feat: Deploy Authentik via official Helm chart

CloudNativePG PostgreSQL (2 replicas), Authentik Helm chart with
2 server + 2 worker replicas. Same secret key as existing deployment.
SOPS secrets, Cloudflared tunnel route, ingress with TLS.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

kubernetes/apps/authentik/helmrelease.yaml

@@ -0,0 +1,93 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: authentik
+  namespace: apps
+spec:
+  interval: 24h
+  url: https://charts.goauthentik.io
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: authentik
+  namespace: apps
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: authentik
+      version: ">=2025.12.0"
+      sourceRef:
+        kind: HelmRepository
+        name: authentik
+        namespace: apps
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env:
+        - name: AUTHENTIK_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              name: authentik-secrets
+              key: secret-key
+
+    authentik:
+      log_level: info
+      error_reporting:
+        enabled: true
+      postgresql:
+        host: "authentik-db-rw.apps.svc.cluster.local"
+        name: "authentik"
+        user: "authentik"
+        password:
+          secretKeyRef:
+            name: "authentik-db-app"
+            key: "password"
+      redis:
+        enabled: false
+      email:
+        host: "smtp.protonmail.ch"
+        port: 587
+        username: "olymp@renner.uno"
+        password:
+          secretKeyRef:
+            name: authentik-secrets
+            key: smtp-password
+        use_tls: true
+        from: "olymp@renner.uno"
+
+    server:
+      replicas: 2
+      ingress:
+        enabled: true
+        ingressClassName: nginx
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+          external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
+          nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
+          nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
+        hosts:
+          - auth.renner.uno
+        tls:
+          - secretName: authentik-tls
+            hosts:
+              - auth.renner.uno
+      metrics:
+        enabled: true
+        serviceMonitor:
+          enabled: false
+
+    worker:
+      replicas: 2
+
+    postgresql:
+      enabled: false
+
+    redis:
+      enabled: false

kubernetes/apps/authentik/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secret.sops.yaml
+  - postgres.yaml
+  - helmrelease.yaml

kubernetes/apps/authentik/postgres.yaml

@@ -0,0 +1,25 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: authentik-db
+  namespace: apps
+spec:
+  instances: 2
+  imageName: ghcr.io/cloudnative-pg/postgresql:16
+  storage:
+    storageClass: ceph-block
+    size: 10Gi
+  bootstrap:
+    initdb:
+      database: authentik
+      owner: authentik
+  postgresql:
+    parameters:
+      shared_buffers: "256MB"
+      max_connections: "200"
+  resources:
+    requests:
+      cpu: 200m
+      memory: 512Mi
+    limits:
+      memory: 1Gi

kubernetes/apps/authentik/secret.sops.yaml

@@ -0,0 +1,24 @@
+apiVersion: ENC[AES256_GCM,data:ScQ=,iv:ZLoiFeUNMLHLjgG8QMSTdDalo+DaFwm8edT5OAc46uc=,tag:Sv0MEscq+sOYBMtrwcHP0w==,type:str]
+kind: ENC[AES256_GCM,data:8+dakzbw,iv:CZCFq5TfhLoiHy7eZ0FisQ5fjMY4YMHJW9sGfcz3N0U=,tag:jFl56vK1HcCZV1tbWzVWHw==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:qVYegGyZJAyVorhJYGb6UgQ=,iv:I9p0FWIQ9HDfmLnOdA/IOXM1iG6cUw9W7M/u27mxVzE=,tag:oQsV4FodWRYxo1TWF+Vu/g==,type:str]
+    namespace: ENC[AES256_GCM,data:glk98A==,iv:AwE9hNrWZT0CCXlx3eyI8xmnY5gVkACCBWxPnnjy5Z0=,tag:j0jKHUNrA77JDk4Xth0Pdw==,type:str]
+type: ENC[AES256_GCM,data:w8tLLY/Q,iv:YzsA6mWq9p/pK/3+DsIlIXzZ7fcWl8XYkdDc0LAudnU=,tag:zIy7EPc2mB9QL81cO5EqqQ==,type:str]
+stringData:
+    secret-key: ENC[AES256_GCM,data:iMhf4uHUjjvw6N8xK4KvQsEEjAw/w/KooEQ2toNttF23phK7tM2e9Oicm6DiJ7jmfyB7bAxRJw1AhdCczd59U2uQ7oI2bB79t5SQk8QKMVE=,iv:+fnJlZJA5wQ1caeBuDVPBH2Y5BQbCKqAOG7ciPJQDnQ=,tag:+P4QEd3ZuABZeL704jXMWg==,type:str]
+    smtp-password: ENC[AES256_GCM,data:1uE4Slgp0PDWlrXmNghNOA==,iv:rv4Na/jmItzmmlx8uFj7+LhJJIKxEpgZw60y9aFH/eY=,tag:cG67ZamZI4ZypgLed88WCg==,type:str]
+sops:
+    age:
+        - recipient: age1yqjvqkwwwxdj7mr546zfs5ckzuwndp69ya2n2drd4vypwns8w4ys04qfy3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArcWJLMlp5Vk90cncvc1o1
+            TTBCR240aVhGU2dKaSthREN1TjNiN1dCVkVFCll3OGtITkxocVNvZVhMdkVjZ3pP
+            YzlISjFJN0R5M0E4eFpiYU5VL1I4NjAKLS0tIDZzQVNSVUJ4SnhzTmVaWjk1Z2RR
+            WXBSK2duYy9DcHl6YW4xVGR4Zysza1EKDcy5dncLJwaVG0v1wA5H6sB7WP4Blnu4
+            GtfQrEfGZNvP+Rle8sLmwCxNn1nNPtmNXcGEdU5bx2bt19tVunh+vA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-10T20:15:54Z"
+    mac: ENC[AES256_GCM,data:jCcPlAbtK9l6FRSpoJFleNqXJnStlKPvMR5OwdMHJV+UuvpCTJJOfXXrMXLngY9iddf4+3k+Q+XPQyAVrbc/2/A+/UDcflvdfFzIisTdHhYzrJ6Z0WjmtNMKOv1JJMjIxvkSi2G/loCJzgRYyXGVCVNRBxIOqWT5+/nl1xCvXY4=,iv:SMtTCQBHWTwEuxgdGfqYr25jIswaCAuLe91JfgeomAU=,tag:n0khxND+j5ehsDM93v4VMg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2

kubernetes/apps/kustomization.yaml

@@ -15,6 +15,7 @@ resources:
   # - crowdsec/  # Moved to infrastructure
   # - immich/
   # - paperless/
+  - authentik/
   # - owncloud/
   # - audiobookshelf/
   # - music-assistant/

kubernetes/infrastructure/cloudflared/configmap.yaml

@@ -16,6 +16,11 @@ data:
         originRequest:
           noTLSVerify: true
 
+      - hostname: auth.renner.uno
+        service: https://ingress-nginx-controller.ingress.svc.cluster.local:443
+        originRequest:
+          noTLSVerify: true
+
       - hostname: owncloud.renner.uno
         service: https://ingress-nginx-controller.ingress.svc.cluster.local:443
         originRequest: