[READ-ONLY] Mirror of https://github.com/tiborpilz/infrastructure. Personal Infrastructure managed via terraform & k8s
feat: serve authentik blueprints via configmap and own forgejo oidc secret
Tibor Pilz
(Jun 23, 2026, 9:33 AM +0200)
2e79f680
6cca2857
+52
-43
+16
-3
applications/authentik/argo-app.yaml
+16
-3
applications/authentik/argo-app.yaml
···
26
26
name: authentik-seed-passwords
27
27
optional: true
28
28
- secretRef:
29
-
name: authentik-env-secrets
30
-
optional: true
31
-
- secretRef:
32
29
name: authentik-oidc-clients
33
30
optional: true
34
31
env:
···
37
34
secretKeyRef:
38
35
name: authentik-db-app
39
36
key: password
37
+
# Surfaced as the blueprint `!Env FORGEJO_OIDC_CLIENT_SECRET` lookup
38
+
# in applications/forgejo/blueprints/oidc.yaml. Same `forgejo-oidc`
39
+
# Secret is reflected to the forgejo namespace and consumed by the
40
+
# forgejo helm chart — single source of truth.
41
+
- name: FORGEJO_OIDC_CLIENT_SECRET
42
+
valueFrom:
43
+
secretKeyRef:
44
+
name: forgejo-oidc
45
+
key: secret
46
+
optional: true
40
47
41
48
authentik:
42
49
existingSecret:
···
66
73
seccompProfile:
67
74
type: RuntimeDefault
68
75
volumes:
76
+
- name: blueprints
77
+
configMap:
78
+
name: authentik-blueprints
69
79
- name: users-blueprint
70
80
secret:
71
81
secretName: authentik-users-blueprint
···
76
86
secret:
77
87
secretName: tine-password
78
88
volumeMounts:
89
+
- name: blueprints
90
+
mountPath: /blueprints/custom
91
+
readOnly: true
79
92
- name: users-blueprint
80
93
mountPath: /blueprints/managed
81
94
readOnly: true
+36
-40
applications/authentik/secrets.enc.yaml
+36
-40
applications/authentik/secrets.enc.yaml
···
1
1
apiVersion: isindir.github.com/v1alpha3
2
2
kind: SopsSecret
3
3
metadata:
4
-
name: authentik-env-secrets
4
+
name: forgejo-oidc
5
5
namespace: authentik
6
6
spec:
7
7
secretTemplates:
8
-
# Authentik worker `envFrom`s this for blueprint !Env lookups. Argo CD's client secret is owned by terraform (authentik-oidc-clients
9
-
- name: authentik-env-secrets
10
-
stringData:
11
-
FORGEJO_OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:E5OIN9J9jEJFDqUvYyW8aR3EGAXWvx9XhvLG0Ji3C7bPkD/f4bjH7XQNRtWxvtZLWAndrRwlUwkUWodIAOqUOg==,iv:xLy7Hox2SIBATB9BTYBCSC6gPjfvK8t1Wp4kfe9um+c=,tag:93fKp+47amgwgDMtezNU/A==,type:str]
