# Authentik is deployed from its official Helm chart, while this repository's
# wrapper chart also owns its PostgreSQL cluster, backups, and persistent data.
# The database is created first with Authentik disabled so the existing Docker
# database can be restored before any new server or worker touches it.
#
# Deliberately NO resources-finalizer.argocd.argoproj.io here. This Application
# owns identity data, and deleting its Git entry must not cascade into deleting
# PostgreSQL or Authentik's uploaded files.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: authentik
  namespace: argocd
spec:
  project: default

  source:
    repoURL: https://tea.ahmza.com/ahmza.com/k8s-starter-pack.git
    targetRevision: main
    path: apps/authentik

  destination:
    server: https://kubernetes.default.svc
    namespace: authentik

  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true