Commit new Chart releases for TrueCharts

Signed-off-by: TrueCharts-Bot <bot@truecharts.org>

enterprise/authelia/19.0.8/CHANGELOG.md

@@ -0,0 +1,99 @@
+**Important:**
+*for the complete changelog, please refer to the website*
+
+
+
+
+## [authelia-19.0.8](https://github.com/truecharts/charts/compare/authelia-19.0.7...authelia-19.0.8) (2023-11-08)
+
+
+
+
+## [authelia-19.0.7](https://github.com/truecharts/charts/compare/authelia-19.0.6...authelia-19.0.7) (2023-11-08)
+
+### Chore
+
+- update helm general non-major ([#14454](https://github.com/truecharts/charts/issues/14454))
+  
+  ### Fix
+
+- fix doc mistakes breaking rendering on docusaurus 3.0
+  
+  
+
+
+## [authelia-19.0.6](https://github.com/truecharts/charts/compare/authelia-19.0.5...authelia-19.0.6) (2023-11-05)
+
+### Chore
+
+- update helm general non-major ([#14365](https://github.com/truecharts/charts/issues/14365))
+  
+  
+
+
+## [authelia-19.0.5](https://github.com/truecharts/charts/compare/authelia-19.0.4...authelia-19.0.5) (2023-11-03)
+
+### Chore
+
+- update helm general non-major ([#14287](https://github.com/truecharts/charts/issues/14287))
+  
+  
+
+
+## [authelia-19.0.4](https://github.com/truecharts/charts/compare/authelia-19.0.3...authelia-19.0.4) (2023-10-29)
+
+### Chore
+
+- Fix typo in categories and make them singular ([#13693](https://github.com/truecharts/charts/issues/13693))
+  - update helm general non-major ([#14094](https://github.com/truecharts/charts/issues/14094))
+  
+  
+
+
+## [authelia-19.0.3](https://github.com/truecharts/charts/compare/authelia-19.0.2...authelia-19.0.3) (2023-10-08)
+
+### Chore
+
+- dont quote bools
+  
+  
+
+
+## [authelia-19.0.2](https://github.com/truecharts/charts/compare/authelia-19.0.1...authelia-19.0.2) (2023-10-08)
+
+### Chore
+
+- run precocmit ([#13387](https://github.com/truecharts/charts/issues/13387))
+  
+  ### Fix
+
+- handle input that might be transalted into objects/arrays ([#13319](https://github.com/truecharts/charts/issues/13319))
+  
+  
+
+
+## [authelia-19.0.1](https://github.com/truecharts/charts/compare/authelia-19.0.0...authelia-19.0.1) (2023-10-07)
+
+### Chore
+
+- update helm general non-major ([#13386](https://github.com/truecharts/charts/issues/13386))
+  
+  
+
+
+## [authelia-19.0.0](https://github.com/truecharts/charts/compare/authelia-18.1.0...authelia-19.0.0) (2023-10-07)
+
+### Chore
+
+- update helm general major (major) ([#11104](https://github.com/truecharts/charts/issues/11104))
+  
+  
+
+
+## [authelia-18.1.0](https://github.com/truecharts/charts/compare/authelia-18.0.0...authelia-18.1.0) (2023-08-16)
+
+### Feat
+
+- Add Password Policy ([#11109](https://github.com/truecharts/charts/issues/11109))
+  
+  

enterprise/authelia/19.0.8/Chart.yaml

@@ -0,0 +1,42 @@
+apiVersion: v2
+appVersion: "4.37.5"
+dependencies:
+  - name: common
+    repository: https://library-charts.truecharts.org
+    version: 14.3.4
+  - condition: redis.enabled
+    name: redis
+    repository: https://deps.truecharts.org
+    version: 8.0.42
+deprecated: false
+description: Authelia is a Single Sign-On Multi-Factor portal for web apps
+home: https://truecharts.org/charts/enterprise/authelia
+icon: https://truecharts.org/img/hotlink-ok/chart-icons/authelia.png
+keywords:
+  - authelia
+  - authentication
+  - login
+  - SSO
+  - Authentication
+  - Security
+  - Two-Factor
+  - U2F
+  - YubiKey
+  - Push Notifications
+  - LDAP
+kubeVersion: ">=1.16.0-0"
+maintainers:
+  - email: info@truecharts.org
+    name: TrueCharts
+    url: https://truecharts.org
+name: authelia
+sources:
+  - https://github.com/truecharts/charts/tree/master/charts/enterprise/authelia
+  - https://github.com/authelia/chartrepo
+  - https://github.com/authelia/authelia
+type: application
+version: 19.0.8
+annotations:
+  truecharts.org/category: security
+  truecharts.org/SCALE-support: "true"
+  truecharts.org/grade: U

enterprise/authelia/19.0.8/app-changelog.md

@@ -0,0 +1,4 @@
+
+
+## [authelia-19.0.8](https://github.com/truecharts/charts/compare/authelia-19.0.7...authelia-19.0.8) (2023-11-08)
+

enterprise/authelia/19.0.8/app-readme.md

@@ -0,0 +1,8 @@
+Authelia is a Single Sign-On Multi-Factor portal for web apps
+
+This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/enterprise/authelia](https://truecharts.org/charts/enterprise/authelia)
+
+---
+
+TrueCharts can only exist due to the incredible effort of our staff.
+Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!

