diff --git a/apps/authentik.yaml b/apps/authentik.yaml
new file mode 100644
index 0000000..036d1f1
--- /dev/null
+++ b/apps/authentik.yaml
@@ -0,0 +1,16 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: authentik
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    targetRevision: main
+    path: services/authentik
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: authentik
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
\ No newline at end of file
diff --git a/services/authentik/cert.yaml b/services/authentik/cert.yaml
new file mode 100644
index 0000000..c55fdeb
--- /dev/null
+++ b/services/authentik/cert.yaml
@@ -0,0 +1,9 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: zb-kw-wildcard
+  namespace: authentik
+spec:
+  secretName: zb-kw-wildcard-tls
+  dnsNames: ["auth.zb-kw.duckdns.org"]
+  issuerRef: {name: duckdns, kind: ClusterIssuer}
\ No newline at end of file
diff --git a/services/authentik/deployment.yaml b/services/authentik/deployment.yaml
new file mode 100644
index 0000000..449b5fb
--- /dev/null
+++ b/services/authentik/deployment.yaml
@@ -0,0 +1,125 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authentik-media-pvc
+  namespace: authentik
+spec:
+  storageClassName: nfs-client        # NFS vanaf Proxmox — Bijlage A
+  accessModes: [ReadWriteOnce]
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-server
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: authentik-server}
+  template:
+    metadata:
+      labels: {app: authentik-server}
+    spec:
+      initContainers:
+      - name: wait-for-db
+        image: busybox:latest   # pin de tag! (Renovate houdt ze bij)
+        command: 
+        - sh
+        - -c
+        - |
+          until nc -z authentik-postgresql 5432; do
+            echo "Waiting for PostgreSQL..."
+            sleep 2
+          done
+          echo "PostgreSQL is ready!"
+      containers:
+      - name: authentik
+        image: ghcr.io/goauthentik/server:2026.5.8
+        args: ["server"]
+        env:
+          - name: AUTHENTIK_SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_SECRET_KEY
+          - name: AUTHENTIK_POSTGRESQL__HOST
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__HOST
+          - name: AUTHENTIK_POSTGRESQL__PORT
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__PORT
+          - name: AUTHENTIK_POSTGRESQL__NAME
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__NAME
+          - name: AUTHENTIK_POSTGRESQL__USER
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__USER
+          - name: AUTHENTIK_POSTGRESQL__PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__PASSWORD
+          - name: AUTHENTIK_REDIS__HOST
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_REDIS__HOST
+          - name: AUTHENTIK_ERROR_REPORTING__ENABLED
+            value: "false"
+        ports:
+        - containerPort: 9000
+          name: http
+        - containerPort: 9443
+          name: https
+        volumeMounts:
+        - name: media
+          mountPath: /media
+        livenessProbe:
+          httpGet:
+            path: /-/health/live/
+            port: 9000
+          initialDelaySeconds: 60
+          periodSeconds: 30
+        readinessProbe:
+          httpGet:
+            path: /-/health/ready/
+            port: 9000
+          initialDelaySeconds: 60
+          periodSeconds: 30
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "250m"
+          limits: 
+            memory: "1Gi"
+            cpu: "1000m"
+      volumes:
+      - name: media
+        persistentVolumeClaim:
+          claimName: authentik-media-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-server
+  namespase: authentik
+spec:
+  selector: {app: authentik-server}
+  ports:
+  - port: 9000
+    targetPort: 9000
+    name: http
+  - port: 9443
+    targetPort: 9443
+    name: https
\ No newline at end of file
diff --git a/services/authentik/ingress.yaml b/services/authentik/ingress.yaml
new file mode 100644
index 0000000..7080fa6
--- /dev/null
+++ b/services/authentik/ingress.yaml
@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: authentik
+  namespace: authentik
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host:
+    paths:
+    - path: /
+      pathType: Prefix
+      backend:
+        service:
+          name: authentik-server
+          port:
+            number: 9000
+  tls:
+  - hosts:
+    - auth.zb-kw.duckdns.org
+    secretName: zb-kw-wildcard-tls
\ No newline at end of file
diff --git a/services/authentik/middleware.yaml b/services/authentik/middleware.yaml
new file mode 100644
index 0000000..92c672c
--- /dev/null
+++ b/services/authentik/middleware.yaml
@@ -0,0 +1,37 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authentik-forwardauth
