From 0663196fa02d1071568e7de05e2cb3dc767f6dc2 Mon Sep 17 00:00:00 2001
From: ahmza <hamza@ahmza.com>
Date: Fri, 16 Oct 2026 16:38:43 +0000
Subject: [PATCH] Expose Authentik through staging HTTPS

---
 apps/authentik/values.yaml | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/apps/authentik/values.yaml b/apps/authentik/values.yaml
index df79450..87f0951 100644
--- a/apps/authentik/values.yaml
+++ b/apps/authentik/values.yaml
@@ -89,10 +89,21 @@ authentik:
       limits:
         cpu: "2"
         memory: 2Gi
-    # Test through kubectl port-forward first. Ingress is enabled only after
-    # the clone is verified and the final source snapshot has been restored.
+    # Route the LAN hostname through the cluster's shared ingress-nginx IP.
+    # Prove DNS-01 issuance against Let's Encrypt staging first; switch this
+    # annotation to letsencrypt-prod only after the staging Certificate is
+    # Ready and HTTPS routing has been tested.
     ingress:
-      enabled: false
+      enabled: true
+      ingressClassName: nginx
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt-staging
+      hosts:
+        - auth.ahmza.com
+      tls:
+        - secretName: authentik-tls
+          hosts:
+            - auth.ahmza.com
 
   worker:
     # Workers run scheduled jobs, source synchronization, and other background