enterprise/authelia/19.0.8/ix_values.yaml

@@ -0,0 +1,652 @@
+image:
+  repository: tccr.io/truecharts/authelia
+  pullPolicy: IfNotPresent
+  tag: 4.37.5@sha256:76a4617539534cec140fd98a12f721b878524f2df3a3653f3df8ff2b7eaab586
+manifestManager:
+  enabled: true
+workload:
+  main:
+    replicas: 2
+    strategy: RollingUpdate
+    podSpec:
+      containers:
+        main:
+          command:
+            - authelia
+          args:
+            - --config=/configuration.yaml
+          envFrom:
+            - configMapRef:
+                name: authelia-paths
+          probes:
+            liveness:
+              type: http
+              path: "/api/health"
+
+            readiness:
+              type: http
+              path: "/api/health"
+
+            startup:
+              type: http
+              path: "/api/health"
+
+service:
+  main:
+    ports:
+      main:
+        port: 9091
+        targetPort: 9091
+
+persistence:
+  config:
+    enabled: true
+    mountPath: "/config"
+
+cnpg:
+  main:
+    enabled: true
+    user: authelia
+    database: authelia
+
+# Enabled redis
+# ... for more options see https://github.com/tccr.io/truecharts/charts/tree/master/tccr.io/truecharts/redis
+redis:
+  enabled: true
+
+domain: example.com
+
+##
+## Server Configuration
+##
+server:
+  ##
+  ## Port sets the configured port for the daemon, service, and the probes.
+  ## Default is 9091 and should not need to be changed.
+  ##
+  port: 9091
+
+  ## Buffers usually should be configured to be the same value.
+  ## Explanation at https://www.authelia.com/docs/configuration/server.html
+  ## Read buffer size adjusts the server's max incoming request size in bytes.
+  ## Write buffer size does the same for outgoing responses.
+  read_buffer_size: 4096
+  write_buffer_size: 4096
+  ## Set the single level path Authelia listens on.
+  ## Must be alphanumeric chars and should not contain any slashes.
+  path: ""
+
+log:
+  ## Level of verbosity for logs: info, debug, trace.
+  level: trace
+
+  ## Format the logs are written as: json, text.
+  format: text
+
+  ## TODO: Statefulness check should check if this is set, and the configMap should enable it.
+  ## File path where the logs will be written. If not set logs are written to stdout.
+  # file_path: /config/authelia.log
+
+## Default redirection URL
+##
+## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
+## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
+## in such a case.
+##
+## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
+## Default is https://www.<domain> (value at the top of the values.yaml).
+default_redirection_url: ""
+# default_redirection_url: https://example.com
+
+theme: light
+
+##
+## TOTP Configuration
+##
+## Parameters used for TOTP generation
+totp:
+  ## The issuer name displayed in the Authenticator application of your choice
+  ## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names
+  ## Defaults to <domain>.
+  issuer: ""
+  ## The period in seconds a one-time password is current for. Changing this will require all users to register
+  ## their TOTP applications again. Warning: before changing period read the docs link below.
+  period: 30
+  ## The skew controls number of one-time passwords either side of the current one that are valid.
+  ## Warning: before changing skew read the docs link below.
+  ## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation.
+  skew: 1
+
+##
+## Password Policy Config
+##
+## Parameters used for Password Policies
+password_policy:
+  ## See: https://www.authelia.com/configuration/security/password-policy/
+  standard:
+    enabled: false
+    min_length: 8
+    max_length: 0
+    require_uppercase: false
+    require_lowercase: false
+    require_number: false
+    require_special: false
+  zxcvbn:
+    ## See https://www.authelia.com/configuration/security/password-policy/#zxcvbn for more info
+    enabled: false
+    min_score: 3
+
+##
+## Duo Push API Configuration
+##
+## Parameters used to contact the Duo API. Those are generated when you protect an application of type
+## "Partner Auth API" in the management panel.
+duo_api:
+  enabled: false
+  hostname: api-123456789.example.com
+  integration_key: ABCDEF
+  plain_api_key: ""
+
+## NTP settings
+
+ntp:
+  address: "time.cloudflare.com:123"
+  version: 4
+  max_desync: 3s
+  disable_startup_check: false
+  disable_failure: true
+
+##
+## Authentication Backend Provider Configuration
+##
+## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
+##
+## The available providers are: `file`, `ldap`. You must use one and only one of these providers.
+authentication_backend:
+  ## Disable both the HTML element and the API for reset password functionality
+  disable_reset_password: false
+
+  ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
+  ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
+  ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
+  ## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
+  ## See the below documentation for more information.
+  ## Duration Notation docs:  https://www.authelia.com/docs/configuration/index.html#duration-notation-format
+  ## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval
+  refresh_interval: 5m
+
+  ## LDAP backend configuration.
+  ##
+  ## This backend allows Authelia to be scaled to more
