ahmza.com/k8s-starter-pack
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable production TLS for Authentik

Browse Source
This commit is contained in:
ahmza
2026-10-16 16:46:10 +00:00
parent a8431d15c6
commit db3c8e4694
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/authentik/values.yaml
+3 -4
View File
@@ -90,14 +90,13 @@ authentik:
cpu: "2" cpu: "2"
memory: 2Gi memory: 2Gi
# Route the LAN hostname through the cluster's shared ingress-nginx IP. # Route the LAN hostname through the cluster's shared ingress-nginx IP.
# Prove DNS-01 issuance against Let's Encrypt staging first; switch this # DNS-01 issuance and HTTPS routing were proven against Let's Encrypt's
# annotation to letsencrypt-prod only after the staging Certificate is # staging service before switching to this browser-trusted issuer.
# Ready and HTTPS routing has been tested.
ingress: ingress:
enabled: true enabled: true
ingressClassName: nginx ingressClassName: nginx
annotations: annotations:
cert-manager.io/cluster-issuer: letsencrypt-staging cert-manager.io/cluster-issuer: letsencrypt-prod
hosts: hosts:
- auth.ahmza.com - auth.ahmza.com
tls: tls:
docs/network.md
+1
View File
@@ -84,6 +84,7 @@ Cloudflare; internal overrides are served by Technitium where noted.
| Hostname | App | Namespace | TLS | Source | | Hostname | App | Namespace | TLS | Source |
|---|---|---|---|---| |---|---|---|---|---|
| `demo.ahmza.com` | Demo app | `demo` | Yes — `letsencrypt-prod`, real trusted cert (see [`docs/12-cert-manager.md`](12-cert-manager.md)) | [`apps/demo/ingress.yaml`](../apps/demo/ingress.yaml) | | `demo.ahmza.com` | Demo app | `demo` | Yes — `letsencrypt-prod`, real trusted cert (see [`docs/12-cert-manager.md`](12-cert-manager.md)) | [`apps/demo/ingress.yaml`](../apps/demo/ingress.yaml) |
| `auth.ahmza.com` | Authentik identity provider | `authentik` | Configured for `letsencrypt-prod`; staging certificate and HTTPS routing verified; Technitium routes LAN clients to `10.10.60.12` | [`apps/authentik/values.yaml`](../apps/authentik/values.yaml) |
| `mc.ahmza.com` | Packwiz modpack files | `mcpacks` | Yes — `letsencrypt-prod`, real trusted certificate | [`apps/mcpacks/ingress.yaml`](../apps/mcpacks/ingress.yaml) | | `mc.ahmza.com` | Packwiz modpack files | `mcpacks` | Yes — `letsencrypt-prod`, real trusted certificate | [`apps/mcpacks/ingress.yaml`](../apps/mcpacks/ingress.yaml) |
| `bazarr.ahmza.com` | Bazarr subtitle manager | `bazarr` | Yes — `letsencrypt-prod`, real trusted certificate; Technitium overrides Cloudflare's NetBird route on the LAN | [`apps/bazarr/ingress.yaml`](../apps/bazarr/ingress.yaml) | | `bazarr.ahmza.com` | Bazarr subtitle manager | `bazarr` | Yes — `letsencrypt-prod`, real trusted certificate; Technitium overrides Cloudflare's NetBird route on the LAN | [`apps/bazarr/ingress.yaml`](../apps/bazarr/ingress.yaml) |
| `soulsync.ahmza.com` | SoulSync media discovery | `soulsync` | Configured for `letsencrypt-prod`; verify the certificate after the first deployment; Technitium routes LAN clients to `10.10.60.12` | [`apps/soulsync/ingress.yaml`](../apps/soulsync/ingress.yaml) | | `soulsync.ahmza.com` | SoulSync media discovery | `soulsync` | Configured for `letsencrypt-prod`; verify the certificate after the first deployment; Technitium routes LAN clients to `10.10.60.12` | [`apps/soulsync/ingress.yaml`](../apps/soulsync/ingress.yaml) |