Complete Authentik Kubernetes cutover

apps/authentik/values.yaml

@@ -67,9 +67,9 @@ authentik:
     enabled: false
 
   server:
-    # Final-cutover maintenance window: prevent writes to the destination while
-    # its trial snapshot is replaced. Return this to 1 after the final restore.
-    replicas: 0
+    # One server is sufficient for this homelab; Kubernetes recreates it if the
+    # Pod fails, while PostgreSQL and uploaded files live on persistent storage.
+    replicas: 1
     # UID/GID 1000 matches the restored Docker files and satisfies this
     # namespace's restricted Pod Security policy without running as root.
     securityContext:
@@ -107,9 +107,9 @@ authentik:
             - auth.ahmza.com
 
   worker:
-    # Workers run scheduled jobs, source synchronization, and other background
-    # tasks. Keep them off while the original VM remains authoritative.
-    replicas: 0
+    # One worker handles scheduled jobs, source synchronization, email, and
+    # management of Kubernetes-native outposts.
+    replicas: 1
     securityContext:
       runAsNonRoot: true
       runAsUser: 1000