+  ## than one instance and therefore is recommended for
+  ## production.
+  ldap:
+    ## Enable LDAP Backend.
+    enabled: false
+
+    ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
+    ## Acceptable options are as follows:
+    ## - 'activedirectory' - For Microsoft Active Directory.
+    ## - 'custom' - For custom specifications of attributes and filters.
+    ## This currently defaults to 'custom' to maintain existing behaviour.
+    ##
+    ## Depending on the option here certain other values in this section have a default value, notably all of the
+    ## attribute mappings have a default value that this config overrides, you can read more about these default values
+    ## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults
+    implementation: activedirectory
+
+    ## The url to the ldap server. Format: <scheme>://<address>[:<port>].
+    ## Scheme can be ldap or ldaps in the format (port optional).
+    url: ldap://openldap.default.svc.cluster.local
+
+    ## Connection Timeout.
+    timeout: 5s
+
+    ## Use StartTLS with the LDAP connection.
+    start_tls: false
+
+    tls:
+      ## Server Name for certificate validation (in case it's not set correctly in the URL).
+      server_name: ""
+
+      ## Skip verifying the server certificate (to allow a self-signed certificate).
+      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
+      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
+      skip_verify: false
+
+      ## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
+      minimum_version: TLS1.2
+
+    ## The base dn for every LDAP query.
+    base_dn: DC=example,DC=com
+
+    ## The attribute holding the username of the user. This attribute is used to populate the username in the session
+    ## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
+    ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
+    ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
+    ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
+    ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
+    ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
+    ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
+    username_attribute: ""
+
+    ## An additional dn to define the scope to all users.
+    additional_users_dn: OU=Users
+
+    ## The users filter used in search queries to find the user profile based on input filled in login form.
+    ## Various placeholders are available in the user filter:
+    ## - {input} is a placeholder replaced by what the user inputs in the login form.
+    ## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`.
+    ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
+    ## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
+    ##   versions, so please don't use it.
+    ##
+    ## Recommended settings are as follows:
+    ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
+    ## - OpenLDAP:
+    ##   - (&({username_attribute}={input})(objectClass=person))
+    ##   - (&({username_attribute}={input})(objectClass=inetOrgPerson))
+    ##
+    ## To allow sign in both with username and email, one can use a filter like
+    ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
+    users_filter: ""
+
+    ## An additional dn to define the scope of groups.
+    additional_groups_dn: OU=Groups
+
+    ## The groups filter used in search queries to find the groups of the user.
+    ## - {input} is a placeholder replaced by what the user inputs in the login form.
+    ## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`).
+    ## - {dn} is a matcher replaced by the user distinguished name, aka, user DN.
+    ## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`.
+    ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
+    ## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
+    ##   versions, so please don't use it.
+    ## - DON'T USE - {1} is an alias for {username} supported for backward compatibility but it will be deprecated in
+    ##   later version, so please don't use it.
+    ##
+    ## If your groups use the `groupOfUniqueNames` structure use this instead:
+    ##    (&(uniquemember={dn})(objectclass=groupOfUniqueNames))
+    groups_filter: ""
+
+    ## The attribute holding the name of the group
+    group_name_attribute: ""
+
+    ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
+    ## first one returned by the LDAP server is used.
+    mail_attribute: ""
+
+    ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
+    display_name_attribute: ""
+
+    ## The username of the admin user.
+    user: CN=Authelia,DC=example,DC=com
+    plain_password: ""
+
+  ##
+  ## File (Authentication Provider)
+  ##
+  ## With this backend, the users database is stored in a file which is updated when users reset their passwords.
+  ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
+  ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
+  ## implications it is highly recommended you leave the default values. Before considering changing these settings
+  ## please read the docs page below:
+  ## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning
+  ##
+  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
+  ##
+  file:
+    enabled: true
+    path: /config/users_database.yml
+    password:
+      algorithm: argon2id
+      iterations: 1