12
8
- name: forgejo-oidc
13
9
annotations:
14
10
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
···
16
12
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
17
13
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: forgejo
18
14
stringData:
19
-
key: ENC[AES256_GCM,data:EEcyvAe7HA==,iv:K8vOd/q42gCPvPNok+aLAJUvZRJXOUFvob3E9RnF+YY=,tag:1S/xy+HuzQHNtWLazHkYYg==,type:str]
20
-
secret: ENC[AES256_GCM,data:15oBLXMjEAOIkMHza52PahHFzQvq7aRwHU5YrA5WOQMDtTfXFfDyg47RPjDX9gCK9D2TONnxB80zpBi5xVkrag==,iv:zzMZbjEyhrXYIPInRx3AsuT9VQlXgsmWp0pCOfU6FrU=,tag:PHAnaHA7ci71ge+LCuPlmg==,type:str]
15
+
key: ENC[AES256_GCM,data:oO4pgboDGw==,iv:JDkZivBuLTFIEnO5wjcVA0UfK+52lLC830QLwWiRHPU=,tag:PjZ3UCSq9uo0XJxqRo8y6Q==,type:str]
16
+
secret: ENC[AES256_GCM,data:r5sTIbreQR5fo4NsfVUUqW/2+QMrr/rgvNBK3IUy4XsvTzklhPn6jcxq5InZM6lvr4lhuhR6eGwU74GC/AIeNQ==,iv:2Mh1JTjToufyBS8FinYpwEMronOBQYtzueUwV4oojY0=,tag:22HYFOD3DSE7rEE5SPVPyw==,type:str]
21
17
sops:
22
18
age:
23
19
- recipient: age1nhsx40cf26syk9jt8hkd0grdrc9qc45sk52cl5vy0d78fxl2f4hs4h7laa
24
20
enc: |
25
21
-----BEGIN AGE ENCRYPTED FILE-----
26
-
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmMk1hcTROWXZ1c3Ezc0E1
27
-
Ukl4SUpxYXdKdDB2S0pJTmJxZ1R0RGxMb0IwClZjRHV2RnAyWUQzY3I1Qk8zNnJr
28
-
SzladklmTWtMdFN4Y0VFRWVsSEN6akUKLS0tIHc2VEFqVVRRb3NiK3FLcE4zV2Fk
29
-
d2YvWXd2dnE2Z251SWkyMDlRejFnV0UKIC9OObgmzXbekQlBImclAE8wGtzWWj7B
30
-
Y61x/dCcmh2AiRe3ugkZhwwVnCVsgdyNAbxavBY4BoOxG+GSlDy/3g==
22
+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDMDFZWk52cVlUd3BVUUpw
23
+
TG4wdlVCdnY0WmRnclFXYUFhOXVxMFZpQ2tZCmMwVjZlaU5vS3M2eWQ5by9lK1Zm
24
+
cE1WdWczV3VtTm9uSDZvMTJaU2R5UG8KLS0tIFZubmsvQnhpdnQ4eG5QMkhTTjdE
25
+
MGRPUit6WHF0UUVuWk9rR3VEWGtEQzQKECPD8bGG0DIZU5ACV0xDnZxqKShTJ4B8
26
+
KuDXLizuZBOKMWPj19Wu0+zF+2IO3e0eTXy/rwCg1Xp9h892hjw+CQ==
31
27
-----END AGE ENCRYPTED FILE-----
32
28
- recipient: age1gzf883y8p0wfy5yjn5l3l2axnqxdgtw2zdcp8jqsrk65m7gf6y6qzgkf63
33
29
enc: |
34
30
-----BEGIN AGE ENCRYPTED FILE-----
35
-
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3QUVRZnlPY21wdHVqY2xM
36
-
