apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: authentik-media-pvc
  namespace: authentik
spec:
  storageClassName: nfs-client        # NFS vanaf Proxmox — Bijlage A
  accessModes: [ReadWriteMany]
  resources:
    requests:
      storage: 5Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: authentik-server
  namespace: authentik
spec:
  replicas: 1
  selector:
    matchLabels: {app: authentik-server}
  template:
    metadata:
      labels: {app: authentik-server}
    spec:
      initContainers:
      - name: wait-for-db
        image: busybox:latest   # pin de tag! (Renovate houdt ze bij)
        command: 
        - sh
        - -c
        - |
          until nc -z authentik-postgresql 5432; do
            echo "Waiting for PostgreSQL..."
            sleep 2
          done
          echo "PostgreSQL is ready!"
      containers:
      - name: authentik
        image: ghcr.io/goauthentik/server:2026.5.8
        args: ["server"]
        env:
          - name: AUTHENTIK_SECRET_KEY
            valueFrom:
              secretKeyRef:
                name: authentik-secret
                key: AUTHENTIK_SECRET_KEY
          - name: AUTHENTIK_POSTGRESQL__HOST
            valueFrom:
              secretKeyRef:
                name: authentik-secret
                key: AUTHENTIK_POSTGRESQL__HOST
          - name: AUTHENTIK_POSTGRESQL__PORT
            valueFrom:
              secretKeyRef:
                name: authentik-secret
                key: AUTHENTIK_POSTGRESQL__PORT
          - name: AUTHENTIK_POSTGRESQL__NAME
            valueFrom:
              secretKeyRef:
                name: authentik-secret
                key: AUTHENTIK_POSTGRESQL__NAME
          - name: AUTHENTIK_POSTGRESQL__USER
            valueFrom:
              secretKeyRef:
                name: authentik-secret
                key: AUTHENTIK_POSTGRESQL__USER
          - name: AUTHENTIK_POSTGRESQL__PASSWORD
            valueFrom:
              secretKeyRef:
                name: authentik-secret
                key: AUTHENTIK_POSTGRESQL__PASSWORD
          - name: AUTHENTIK_REDIS__HOST
            valueFrom:
              secretKeyRef:
                name: authentik-secret
                key: AUTHENTIK_REDIS__HOST
          - name: AUTHENTIK_ERROR_REPORTING__ENABLED
            value: "false"
        ports:
        - containerPort: 9000
          name: http
        - containerPort: 9443
          name: https
        volumeMounts:
        - name: media
          mountPath: /media
        livenessProbe:
          httpGet:
            path: /-/health/live/
            port: 9000
          initialDelaySeconds: 60
          periodSeconds: 30
        readinessProbe:
          httpGet:
            path: /-/health/ready/
            port: 9000
          initialDelaySeconds: 60
          periodSeconds: 30
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits: 
            memory: "1Gi"
            cpu: "1000m"
      volumes:
      - name: media
        persistentVolumeClaim:
          claimName: authentik-media-pvc
---
apiVersion: v1
kind: Service
metadata:
  name: authentik-server
  namespace: authentik
spec:
  selector: {app: authentik-server}
  ports:
  - port: 9000
    targetPort: 9000
    name: http
  - port: 9443
    targetPort: 9443
    name: https