+      key_length: 32
+      salt_length: 16
+      memory: 1024
+      parallelism: 8
+
+##
+## Access Control Configuration
+##
+## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
+##
+## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
+## to anyone. Otherwise restrictions follow the rules defined.
+##
+## Note: One can use the wildcard * to match any subdomain.
+## It must stand at the beginning of the pattern. (example: *.mydomain.com)
+##
+## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
+##
+## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
+##
+## - 'domain' defines which domain or set of domains the rule applies to.
+##
+## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
+##    provided. If provided, the parameter represents either a user or a group. It should be of the form
+##    'user:<username>' or 'group:<groupname>'.
+##
+## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
+##
+## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
+##   is optional and matches any resource if not provided.
+##
+## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
+access_control:
+  ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
+  ## resource if there is no policy to be applied to the user.
+  default_policy: deny
+
+  networks: []
+  # networks:
+  # - name: private
+  #   networks:
+  #   - 10.0.0.0/8
+  #   - 172.16.0.0/12
+  #   - 192.168.0.0/16
+  # - name: vpn
+  #   networks:
+  #   - 10.9.0.0/16
+
+  rules: []
+  # rules:
+  # - domain: public.example.com
+  #   policy: bypass
+  # - domain: "*.example.com"
+  #   policy: bypass
+  #   methods:
+  #   - OPTIONS
+  # - domain: secure.example.com
+  #   policy: one_factor
+  #   networks:
+  #   - private
+  #   - vpn
+  #   - 192.168.1.0/24
+  #   - 10.0.0.1
+  # - domain:
+  #   - secure.example.com
+  #   - private.example.com
+  #   policy: two_factor
+  # - domain: singlefactor.example.com
+  #   policy: one_factor
+  # - domain: "mx2.mail.example.com"
+  #   subject: "group:admins"
+  #   policy: deny
+  # - domain: "*.example.com"
+  #   subject:
+  #   - "group:admins"
+  #   - "group:moderators"
+  #   policy: two_factor
+  # - domain: dev.example.com
+  #   resources:
+  #   - "^/groups/dev/.*$"
+  #   subject: "group:dev"
+  #   policy: two_factor
+  # - domain: dev.example.com
+  #   resources:
+  #   - "^/users/john/.*$"
+  #   subject:
+  #   - ["group:dev", "user:john"]
+  #   - "group:admins"
+  #   policy: two_factor
+  # - domain: "{user}.example.com"
+  #   policy: bypass
+
+##
+## Session Provider Configuration
+##
+## The session cookies identify the user once logged in.
+## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
+session:
+  ## The name of the session cookie. (default: authelia_session).
+  name: authelia_session
+
+  ## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
+  ## Please read https://www.authelia.com/docs/configuration/session.html#same_site
+  same_site: lax
+
+  ## The time in seconds before the cookie expires and session is reset.
+  expiration: 1h
+
+  ## The inactivity time in seconds before the session is reset.
+  inactivity: 5m
+
+  ## The remember me duration.
+  ## Value is in seconds, or duration notation. Value of 0 disables remember me.
+  ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
+  ## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to
+  ## spy or attack. Currently the default is 1M or 1 month.
+  remember_me_duration: 1M
+
+##
+## Redis Provider
+##
+## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
+##
+## The redis connection details
+redisProvider:
+  port: 6379
+
+  ## Optional username to be used with authentication.
+  # username: authelia
+  username: ""
+
+  ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
+  database_index: 0
+
+  ## The maximum number of concurrent active connections to Redis.
+  maximum_active_connections: 8
+
+  ## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
+  minimum_idle_connections: 0
+
+  ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
+  tls:
+    enabled: false
+
+    ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
+    server_name: ""
+
+    ## Skip verifying the server certificate (to allow a self-signed certificate).
+    ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
+    ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
+    skip_verify: false
+
+    ## Minimum TLS version for the connection.
+    minimum_version: TLS1.2
+
+  ## The Redis HA configuration options.
+  ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
+  high_availability:
+    enabled: false
+    enabledSecret: false
+    ## Sentinel Name / Master Name
+    sentinel_name: mysentinel
+
+    ## The additional nodes to pre-seed the redis provider with (for sentinel).
+    ## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
+    ## For high availability to be used you must have either defined; the host above or at least one node below.
+    nodes: []
+    # nodes:
+    #   - host: sentinel-0.databases.svc.cluster.local
+    #     port: 26379
+    #   - host: sentinel-1.databases.svc.cluster.local
+    #     port: 26379
+
+    ## Choose the host with the lowest latency.
+    route_by_latency: false
+
+    ## Choose the host randomly.
+    route_randomly: false
+
+##
+## Regulation Configuration
+##
+## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are done
+## in a short period of time.
+regulation:
+  ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
+  max_retries: 3
+
+  ## The time range during which the user can attempt login before being banned. The user is banned if the
+  ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
+  ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
+  find_time: 2m
+
+  ## The length of time before a banned user can login again. Ban Time accepts duration notation.
+  ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
+  ban_time: 5m
+
+##
+## Storage Provider Configuration
+##
+## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
+storage:
+  ##
+  ## PostgreSQL (Storage Provider)
+  ##
+  postgres:
+    port: 5432
+    database: authelia
+    username: authelia
+    sslmode: disable
+    timeout: 5s
+
+##
+## Notification Provider
+##
+##
+## Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration.
+## The available providers are: filesystem, smtp. You must use one and only one of these providers.
+notifier:
+  ## You can disable the notifier startup check by setting this to true.
+  disable_startup_check: false
+
+  ##
+  ## File System (Notification Provider)
+  ##
+  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
+  ##
+  filesystem:
+    enabled: true
+    filename: /config/notification.txt
+
+  ##
+  ## SMTP (Notification Provider)
+  ##
+  ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
+  ## [Security] By default Authelia will:
+  ##   - force all SMTP connections over TLS including unauthenticated connections
+  ##      - use the disable_require_tls boolean value to disable this requirement
+  ##        (only works for unauthenticated connections)
+  ##   - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
+  ##     (configure in tls section)
+  smtp:
+    enabled: false
+    enabledSecret: false
+    host: smtp.mail.svc.cluster.local
+    port: 25
+    timeout: 5s
+    username: test
+    plain_password: test
+    sender: admin@example.com
+    ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
+    identifier: localhost
+    ## Subject configuration of the emails sent.
+    ## {title} is replaced by the text from the notifier
+    subject: "[Authelia] {title}"
+    ## This address is used during the startup check to verify the email configuration is correct.
+    ## It's not important what it is except if your email server only allows local delivery.
+    startup_check_address: test@authelia.com
+    disable_require_tls: false
+    disable_html_emails: false
+
+    tls:
+      ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
+      server_name: ""
+
+      ## Skip verifying the server certificate (to allow a self-signed certificate).
+      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
+      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
+      skip_verify: false
+
+      ## Minimum TLS version for either StartTLS or SMTPS.
+      minimum_version: TLS1.2
+
+identity_providers:
+  oidc:
+    ## Enables this in the config map. Currently in beta stage.
+    ## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
+    enabled: false
+
+    access_token_lifespan: 1h
+    authorize_code_lifespan: 1m
+    id_token_lifespan: 1h
+    refresh_token_lifespan: 90m
+
+    enable_client_debug_messages: false
+
+    ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
+    ## security reasons.
+    minimum_parameter_entropy: 8
+
+    clients: []
+    # clients:
+    # -
+    ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
+    # id: myapp
+
+    ## The description to show to users when they end up on the consent screen. Defaults to the ID above.
+    # description: My Application
+
+    ## The client secret is a shared secret between Authelia and the consumer of this client.
+    # secret: apple123
+
+    ## Sets the client to public. This should typically not be set, please see the documentation for usage.
+    # public: false
+
+    ## The policy to require for this client; one_factor or two_factor.
+    # authorization_policy: two_factor
+
+    ## Configures the consent mode; auto, explicit or implicit
+    # consent_mode: auto
+
+    ## Audience this client is allowed to request.
+    # audience: []
+
+    ## Scopes this client is allowed to request.
+    # scopes:
+    #   - openid
+    #   - profile
+    #   - email
+    #   - groups
+
+    ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
+    # redirect_uris:
+    #   - https://oidc.example.com/oauth2/callback
+
+    ## Grant Types configures which grants this client can obtain.
+    ## It's not recommended to configure this unless you know what you're doing.
+    # grant_types:
+    #   - refresh_token
+    #   - authorization_code
+
+    ## Response Types configures which responses this client can be sent.
+    ## It's not recommended to configure this unless you know what you're doing.
+    # response_types:
+    #   - code
+
+    ## Response Modes configures which response modes this client supports.
+    ## It's not recommended to configure this unless you know what you're doing.
+    # response_modes:
+    #   - form_post
+    #   - query
+    #   - fragment
+
+    ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
+    # userinfo_signing_algorithm: none
+
+portal:
+  open:
+    enabled: true