Qm9wRkdWYlVZK3lacDgrQkwvZzkySlpxM2t3CkVIcHVycHFPSHVsQ3oxQzZWd0Ur
37
-
Mk0rOU1iNDVoMEpSN1plYVk2M0JQRFUKLS0tIEkvMm0xQjhYWk82MFRPV2Q4N3Yr
38
-
ak5Ja293MFExYm9XNCtCaWVUOFMzVjgKfJ7AfKHOy3bpkYvuSylMS4s7m5JGrZTj
39
-
DrLz7QWahrkh6WA1GuM263PAfSfRpIhjywq808EC/Mjj+UJTGZkJOg==
31
+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpQ0s5YmR5M1AxcmhiTlo4
32
+
OWlaSk84c3hocnY2ZXZpc0dXUm9JZ3owQndvCndXcVhzRjJzUWttOFJ5NUxWY2p3
33
+
ZmNqZDN3RHJaOVh0eTY3U1VlWklQY0EKLS0tIFVydHdIb05lR0R6ZWVkWW4wVko2
34
+
eitCYVVhWXpKbHRKWUd6YjczOHBiTHMKVnzZwQkJvSn6GwrJYtALckxwzPzFdp8m
35
+
1ILGhtxz3gCIksghQGk1IO171ohxdYKslni7U/XFaKzJE6P1+RWqlA==
40
36
-----END AGE ENCRYPTED FILE-----
41
37
- recipient: age1eagn023gem8ekv6q8gx7rc37x2rsxfscpyt2znd4j5l8ryehksdqzjek59
42
38
enc: |
43
39
-----BEGIN AGE ENCRYPTED FILE-----
44
-
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxUUx0eGVDNURLc1Z1VzV3
45
-
OXFRRUhYY0tkY2hxMXBVem9xRWQ3cE0rb200CngwMjRJc21sZGo2UHVENlNxSVdt
46
-
V2NTckgwb2l6UXVmUUh3bUNGSTRiZ00KLS0tIFg3TE1FZExjTTNETUhNZ2gyM2o4
47
-
Q1lEZzNyWXpyU0pteDhSZUJQeDNBSTgK9l295KrizvPeK2zkab9+CW0XNk3aVAL4
48
-
xhmTnX+VgJ6iixJIh2mYic8g2KC992xkvkoHLopsUFYJ5QmcFn5Bfw==
40
+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5d2JLOXVObHhQdUR2cCti
41
+
czhhOW1GKzMrNWtodWVEeWpxWWcxbmxteWswCkVQQ1phSDZzaG1YdXVaUWtYUlky
42
+
QWxpNnNJd0tnL2pTZjJNOTNQbVNiRGcKLS0tIDB1K3VaZkluTlczUmk3bGZ2aTBG
43
+
YlpmeHJMVzBlWENUaG82MThmZlpTcEkKB3EgWmpKonHHSD5MPsgTcjN7Ea+IxhEM
44
+
WLz18+zHNwcKcxfQDl9wT0TNcVd25DU2N4XhIX5qgAD5EZLqpryYHQ==
49
45
-----END AGE ENCRYPTED FILE-----
50
-
lastmodified: "2026-06-13T17:12:35Z"
51
-
mac: ENC[AES256_GCM,data:XVWoJxAAWIQGcLAxphG+p8S6iHhXfSTOrxnRBDp0ApuvNjQn544FrkdFyu7+OirlaLwSkLfpMxKV+gS39QXnphvsgLoOAg4DVmfzAQ1F8PPRFGNKNyguE9LUwQq2gdVsjqNWmKEbgvzbSUIeYAhN1XvjdI4FdHtT2a1OSQut+kw=,iv:OHScbLUwzT6BFfMSzqXembsUlKptsXsdZUcz8B5aXcg=,tag:CG+EGCOjpWSZWQobL9cKcA==,type:str]
46
+
lastmodified: "2026-06-13T19:30:27Z"
47
+
mac: ENC[AES256_GCM,data:AbARQhfw8qbbrW1QzPEC13odyy2CWA8y6sDxQ35oRJ+v0mRXIGBhwacy7x1D13GiwapZo0Wg5uWc/CutBrN+U+yRbHGWEuHI0h5mA/n1HbhH/wXdqWwAageaQnIacHWfvc3MXlkB+Gl0T1WFj93oUw0x+2sc+YA2QHmqpUUJSag=,iv:yl7fjQr2blFIvOk/YK6wWQ/WhLPqQpQPRQxezPe8to0=,tag:iQI7EYtSkWsHO5zyBgMhIw==,type:str]