+  namespace: authentik
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authentik-forwardauth-with-cookies
+  namespace: authentik
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - Set-Cookie
+      - Cookie
+    authRequestHeaders:
+      - X-Forwarded-Proto
+      - X-Forwarded-Host
+      - X-Forwarded-Uri
\ No newline at end of file
diff --git a/services/authentik/namespace.yaml b/services/authentik/namespace.yaml
new file mode 100644
index 0000000..b3fa2e3
--- /dev/null
+++ b/services/authentik/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: authentik
\ No newline at end of file
diff --git a/services/authentik/postgres.yaml b/services/authentik/postgres.yaml
new file mode 100644
index 0000000..78e7c12
--- /dev/null
+++ b/services/authentik/postgres.yaml
@@ -0,0 +1,65 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authentik-postgres-pvc
+  namespace: authentik
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-postgresql
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: authentik-postgresql}
+  template:
+    metadata:
+      labels: {app: authentik-postgresql}
+    spec:
+      containers:
+      - name: postgresql
+        image: postgres:16-alpine
+        env: 
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: authentik-postgres-secret
+              key: POSTGRES_PASSWORD
+        - name: POSTGRES_USER
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-postgres-secret
+              key: POSTGRES_USER
+        - name: POSTGRES_DB
+          valueFrom:
+            secretKeyRef:
+              name: authentik-postgres-secret
+              key: POSTGRES_DB
+        ports:
+        - containerPort: 5432
+        volumeMounts:
+        - name: postgres-data
+          mountPath: /var/lib/postgresql/data
+      volumes:
+      - name: postgres-data
+        persistentVolumeClaim:
+          claimName: authentik-postgres-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-postgresql
+  namespace: authentik
+spec:
+  selector:
+    app: authentik-postgresql
+  ports:
+  - port: 5432
\ No newline at end of file
diff --git a/services/authentik/redis.yaml b/services/authentik/redis.yaml
new file mode 100644
index 0000000..b717d63
--- /dev/null
+++ b/services/authentik/redis.yaml
@@ -0,0 +1,46 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-redis
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: authentik-redis}
+  template:
+    metadata:
+      labels: {app: authentik-redis}
+    spec:
+      containers:
+      - name: redis
+        image: redis:alpine
+        ports:
+        - containerPort: 6379
+          name: redis
+        command:
+        - redis-server
+        - --save
+        - "60"
+        - "1"
+        - --logLevel
+        - warning
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "100m"
+          limits:
+            memory: "256Mi"
+            cpu: "200m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-redis
+  namespace: authentik
+spec:
+  selector: {app: authentik-redis}
+  ports:
+  - port: 6379
+    targetPort: 6379
+    name: redis
\ No newline at end of file
diff --git a/services/authentik/worker.yaml b/services/authentik/worker.yaml
new file mode 100644
index 0000000..3691bf4
--- /dev/null
+++ b/services/authentik/worker.yaml
@@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-worker
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: authentik-worker}
+  template:
+    metadata:
+      labels: {app: authentik-worker}
+    spec:
+      containers:
+      - name: authentik
+        image: ghcr.io/goauthentik/server:2026.5.8
+        args: ["worker"]
+        env:
+        - name: AUTHENTIK_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_SECRET_KEY
+        - name: AUTHENTIK_POSTGRESQL__HOST
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_POSTGRESQL__HOST
+        - name: AUTHENTIK_POSTGRESQL__PORT
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_POSTGRESQL__PORT
+        - name: AUTHENTIK_POSTGRESQL__NAME
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_POSTGRESQL__NAME
+        - name: AUTHENTIK_POSTGRESQL__USER
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_POSTGRESQL__USER
+        - name: AUTHENTIK_POSTGRESQL__PASSWORD
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_POSTGRESQL__PASSWORD
+        - name: AUTHENTIK_REDIS__HOST
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_REDIS__HOST
+        - name: AUTHENTIK_ERROR_REPORTING__ENABLED
+          value: "false"
+        volumeMounts:
+          - name: media
+            mountPath: /media
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+      volumes:
+      - name: media
+        persistentVolumeClaim:
+          claimName: authentik-media-pvc
\ No newline at end of file