homelab-infra/apps/authelia

Authelia — SSO over Samba AD

Authelia is the web SSO layer on top of the Samba AD DC (../../infrastructure/samba-ad/): it authenticates users against AD over LDAPS and provides an auth portal + (round 2) an OIDC provider. Deployed via the official Helm chart; config-as-code lives in values.yaml.

• Chart: authelia/authelia (app 4.39.20)
• Exposure: cloudflared → auth.ddupan.top → authelia.authelia.svc:9091 (the chart's own ingress is disabled; see ../../infrastructure/cloudflared/cloudflared.yaml)
• Identity: LDAPS to the DC (ldaps://192.168.10.5:636), bind as svc-authelia
• Storage: dedicated authelia role/db on shared-postgresql (no shared superuser)
• Secrets: chart auto-generates session/JWT keys; values.yaml pins the LDAP + DB passwords and the storage encryption key (data-at-rest, must stay stable)

Prerequisites (already done)

• AD service account svc-authelia (read-only bind), never-expires — created with samba-tool user create svc-authelia ... ; samba-tool user setexpiry svc-authelia --noexpiry.

Deploy

These touch the live cluster / shared Postgres, so run them yourself (auto-mode gates writes to shared infra):

# 1. dedicated Postgres role + database (run against the CNPG primary)
POD=$(kubectl -n shared-db get pods -l cnpg.io/instanceRole=primary -o jsonpath='{.items[0].metadata.name}')
kubectl -n shared-db exec "$POD" -c postgres -- psql -U postgres -v ON_ERROR_STOP=0 \
  -c "CREATE ROLE authelia LOGIN PASSWORD 'Adbdf340cea488a90b4cf07Aa1!'" \
  -c "CREATE DATABASE authelia OWNER authelia"

# 2. install Authelia
helm repo add authelia https://charts.authelia.com && helm repo update authelia
helm upgrade --install authelia authelia/authelia \
  -n authelia --create-namespace -f authelia/values.yaml

# 3. repoint the tunnel (auth.ddupan.top -> authelia) — already edited in the file
kubectl apply -f cloudflared/cloudflared.yaml
kubectl -n cloudflared rollout restart deployment/cloudflared

The DB password above must match configMap.storage.postgres.password.value in values.yaml. If you rotate it, change both.

Verify

kubectl -n authelia rollout status deploy/authelia
kubectl -n authelia logs deploy/authelia | grep -iE 'listening|ldap|error'
# then browse https://auth.ddupan.top and log in as an AD user (e.g. administrator)

Round 2 — enable the OIDC provider

Uncomment/add configMap.identity_providers.oidc in values.yaml: set an hmac_secret (auto-gen ok) and a jwks RSA key, then register clients under identity_providers.oidc.clients. Re-run the helm upgrade above. Once OIDC is proven, retire Keycloak (../keycloak/) and its idm.ddupan.top tunnel entry.

Notes

• Contour/Envoy can't do Authelia forward-auth (gRPC ext_authz only); protect apps via OIDC or route forward-auth through Traefik (ForwardAuth).
• Sessions are in-memory (single replica). For HA add configMap.session.redis.
• Secrets are inline in values.yaml (homelab style, like the other services here); move to sops/sealed-secrets if this leaves the homelab.