG9TV3v+oSdzqn9UFPTIP1SO3IhyVoICDGmo829ki104ZnvjVciuPLH85l5rSdQI6qJuabLXylqTU8tmebTXDJZw/kBD+hw4ycCgD1kQssZM3djjy/RbMhY4zrpN345jelr9Z5kQsINcDBPfyCjCm/Eo6PM/fiuCkNP/KrKHI6C+NkyFHWk14ZeYODJI8GYakRO6SCRZ1G/SWJxA5DfZcuojweGD0G
-    WIREGUARD_ENDPOINT_IP: AgBKPD8cgNPVl7YTUsKkDRioPFCLNg+q+PGYiN5Qvw5nAvhh8tmUiV3JlkdtUHp/ggC8Fn+bLsNPRjjQoa02F8wZv1oxO1XeThNtxX49xlcLiFsw83wtL/pKQcNShml+HClsiCXN569g9NkcCY4R13tcSZPRbVs+oV95sGeUtfx/Ukh4g/URX1Z0aKzI2RE1ENMLQMXkVrrk7GJdqKBBsW76wHcTHw3DgcshMhlgcDwLiX4b+e5nAOzjlcwEKm6EBxXz2NuHP9PTkzfvK9QSSZJ7GLlac7eqFWj+xir8k1s1bIzB/suNMIzpo0bvOUjpxmoI54Xd4/hZ6fXkEF7lD1DwK7G/RV9+XNePPX+lGSJ9gQMIadmK3P6jHNnl/+RtqUk3mQ35r3Tl1Tmz3mhhK3/YalL6/8zWesNVYt6D4yQkFi3GFnc02Htl7/CyU+r5a3TwE3xUl/VNtkhHklrL8obF/cCORbFlYcwT2tbYl1av/3slJ8UsG+DXEX62+o6Tpt70Mzhcj61mQ2H/Emb5d7FPYlohogM1e37YY6lJhbjZeNHxxKvki8kusPa/eY8ZAdJcpd41/0rrL3uSOOZqqELNuTzqQKRhb6CDUGaoYFqSw9umDqwjdvfFQcYLQepn84HFILAlUfNF/InO6WrNh8jWGKx9SNsDfrJpY/RRyEJK8EoNIuelLdNP3phZhxUcQn/UBZ/M/UOzJZZ2xJPl
-    WIREGUARD_ENDPOINT_PORT: AgCOTc0MMWugdnF6Ou8mGgBGu5VD7zP6O3hGr+4YzW/UvCEARqwuoRXTKggUpFcZC0mNf1CdGCB1iRGCVWjnFJsw6zSudcJiWEVOtqLMfxxwZHhApiMtaHq4ERP4Hhu3jn/QwdwbYgk7rUoqsCRU2JelgPoYIhJh/2BtOz0z8PO+ktMIi5Qaj7m6O0zkxbzvqZaEbgkYsFCtQlaWqvghNk7GZB12KOOr0kU+Uu4vyi2ak7quoMjaQkMrRHOhhw0hk++FCXN9SNpDGyGBcqPtl/8ZRUyomLi76O3nsHX8QtXXj3yzDEwrdfwNzCwJXqI6HI4X2+/xSvnxI09wf5ei6D8gyJX8gkPQiqsXA4dsYvTUstf26Qlh/L6iQjB8RkXixBR1YwrIu/lLNO0FpFPqtLJu5jf1jMjZIn+oPl3GxAXcM+kRsX9YS5oJdD3rFFTz8HGthfOTSpaEgSnN2rF440vfIH8DKvTDH4cyR78C2Z8TWQ2hbDxXOX/NwxvPfidttyC3euLBc4Nkb/VX/DEU9W3QCB9yKuXw2KKSqnWHvIAReYLn5ex9czU+B+8IP2fJzTMDH7gOYqwtxuRMPu5bto0dn/120ZaLDBzGUHL38pBnMsYhssOGQlerpG32nT66IYdaZXTMD2UHsTwnNqu4/J98IY47n60wg3SVOVyZQ/dmS7Dfp8lPr/kE3+xNM8HWayCEKYxW
-    WIREGUARD_PRIVATE_KEY: AgAwJo1zxNRWXAinDWXvLajPWwHeWwAD8zOopE8Z8M5xAUDKWkTwZecR/ODI37bYQ22bb1+qjErBsqUHyT79adOmypY9DLW6YdY2YPkQwef33iXdgC1T7nV4pjI2TahiVab0z+5ot18A/FM9S7VHmRX4L+3ccO/oqcInNz5PFbsXp6U0dZZtiKWg7N5IzdT9dwDCknNFTv10URlHKE0Awff8jA34XGC8Ra/SvF3gSiaYjwd74HEBpnBMM5CsiveOyU1vCNxg93S12yrauC5jmD/ex5oEnJ4J1SziTUlB6e6ALpluA3AD91wuZ+wXeaJ0huNSz4g4sL6jm3OQykyiRx7jx/8FL3no0u3ydGPgYZ5MaEYXBtTk6ODFEhUZ7EGs9w8vip1SY/FijZYC3QT78R5WMim8gi1wf+TwmA8YRIDZW0CMhbtI32Ef2oDmb1Jzl58Igba8zQGTIqT7Htj6f4mpJk8gKSRIzkvLK6o+cynOpQzZBOZb+G7lZst4g+lILLjmfpFGJTVgogfEkuYV6ntuE3dGB2OmRGUW0vpDM4ZCkxYsjh/1kzSyOGVYtL0EHS689ehzUDUJLuJuvuwZIFUjOFCFofGP37rKCcSGouLNj+xWmcbCgx7si05rw8JMeAWE5YETaBbi55DDaUB98G97KM28OlPBDm8PtqdcBD4W2up34nowXdG0tZ38VsTV7xNyp+2A5saPQZ72wM1fQiUwGwoHRKdHB1ptF6u+0zr6tlQoiVE07BMQ8/ykAQ==
-    WIREGUARD_PUBLIC_KEY: AgBAElHBgsQNQ3l8CGLlKMmi9dMTLmgp4gseMgbEMW4sjOvhsAIeLGsuv+HuStvH+bfAp7U9Fh6pAlEZKPOdN5pbpoFjkTDC5VU8aKJcdO/+iZWURbULYBDyGK32Ss/0eCwIsdO7lFcSFy2T7XJFPn656lBx8gocBp9PMHRSoL2dELP9q8JyNr3nb84vZ8hwiBP3Gy8BITeeE4J7+DnF2SUg+4pc92gMOgmWL4LO25pI39Q1yKBw4tCOf4f4ETgmjRHv17WsFw2JZTgb1rmXFvvKWGzTPZbA1gajcRgTKY7DrzWFjFi/o84qjGC4feQ9vb5ZwnLN1MzU1yByQmxQiAOSCK+1SMrvUJ9dF2kE3zJw0fSGjU83iXcorpbe4YYFr4Y8k6mKSSthchYyQZp5FuB9N9J7vm4vv4kUbTGOtwHQFrKRNiB5PVVFqzUVYWs9CfFcodAu7JaCBHKzLj1X7xBLiQoWYpx7/LVTjoR/R9j/+bfblKlid+H322Oh4ReSuxVKfMmNiOGeueMOrGX+DhHtYFbGHmdc3aprjBkYanq71MV9kFRVAZd834IX4wWykQWWgmYtx+eZJs6DZRWhAaVbBQ9IY0vS4IjAInTpMN9yqNxJkZ+w1MJIeTG5S9NnB3xUjnOgSCow9r/IEVNFbT4CbsEXbMECQ3S0OIby8r3Zwt8J7NEphFYkLtsR+brtMLsWRHIw23mtSTZajLMaSHOG6fooZyNKYgYJGr0Spura2M6TjhW+f1csYKrkxA==
-    wgcf-account.toml: AgAaSo7eZz/CvAN1reUDhHzFWIcmQMopYloYitAYq5Zu6gXE+65ogq0Jr/S7WLTqdgL3KWWhSmlG+jpepC8cpomVrnPfydlw6or227dm0ND5XNEO1MwNOtzeGNS3q7ayB8NoC7qZVR33KqutGOZLbFawyTZUi4ItjW74SdvL/Ftd4VvqrG7hQtAd/2PP37mL0unw2DesL8hFUXTkvlzAdKHZGQMaYNcH73JWJwvlf95L6ncKdZXWEM0uJnjhAVE+sCpUEQK67mQcX4RrYairr1wwux2YYjwweAriXw7wzBDvOXnHqg3Ldmat0V7FMK0MeIzHhezy15AGLtYRonFcYzEznIl7P2FjjG4Yz0EAk0t1rJpQgV35NAybseQ8t/92+vPa7LaPcjUUKZ5Kx1a2SdihljtLEjzuIdvYN/tKPcselzehWWrbDl/qeQuwZABxj8z24moJmBqJcXpAigvX4XlDcWp0jHWQxbLDozKtYHKUEPmhAklVaDuVr+bY2jOxU4Nki3ybLYpi834CsifcSc7RAaruJIlnITZUR2VG7PMIoTObqfeYnSyZKabHadWHHdkoyYsJmSiWjadvlvBXtW+RTHVU8UsD8GdVS9wBpA6ZcRsegFiEAoMzdyZQNRabYjUeAxpA/lOtt/PH1FnIV588Of/lhypBdUF4rRYcCvVT0gFQjoe7ITsvEf/P+fLb3TO47fQtBqOmKqoD21yhtb8Y4GQ21XVmB1gJT+/oYjny9/YL5CuhJif0XoarJZHtvTb5Ubs716PRSmSvAoXI6jBMKVSssWtfMIedL03X+RAxyT3jvL/W/SEuN5D5a2RpjIswAIN5LQ3b9f7F/JgDIQKdIHUEm+Z430lS83RDsMpJ13SmRVoXzbAededT7r08DHu++sOvDfHeMy+lTD0aTaskbPWY5PLve7g7PWat9q+NMepgRC3z26JCw/08O4SGX/fUhxg709F5A8hf/LUSTNGRlQ==
-  template:
-    metadata:
-      name: wireguard
-      namespace: qbit