enterprise/authelia/19.0.8/templates/_configmap.tpl

@@ -0,0 +1,363 @@
+{{/* Define the configmap */}}
+{{- define "authelia.configmap.paths" -}}
+enabled: true
+data:
+  AUTHELIA_SERVER_DISABLE_HEALTHCHECK: "true"
+  AUTHELIA_JWT_SECRET_FILE: "/secrets/JWT_TOKEN"
+  AUTHELIA_SESSION_SECRET_FILE: "/secrets/SESSION_ENCRYPTION_KEY"
+  AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: "/secrets/ENCRYPTION_KEY"
+  AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: "/secrets/STORAGE_PASSWORD"
+  {{- if .Values.authentication_backend.ldap.enabled }}
+  AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE: "/secrets/LDAP_PASSWORD"
+  {{- end }}
+  {{- if .Values.notifier.smtp.enabled }}
+  AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: "/secrets/SMTP_PASSWORD"
+  {{- end }}
+  AUTHELIA_SESSION_REDIS_PASSWORD_FILE: "/secrets/REDIS_PASSWORD"
+  {{- if .Values.redisProvider.high_availability.enabled }}
+  AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE: "/secrets/REDIS_SENTINEL_PASSWORD"
+  {{- end }}
+  {{- if .Values.duo_api.enabled }}
+  AUTHELIA_DUO_API_SECRET_KEY_FILE: "/secrets/DUO_API_KEY"
+  {{- end }}
+  {{- if .Values.identity_providers.oidc.enabled }}
+  AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: "/secrets/OIDC_HMAC_SECRET"
+  AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE: "/secrets/OIDC_PRIVATE_KEY"
+  {{- end }}
+
+{{- end -}}
+
+{{- define "authelia.configmap.configfile" -}}
+enabled: true
+data:
+  configuration.yaml: |
+    ---
+    theme: {{ .Values.theme | default "light" }}
+    default_redirection_url: {{ default (printf "https://www.%s" .Values.domain) .Values.default_redirection_url }}
+    ntp:
+      address:  {{ .Values.ntp.address | default "time.cloudflare.com:123" }}
+      version: {{ .Values.ntp.version | default 4 }}
+      max_desync: {{ .Values.ntp.max_desync | default "3s" }}
+      disable_startup_check: {{ .Values.ntp.disable_startup_check | default false }}
+      disable_failure: {{ .Values.ntp.disable_failure |  default true }}
+    server:
+      host: 0.0.0.0
+      port: {{ .Values.server.port | default 9091 }}
+      {{- if ne "" (.Values.server.path | default "") }}
+      path: {{ .Values.server.path }}
+      {{- end }}
+      buffers:
+        write: {{ .Values.server.write_buffer_size | default 4096 }}
+        read: {{ .Values.server.read_buffer_size | default 4096 }}
+      enable_pprof: {{ .Values.server.enable_pprof | default false }}
+      enable_expvars: {{ .Values.server.enable_expvars | default false }}
+    log:
+      level: {{ .Values.log.level | default "info" }}
+      format: {{ .Values.log.format | default "text" }}
+      {{- if ne "" (.Values.log.file_path | default "") }}
+      file_path: {{ .Values.log.file_path }}
+      keep_stdout: true
+      {{- end }}
+    totp:
+      issuer: {{ .Values.totp.issuer | default .Values.domain }}
+      period: {{ .Values.totp.period | default 30 }}
+      skew: {{ .Values.totp.skew | default 1 }}
+    {{- if .Values.password_policy.enabled }}
+    password_policy:
+      standard:
+        enabled: {{ .Values.password_policy.standard.enabled | default false }}
+        min_length: {{ .Values.password_policy.standard.min_length | default 8 }}
+        max_length: {{ .Values.password_policy.standard.max_length | default 0 }}
+        require_uppercase: {{ .Values.password_policy.standard.require_uppercase | default false }}
+        require_lowercase: {{ .Values.password_policy.standard.require_lowercase | default false }}
+        require_number: {{ .Values.password_policy.standard.require_number | default false }}
+        require_special: {{ .Values.password_policy.standard.require_special | default false }}
+      zxcvbn:
+        enabled: {{ .Values.password_policy.zxcvbn.enabled | default false }}
+        min_score: {{ .Values.password_policy.zxcvbn.min_score | default 3 }}
+    {{- end -}}
+    {{- if .Values.duo_api.enabled }}
+    duo_api:
+      hostname: {{ .Values.duo_api.hostname }}
+      integration_key: {{ .Values.duo_api.integration_key }}
+    {{- end -}}
+    {{- with $auth := .Values.authentication_backend }}
+    authentication_backend:
+      password_reset:
+        disable: {{ $auth.disable_reset_password }}
+    {{- if $auth.file.enabled }}
+      file:
+        path: {{ $auth.file.path }}
+        password:
+          {{- $p := $auth.file.password -}}
+          {{- if $p.algorithm }}
+          algorithm: {{ $p.algorithm }}
+          {{- end -}}
+          {{- if $p.iterations }}
+          iterations: {{ $p.iterations }}
+          {{- end -}}
+          {{- if $p.key_length }}
+          key_length: {{ $p.key_length }}
+          {{- end -}}
+          {{- if $p.salt_length }}
+          salt_length: {{ $p.salt_length }}
+          {{- end -}}
+          {{- if $p.memory }}
+          memory: {{ $p.memory }}
+          {{- end -}}
+          {{- if $p.parallelism }}
+          parallelism: {{ $p.parallelism }}
+          {{- end -}}
+    {{- end -}}
+    {{- if $auth.ldap.enabled }}
+      ldap:
+        implementation: {{ $auth.ldap.implementation | default "custom" }}
