From db3c8e46948081e3ffce07409a7cf37ed07d4aa6 Mon Sep 17 00:00:00 2001 From: ahmza Date: Fri, 16 Oct 2026 16:46:10 +0000 Subject: [PATCH] Enable production TLS for Authentik --- apps/authentik/values.yaml | 7 +++---- docs/network.md | 1 + 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/authentik/values.yaml b/apps/authentik/values.yaml index 87f0951..d6506b3 100644 --- a/apps/authentik/values.yaml +++ b/apps/authentik/values.yaml @@ -90,14 +90,13 @@ authentik: cpu: "2" memory: 2Gi # Route the LAN hostname through the cluster's shared ingress-nginx IP. - # Prove DNS-01 issuance against Let's Encrypt staging first; switch this - # annotation to letsencrypt-prod only after the staging Certificate is - # Ready and HTTPS routing has been tested. + # DNS-01 issuance and HTTPS routing were proven against Let's Encrypt's + # staging service before switching to this browser-trusted issuer. ingress: enabled: true ingressClassName: nginx annotations: - cert-manager.io/cluster-issuer: letsencrypt-staging + cert-manager.io/cluster-issuer: letsencrypt-prod hosts: - auth.ahmza.com tls: diff --git a/docs/network.md b/docs/network.md index 313931b..c9d1e0c 100644 --- a/docs/network.md +++ b/docs/network.md @@ -84,6 +84,7 @@ Cloudflare; internal overrides are served by Technitium where noted. | Hostname | App | Namespace | TLS | Source | |---|---|---|---|---| | `demo.ahmza.com` | Demo app | `demo` | Yes — `letsencrypt-prod`, real trusted cert (see [`docs/12-cert-manager.md`](12-cert-manager.md)) | [`apps/demo/ingress.yaml`](../apps/demo/ingress.yaml) | +| `auth.ahmza.com` | Authentik identity provider | `authentik` | Configured for `letsencrypt-prod`; staging certificate and HTTPS routing verified; Technitium routes LAN clients to `10.10.60.12` | [`apps/authentik/values.yaml`](../apps/authentik/values.yaml) | | `mc.ahmza.com` | Packwiz modpack files | `mcpacks` | Yes — `letsencrypt-prod`, real trusted certificate | [`apps/mcpacks/ingress.yaml`](../apps/mcpacks/ingress.yaml) | | `bazarr.ahmza.com` | Bazarr subtitle manager | `bazarr` | Yes — `letsencrypt-prod`, real trusted certificate; Technitium overrides Cloudflare's NetBird route on the LAN | [`apps/bazarr/ingress.yaml`](../apps/bazarr/ingress.yaml) | | `soulsync.ahmza.com` | SoulSync media discovery | `soulsync` | Configured for `letsencrypt-prod`; verify the certificate after the first deployment; Technitium routes LAN clients to `10.10.60.12` | [`apps/soulsync/ingress.yaml`](../apps/soulsync/ingress.yaml) |