---
kind: helm
metadata:
  icon:
    provider: selfh
    id: authentik
  name: Authentik
  description: >
    Helm values template for Authentik, an open-source Identity Provider focused
    on flexibility and versatility with support for various protocols (OAuth2, SAML, LDAP).


    Chart Repository: https://charts.goauthentik.io

    Chart Name: authentik

    Chart Version: Compatible with Authentik 2025.6.3


    Project: https://goauthentik.io/

    Documentation: https://docs.goauthentik.io/
  version: 2025.6.3
  author: Christian Lempa
  date: '2025-01-11'
  draft: true
schema: "1.2"
spec:
  general:
    vars:
      release_name:
        default: authentik
      namespace:
        type: str
        description: Kubernetes namespace
        default: authentik
  networking:
    vars:
      network_mode:
        type: str
        description: Network mode for service
        default: ClusterIP
  authentik:
    title: Authentik Configuration
    description: Configure Authentik application settings
    required: true
    vars:
      authentik_secret_key:
        type: str
        description: Secret Key
        extra: Used for cookie signing and unique user IDs
        sensitive: true
        autogenerated: true
      authentik_log_level:
        type: enum
        description: Authentik log level
        options:
          - trace
          - debug
          - info
          - warning
          - error
        default: error
      authentik_error_reporting:
        type: bool
        description: Enable error reporting to Authentik developers
        default: false
  database:
    title: Database Configuration
    toggle: database_enabled
    vars:
      database_enabled:
        type: bool
        description: Enable database
        default: true
      database_type:
        type: enum
        description: Database type
        options: [postgres, mysql]
        default: postgres
      database_host:
        type: hostname
        description: Database host
        default: authentik-postgresql
      database_port:
        type: int
        description: Database port
        default: 5432
      database_name:
        type: str
        description: Database name
        default: authentik
      database_user:
        type: str
        description: Database user
        default: authentik
      database_password:
        type: str
        description: PostgreSQL database password
        sensitive: true
        autogenerated: true
  email:
    title: Email Configuration
    toggle: email_enabled
    vars:
      email_enabled:
        type: bool
        description: Enable email notifications
        default: false
      email_host:
        type: hostname
        description: SMTP server hostname
        default: smtp.example.com
      email_port:
        type: int
        description: SMTP server port
        default: 587
      email_username:
        type: str
        description: SMTP username
        default: ""
      email_password:
        type: str
        description: SMTP password
        sensitive: true
        default: ""
      email_from:
        type: email
        description: From email address
        default: authentik@example.com
      email_use_tls:
        type: bool
        description: Use TLS/STARTTLS for SMTP connection
        default: true
  traefik:
    title: Traefik Configuration
    toggle: traefik_enabled
    vars:
      traefik_enabled:
        type: bool
        description: Enable Traefik ingress
        default: false
      traefik_host:
        type: hostname
        description: Traefik hostname
        default: authentik.home.arpa
      traefik_tls_enabled:
        type: bool
        description: Enable TLS for Traefik ingress
        default: false
      traefik_tls_secret:
        type: str
        description: TLS secret name for Traefik ingress
        default: authentik-tls
      traefik_tls_certmanager:
        type: bool
        description: Use cert-manager for TLS certificate
        default: false
      certmanager_issuer:
        type: str
        description: Cert-manager issuer name
        needs: traefik_tls_certmanager=true
        default: letsencrypt-prod