apps/qbit/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: qbittorrent
-  namespace: qbit
-spec:
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http
-  selector:
-    app.kubernetes.io/name: qbittorrent

argocd-apps/add-ons/argocd-repos.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: argocd-repos
+  namespace: argocd
+spec:
+  destination:
+    namespace: argocd
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: infra/argocd-repos
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

argocd-apps/add-ons/kustomization.yaml

@@ -1,7 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - anubis-operator.yaml
   - argocd-dashboard.yaml
+  - argocd-repos.yaml
   - authentik.yaml
   - cert-manager.yaml
   - cnpg.yaml

argocd-apps/services/garage-ui.yaml

@@ -27,7 +27,9 @@ spec:
                 name: garage-ui-secrets
             auth:
               admin:
-                enabled: false
+                enabled: true
+                existingSecret:
+                  name: garage-ui-secrets
               jwt_private_key_secret:
                 name: garage-ui-secrets
             cors:

argocd-apps/services/qbit.yaml

@@ -11,8 +11,8 @@ spec:
     server: https://kubernetes.default.svc
   project: default
   source:
-    path: apps/qbit
+    path: qbit
-    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops-private.git
     targetRevision: main
   syncPolicy:
     automated:

argocd-apps/services/redoost.yaml

@@ -39,19 +39,6 @@ spec:
             websiteUpstream: garage.garage.svc.cluster.local:3902
             bucket: redoost-sites
             existingSecret: redoost-s3
-          networkPolicy:
-            enabled: true
-            gateway:
-              - namespaceSelector:
-                  matchLabels:
-                    kubernetes.io/metadata.name: traefik
-            s3:
-              - namespaceSelector:
-                  matchLabels:
-                    kubernetes.io/metadata.name: garage
-                podSelector:
-                  matchLabels:
-                    app.kubernetes.io/name: garage
     - path: apps/redoost
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main

bootstrap/argocd-cm-oidc-patch.yaml

@@ -8,7 +8,6 @@ data:
     issuer: https://auth.whyredfire.dev/application/o/argocd/
     clientID: argocd
     clientSecret: $argocd-oidc:clientSecret
-    enablePKCEAuthentication: true
     requestedScopes:
       - openid
       - profile

infra/argocd-repos/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - repo-sealed-secret.yaml

infra/argocd-repos/repo-sealed-secret.yaml

@@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: repo-gitops-private
+  namespace: argocd
+spec:
+  encryptedData:
+    password: AgCYFWUZmqWTYbutOvQr0GJ87zvVwW/GYanXC4Qdlqo1nkYC0u/ve88UonB0UklJPfMq59/jefbrl80fg4JUMLJMBnNUiIfUIJ2gN07n5P1UqQGTFwo8iHFD4XwKlCfSD75wQXBhccWO1zS1lVZEIzbUdom7rI45bG2Q+u5NQBC/bs3NxrrzYqrHFsbE2jEeu0hG33JOoikvLOwih96Xxgadrvbdw/WpY2bbqM/BSA35u8fzeDF4ZZ98x7LPzflP04DxKJZLh5U3H1//RjWaKeNkDwp/dtNm63NPJrh7+rD+EOHu4undBwNHIW4vrv4bRQeP4xBERNFquiwwmQsi2Wwd4kpD+kgbGhezYMDgk8FOBwS04DJJJpvYdJdGTZoCwML1C+iwMoKhwk7WFvg4vkW3DBpRh+w9Otdq4odsklqgwp1o8OXL1hcd/iQqp8TiuwUFlmJhTs841xvqRMuCBQ0SnAwQ/u9kEsY6C6r/EvdaOciRoEWa0pMk3zvkaCrSkoAElYtXh30MhGfd1rbWT09Xvh/ACRjarBvLHUa7fPSc9Po9t+6eRuFR1cqT2jwUtHMuAqFA4XDC+oHkLsz8WD8qm4K9dwfOXME1rT2OoByaSdlSDsV6uKWRlMxxrzBGzihUBp1TSI8X+ux90hp5vQ30BKqGCC0Y3aRHprndDcHvdP4ASJ6++uu3ZkD6cY/he87w21ETl9+zxo8=
+    type: AgBWyIT44g9RaY/2dyznsXqQ3lVS0q/zJ5MeQhqkREsCn37U8ZxUrVqrmYq+RJU+cPVDWSl2tnmnfjvzV6+SEroVPAaTduRSFYxP6X4xsFuarJ21GSOAvt4Zc1ODZXYxCKfEAB+K7djc+g4+WOp/RihxKue9sevsM2krxnBXouNn7gXOog2Vd7mHbenuuGNVzV6ROJU7tw3uzZ/KETqr+5Jr1bKf64URkcN1njxb9lJHmK+VJbWPLcIbaGCfel07QqX0+EQXjIMwvpHoiWF25dJfPtbADlF/UIjWRXRRh5pCoppXpte39S4nrkkyOKCe2l7IctYF6+pvg5xNOmPeYnqIxpgZwWlWg2TcI5pn4aTxyXA+COJs5VQYgGDxPyNmm2lqh77hzHFceTxlFjtS5u5UQBzjagClXg2lYi2YRcnMTLUHDJyisT9Gr7bpgRK1BU19yxMg5f+vhzL5GmPMtOE6r9dZXwbi5660Okrn7x1MEgHb7poiXbG920yEC3mqVB6+1HLzoY5603b44VafDCTh2AtslSEW8n4Dt1gBm8DAOcDvq1e3NMn8Aq7cyGF5L7x0WwXLjgjr26nf6XiyZ9NAOD2upyJDCZvvVqcFypqOFsFOyhZXU86vuRW35tNqq6N3ppL2OFmm84ies04InHGTJHS3ps8KCyXWow1PgGhn/spB73JSjW4nsUztQPThOQ2c2JY=
+    url: AgDV+GO2ccs/uj87TNXbhSA18Y8amZiqmasZcijd/Zpjv8LPw94f9PORC1v9DhautblXF+Y39MnBjQm3pYLEbIU7FBDpx/Kkk34+F/tTfJqmQOcvGjEZLs73I7kvvy9Uy2Wme/uJt4PpR3UyJEAwJKNudC2NAJz2gfS7lsk+6AUpc+Z6MBoETdUQuaYlk/cxliWnPbJx8EYOS0TEaLezZ27w1OeN2kYEtnZ+qRd/+6g68MpM6UeoL53kOwNOcXN67+IdPE17zD05I0SPIKJy760Ukw/S1sphUpfQgOueHpmgpQanzJWZDCyudLpgnWS/cVWmZY0tDcgmiWCVJwYVFML8Qse3oXWRixIIunhMSS8jFk8Sa/v0agY8SOeIEWIx7n6G6jGkBLK5QZ8Y689UqsfsuKy3aUxno3gqzz4WibjdwAJfNsWCb3P6ZH2AfeTw7gz9HD/AiMRGuSTlzZpGS4acyltwbkKKz1WwLZF/qXtL0hi7QrYIPK82hKF7s458s0KQG2lE+bWOUG0WGjMWys6FwEbe5p3OTT2ea45+OyL0BlFQFkXHeIlxpq86Iz2KVxy4age5SghpSBn3+S3NM4voo9QDIeLXF++EOLCQXRXHgp4vOnb/nAVkbfQ6cvs2HBVg4lSYaNlBlznkPORiUNvXuu2JKHeKzXEJWhwIvmXrnac629MEaCCONEiBaTAy3B08WjSzvWUkxXYuBrRvrcm/JOP8K2yNgtJTRGGbH9SbMTJ8RoqgMC+GjokIFvlButxh0MeXlQLk0huV
+    username: AgBB0XO+j5xoMAgvbIKEf0/ghe9rPwoTnzZvm4lbakuCc4BEKl1Zm5bkNQilEBpxl/TsfnxdhhGnNvF9DXbIJjoEfEU8wzX5LpBMXt5qWC1Oquul4qvEHw6kMCu3oJ7hQ54yBVIhM5W9n1c6UWhJ6ttwZJ/ymqGLFWh1r/3KhoiInfU2EkPJ7bte085rUuyT524mwH9pfGEwte6VjuHPXBQt22i4fP+BBT3pV443PISshGfQC28bpt8vMi83kE/ICkwg21AQUImvfcHXojUJE5dks4mbrA49532R4uDVseVxCrW5fCtevQmgHbkyOke3FQG1AspXx7gdLldKVeW7QBgDP6O9DuEZgNzrxY6T4jf2dNUi1y5W00A4hJVMvIyBy4wENGIj1JJto6D1pRbYPzugKzUhb529UHS6Oxy3H2GqoE5L+mTbrQ2Nm8OhLeaSXUqQtJreZg9GYDZ3sjTe5tlqmcRisM43D5Aw/vV9wu40pRB0OTKM6nIHw1emg/Bq7ZAlZ9S8OpJYitO4SU9J1sOjnI1K3O1QLWB3buGoMnH/1k+Tt7rvYajWyqBM4ODV9O3yN1G9zEEXxzK7sz84JPGAevNJo7fiu8YdaMXhxVywhN43q6PpPQqTdqwQ0muJ5FqJbAzmOiDSQtF18OfpORrKJXVOwD/iFUS4V/6WKqn9HDAc1Dff1CgqJ8IOqxO43Jj4gpvkH2Owzdyf
+  template:
+    metadata:
+      labels:
+        argocd.argoproj.io/secret-type: repository
+      name: repo-gitops-private
+      namespace: argocd