52
48
pgp:
53
-
- created_at: "2026-06-13T17:12:35Z"
49
+
- created_at: "2026-06-13T19:30:26Z"
54
50
enc: |-
55
51
-----BEGIN PGP MESSAGE-----
56
52
57
-
hQIMA0IKwDTH3WibARAAlsqq89vROSxWoFrssMWmD44PJRxorzHo+tci+zsR5C6M
58
-
0CCjPxkqFmXEWNvTANYS79tOAHQubrPilza34Ok7aRJ2Dx3dQ5BQ5Z3B/L5r6cin
59
-
l5tEE20399w0XF2sBlQiPndYDss8Kvybp9bFWCJzOYJHNhFZ/R47q+8Cv1gGeUDp
60
-
dJwUg1odVm+9/tvkkx48q1U/06BA/+IHHW2+AXFiT6oeyddJqzG05oHEzFxG7RiC
61
-
ys8bRqdqoCLb3LP/xdiZDqm++tITnA/OjsiFJPuHkfnUrEnrWTzlWWRYScDp7ivE
62
-
Q77Y2ETXxwbdNZ1aHORI+H3/hLe3xvep8uOwnJzR2O9kyaFbCLO40IXSaDXXMXjr
63
-
CY9ZIXDnzIT5koPKK0mfQXfxvP0YmdhjSZFyY9y8L9rg/THMTw9OP8YGXM1Kpd2a
64
-
q/jpOFSMwuIOkyoKwfqaI54GwCfroYXCiHsaZ2cV0POFXgXfOz4W/zWsOTPPfI3Y
65
-
pR8UvdBYA1TFQNRdujB26bcw5d44JvlsRe5uvTqD699BBd9sdEcpQ8G3SKpsIXzB
66
-
SakVDucwRVPc5StPdQMdZgC26/cjZUtUh83jXabCsI8+XJ9mmSFieAZ35hLEybxZ
67
-
1PAdTkbukPGrhXURFouZX4plVZjFJuvIGdxxT6L03ZUz09FWwiMCOPbImA8UFo7S
68
-
XAE8ny0W1+AmPkqOo8rutBKnp/jOoI+0vfQY6TOXofNg256mz0Z91iagjJNSrrnf
69
-
ob37xlzLdoSyhzXT0CR9Mph1axxFbY0wV4N+PQIHpvTRrLXFzD4ilI0UI8He
70
-
=Wy6a
53
+
hQIMA0IKwDTH3WibARAAk5RbAgHRVI+BPhAqJBeESG3aasiAI5wNtGacIsXCKkkz
54
+
9HR420XCi/aMgEbs3PsWKwkfhp+d+RiqRc21FW5aHGwmEyCF95QHVrfxwwV6mKB2
55
+
yT2c2yI6Xrq6LroaWMKPz/5Md5P1HFeebY3OmmVIIxM8TYHOxmfEl7eeakTdxykj
56
+
ltQ7tLLyrWtqqrsPISQ7Ga8FxjGW97EH4S976hM/oIY2Eu2rtERZdPChexSKW6Jh
57
+
B6oANNfh+W0MjIwbXgYb59idLEx1FqYmnfTOWEFdKMlY1oilIQZuMp1+EeaxTm5h
58
+
L5/JOwJB3YHKMyaVAvP0jlfCC13j5TW1yoEbP1TD/DX7O3/fOzgL3FUa1w544kpQ
59
+
SWvsOJ3hCui4QpQ0FNlnI0l2UqGo9psibtmNcfcY/o3vRKeUo/gbEQUMtmmM/0PA
60
+
rwLN9aDfGpPo/F8Mz8v/SLTVz1xOcU5X+iv89PlzgbsDMF1ptujpEyeRZQrKeSna
61
+
LL38Npc0ZsEmLKl86YY/36WQcYY/uu/yy4z+vgxsFBBx+0LotLMJDG/nSvsoiUAW
62
+
0RyeZ5SwQz4i0C/UhhX4Ch5addkjiPmliOi44WYAk3QR9rwAncqyZHc4faLvPCWX
63
+
lI90TZx8+CxWWpmNQReSuil13vI3c+IybV0HJbfA5DVBDzHwAZjyuqu08ITt66PS
64
+
XgGo9c9r0GZ1HrCAs1uhsOAmvK94XeMTHihxw/rMXTg4tn1jVCExWZkFY8KxLK0b
65
+
sdguuZ0ibVT1+WpNhfmHqw07jD3/iAJf6xqtUa5TT/CAHZBb5vL9xAgf+lZTXLE=
66
+
=YUdx
71
67
-----END PGP MESSAGE-----
72
68
fp: 03746612698994281D322B09923BC5E9B4E9509B
73
-
encrypted_regex: stringData
69
+
encrypted_regex: ^(data|stringData)$
74
70
version: 3.12.2