# The trial server is enabled only after the source database and files have
# been restored. Its worker and Ingress remain disabled until cutover, which
# prevents background jobs and production traffic reaching this clone.
authentikDeployment:
  enabled: true

authentik:
  global:
    # CloudNativePG generates this connection Secret. Referencing individual
    # keys avoids duplicating its generated database password in Git or SOPS.
    env:
      - name: AUTHENTIK_POSTGRESQL__HOST
        valueFrom:
          secretKeyRef:
            name: authentik-postgres-app
            key: host
      - name: AUTHENTIK_POSTGRESQL__PORT
        valueFrom:
          secretKeyRef:
            name: authentik-postgres-app
            key: port
      - name: AUTHENTIK_POSTGRESQL__NAME
        valueFrom:
          secretKeyRef:
            name: authentik-postgres-app
            key: dbname
      - name: AUTHENTIK_POSTGRESQL__USER
        valueFrom:
          secretKeyRef:
            name: authentik-postgres-app
            key: username
      - name: AUTHENTIK_POSTGRESQL__PASSWORD
        valueFrom:
          secretKeyRef:
            name: authentik-postgres-app
            key: password
      # `require` encrypts traffic to PostgreSQL without depending on a public
      # CA; CloudNativePG rotates its private in-cluster certificates itself.
      - name: AUTHENTIK_POSTGRESQL__SSLMODE
        value: require

    # The same Longhorn claim carries three restored source directories. Each
    # subPath is mounted where the upstream container expects it.
    volumes:
      - name: authentik-data
        persistentVolumeClaim:
          claimName: authentik-data
    volumeMounts:
      - name: authentik-data
        mountPath: /data
        subPath: data
      - name: authentik-data
        mountPath: /templates
        subPath: custom-templates
      - name: authentik-data
        mountPath: /certs
        subPath: certs

  authentik:
    # This SOPS-managed Secret contains the source installation's exact secret
    # key, preserving encrypted configuration and existing identity semantics.
    existingSecret:
      secretName: authentik-secrets

  # CloudNativePG supplies PostgreSQL; do not deploy the bundled database.
  postgresql:
    enabled: false

  server:
    replicas: 1
    # UID/GID 1000 matches the restored Docker files and satisfies this
    # namespace's restricted Pod Security policy without running as root.
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      fsGroup: 1000
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      seccompProfile:
        type: RuntimeDefault
    resources:
      requests:
        cpu: 250m
        memory: 512Mi
      limits:
        cpu: "2"
        memory: 2Gi
    # Test through kubectl port-forward first. Ingress is enabled only after
    # the clone is verified and the final source snapshot has been restored.
    ingress:
      enabled: false

  worker:
    # Workers run scheduled jobs, source synchronization, and other background
    # tasks. Keep them off while the original VM remains authoritative.
    replicas: 0
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      fsGroup: 1000
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      seccompProfile:
        type: RuntimeDefault