infra/authentik/blueprints.yaml

@@ -4,11 +4,18 @@ metadata:
   name: authentik-blueprints
   namespace: authentik
 data:
+  # Google is the only way in: its source has no enrollment flow, so a Google
+  # account can only log in when a user with the same email already exists.
   google-login.yaml: |
     version: 1
     metadata:
       name: Google login
     entries:
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: default/flow-default-authentication-flow.yaml
+          required: true
       - model: authentik_blueprints.metaapplyblueprint
         attrs:
           identifiers:
@@ -41,29 +48,8 @@ data:
           provider_type: google
           user_matching_mode: email_link
       - model: authentik_stages_identification.identificationstage
-        id: google-identification
         identifiers:
-          name: google-identification
+          name: default-authentication-identification
         attrs:
           sources:
             - !KeyOf google
-          user_fields: []
-      - model: authentik_flows.flow
-        id: google-flow
-        identifiers:
-          slug: google-login
-        attrs:
-          authentication: require_unauthenticated
-          designation: authentication
-          name: Google login
-          title: Welcome!
-      - model: authentik_flows.flowstagebinding
-        identifiers:
-          order: 10
-          stage: !KeyOf google-identification
-          target: !KeyOf google-flow
-      - model: authentik_brands.brand
-        identifiers:
-          domain: authentik-default
-        attrs:
-          flow_authentication: !KeyOf google-flow

infra/authentik/httproute.yaml

@@ -14,20 +14,6 @@ spec:
       namespace: traefik
       sectionName: websecure
   rules:
-    # The ArgoCD Android app posts to the token endpoint without its trailing slash
-    - backendRefs:
-        - name: authentik-server
-          port: 80
-      filters:
-        - type: URLRewrite
-          urlRewrite:
-            path:
-              replaceFullPath: /application/o/token/
-              type: ReplaceFullPath
-      matches:
-        - path:
-            type: Exact
-            value: /application/o/token
     - backendRefs:
         - name: authentik-server
           port: 80

infra/authentik/kustomization.yaml

@@ -4,4 +4,3 @@ resources:
   - sealed-secret.yaml
   - blueprints.yaml
   - httproute.yaml
-  - referencegrant.yaml

infra/authentik/referencegrant.yaml

@@ -1,17 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: ReferenceGrant
-metadata:
-  name: outpost
-  namespace: authentik
-spec:
-  from:
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: garage
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: qbit
-  to:
-    - group: ""
-      kind: Service
-      name: authentik-server