+        url: {{ $auth.ldap.url }}
+        timeout: {{ $auth.ldap.timeout | default "5s" }}
+        start_tls: {{ $auth.ldap.start_tls }}
+        tls:
+          {{- if hasKey $auth.ldap.tls "server_name" }}
+          server_name: {{ $auth.ldap.tls.server_name | default $auth.ldap.host }}
+          {{- end }}
+          minimum_version: {{ $auth.ldap.tls.minimum_version | default "TLS1.2" }}
+          skip_verify: {{ $auth.ldap.tls.skip_verify | default false }}
+    {{- if $auth.ldap.base_dn }}
+        base_dn: {{ $auth.ldap.base_dn }}
+    {{- end -}}
+    {{- if $auth.ldap.username_attribute }}
+        username_attribute: {{ $auth.ldap.username_attribute }}
+    {{- end -}}
+    {{- if $auth.ldap.additional_users_dn }}
+        additional_users_dn: {{ $auth.ldap.additional_users_dn }}
+    {{- end -}}
+    {{- if $auth.ldap.users_filter }}
+        users_filter: {{ $auth.ldap.users_filter }}
+    {{- end -}}
+    {{- if $auth.ldap.additional_groups_dn }}
+        additional_groups_dn: {{ $auth.ldap.additional_groups_dn }}
+    {{- end -}}
+    {{- if $auth.ldap.groups_filter }}
+        groups_filter: {{ $auth.ldap.groups_filter }}
+    {{- end -}}
+    {{- if $auth.ldap.group_name_attribute }}
+        group_name_attribute: {{ $auth.ldap.group_name_attribute }}
+    {{- end -}}
+    {{- if $auth.ldap.mail_attribute }}
+        mail_attribute: {{ $auth.ldap.mail_attribute }}
+    {{- end -}}
+    {{- if $auth.ldap.display_name_attribute }}
+        display_name_attribute: {{ $auth.ldap.display_name_attribute }}
+    {{- end }}
+        user: {{ $auth.ldap.user }}
+    {{- end -}}
+    {{- end -}}
+    {{- with $session := .Values.session }}
+    session:
+      name: {{ $session.name | default "authelia_session" }}
+      domain: {{ required "A valid .Values.domain entry required!" $.Values.domain }}
+      same_site: {{ $session.same_site | default "lax" }}
+      expiration: {{ $session.expiration | default "1M" }}
+      inactivity: {{ $session.inactivity | default "5m" }}
+      remember_me_duration: {{ $session.remember_me_duration | default "1M" }}
+    {{- end }}
+      redis:
+        host: {{ .Values.redis.creds.plain }}
+      {{- with $redis := .Values.redisProvider }}
+        port: {{ $redis.port | default 6379 }}
+        {{- if not (eq $redis.username "") }}
+        username: {{ $redis.username }}
+        {{- end }}
+        maximum_active_connections: {{ $redis.maximum_active_connections | default 8 }}
+        minimum_idle_connections: {{ $redis.minimum_idle_connections | default 0 }}
+    {{- if $redis.tls.enabled }}
+        tls:
+          server_name: {{ $redis.tls.server_name }}
+          minimum_version: {{ $redis.tls.minimum_version | default "TLS1.2" }}
+          skip_verify: {{ $redis.tls.skip_verify }}
+    {{- end }}
+    {{- if $redis.high_availability.enabled }}
+        high_availability:
+          sentinel_name: {{ $redis.high_availability.sentinel_name }}
+    {{- if $redis.high_availability.nodes }}
+          nodes:
+          {{- range $node := $redis.high_availability.nodes }}
+          - host: {{ $node.host }}
+            port: {{ $node.port | default 26379 }}
+          {{- end -}}
+    {{- end }}
+          route_by_latency: {{ $redis.high_availability.route_by_latency }}
+          route_randomly: {{ $redis.high_availability.route_randomly }}
+      {{- end }}
+    {{- end }}
+    regulation:
+      max_retries: {{ .Values.regulation.max_retries | default 3 }}
+      find_time: {{ .Values.regulation.find_time | default "1m" }}
+      ban_time: {{ .Values.regulation.ban_time | default "5m" }}
+    storage:
+      postgres:
+        host: {{ $.Values.cnpg.main.creds.host }}
+    {{- with $storage := .Values.storage }}
+        port: {{ $storage.postgres.port | default 5432 }}
+        database: {{ $storage.postgres.database | default "authelia" }}
+        username: {{ $storage.postgres.username | default "authelia" }}
+        timeout: {{ $storage.postgres.timeout | default "5s" }}
+        ssl:
+          mode: {{ $storage.postgres.sslmode | default "disable" }}
+    {{- end }}
+    {{- with $notifier := .Values.notifier }}
+    notifier:
+      disable_startup_check: {{ $.Values.notifier.disable_startup_check }}
+    {{- if $notifier.filesystem.enabled }}
+      filesystem:
+        filename: {{ $notifier.filesystem.filename }}
+    {{- end }}
+    {{- if $notifier.smtp.enabled }}
+      smtp:
+        host: {{ $notifier.smtp.host }}
+        port: {{ $notifier.smtp.port | default 25 }}
+        timeout: {{ $notifier.smtp.timeout | default "5s" }}
+        {{- with $notifier.smtp.username }}
+        username: {{ . }}
+        {{- end }}
+        sender: {{ $notifier.smtp.sender | quote }}
+        identifier: {{ $notifier.smtp.identifier | quote }}
+        subject: {{ $notifier.smtp.subject | quote }}
+        startup_check_address: {{ $notifier.smtp.startup_check_address | quote }}
+        disable_require_tls: {{ $notifier.smtp.disable_require_tls }}
+        disable_html_emails: {{ $notifier.smtp.disable_html_emails }}
+        tls:
+          server_name: {{ $notifier.smtp.tls.server_name | default $notifier.smtp.host }}
+          minimum_version: {{ $notifier.smtp.tls.minimum_version | default "TLS1.2" }}
+          skip_verify: {{ $notifier.smtp.tls.skip_verify | default false }}
+    {{- end }}
+    {{- end }}
+    {{- if .Values.identity_providers.oidc.enabled }}
+    identity_providers:
+      oidc:
+        access_token_lifespan: {{ .Values.identity_providers.oidc.access_token_lifespan | default "1h" }}
+        authorize_code_lifespan: {{ .Values.identity_providers.oidc.authorize_code_lifespan | default "1m" }}
+        id_token_lifespan: {{ .Values.identity_providers.oidc.id_token_lifespan | default "1h" }}
+        refresh_token_lifespan: {{ .Values.identity_providers.oidc.refresh_token_lifespan | default "90m" }}
+        enable_client_debug_messages: {{ .Values.identity_providers.oidc.enable_client_debug_messages | default false }}
+        minimum_parameter_entropy: {{ .Values.identity_providers.oidc.minimum_parameter_entropy | default 8 }}
+        {{- if .Values.identity_providers.oidc.clients  }}
+        clients:
+    {{- range $client := .Values.identity_providers.oidc.clients }}
+        - id: {{ $client.id }}
+          description: {{ $client.description | default $client.id }}
+          secret: {{ $client.secret | default (randAlphaNum 128) }}
+          {{- if $client.public }}
+          public: {{ $client.public }}
+          {{- end }}
+          authorization_policy: {{ $client.authorization_policy | default "two_factor" }}
+          consent_mode: {{ $client.consent_mode | default "auto" }}
+          redirect_uris:
+          {{- range $client.redirect_uris }}
+          - {{ . }}
+          {{- end }}
+          {{- if $client.audience }}
+          audience:
+            {{- range $client.audience }}
+            - {{ . }}
+            {{- end }}
+          {{- end }}
+          scopes:
+          {{- range ($client.scopes | default (list "openid" "profile" "email" "groups")) }}
+            - {{ . }}
+          {{- end }}
+          grant_types:
+          {{- range ($client.grant_types | default (list "refresh_token" "authorization_code")) }}
+            - {{ . }}
+          {{- end }}
+          response_types:
+          {{- range ($client.response_types | default (list "code")) }}
+            - {{ . }}
+          {{- end }}
+          {{- if $client.response_modes }}
+          response_modes:
+          {{- range $client.response_modes }}
+            - {{ . }}
+          {{- end }}
+          {{- end }}
+          userinfo_signing_algorithm: {{ $client.userinfo_signing_algorithm | default "none" }}
+    {{- end }}
+    {{- end }}
+    {{- end }}
+    access_control:
+    {{- if not .Values.access_control.rules }}
+      {{- if (eq .Values.access_control.default_policy "bypass") }}
+      default_policy: one_factor
+      {{- else if (eq .Values.access_control.default_policy "deny") }}
+      default_policy: two_factor
+      {{- else }}
+      default_policy: {{ .Values.access_control.default_policy }}
+      {{- end }}
+    {{- else }}
+      default_policy: {{ .Values.access_control.default_policy }}
+    {{- end }}
+
+    {{- if not .Values.access_control.networks }}
+      networks: []
+    {{- else }}
+      networks:
+    {{- range $net := .Values.access_control.networks }}
+      - name: {{ $net.name }}
+        networks:
+          {{- range $net.networks }}
+          - {{ . | squote }}
+          {{- end }}
+    {{- end }}
+    {{- end }}
+
+    {{- if not .Values.access_control.rules }}
+      rules: []
+    {{- else }}
+      rules:
+    {{- range $rule := .Values.access_control.rules }}
+      {{- if $rule.domain }}
+      - domain:
+        {{- if kindIs "string" $rule.domain }}
+          - {{ $rule.domain | squote }}
+        {{- else -}}
+          {{- range $rule.domain }}
+          - {{ . | squote }}
+          {{- end }}
+        {{- end }}
+      {{- end -}}
+      {{- with $rule.policy }}
+        policy: {{ . }}
+      {{- end -}}
+      {{- if $rule.networks }}
+        networks:
+        {{- if kindIs "string" $rule.networks }}
+          - {{ $rule.networks | squote }}
+        {{- else -}}
+          {{- range $rule.networks }}
+            - {{ . | squote }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+      {{- if $rule.subject }}
+        subject:
+        {{- if kindIs "string" $rule.subject }}
+          - {{ $rule.subject | squote }}
+        {{- else -}}
+          {{- range $rule.subject }}
+            - {{ . | squote }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+      {{- if $rule.resources }}
+        resources:
+        {{- if kindIs "string" $rule.resources }}
+          - {{ $rule.resources | squote }}
+        {{- else -}}
+          {{- range $rule.resources }}
+            - {{ . | squote }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
+    {{- end }}
+    ...
+{{- end -}}

enterprise/authelia/19.0.8/templates/_secrets.tpl

@@ -0,0 +1,53 @@
+{{/* Define the secrets */}}
+{{- define "authelia.secrets" -}}
+{{- $basename := include "tc.v1.common.lib.chart.names.fullname" $ -}}
+{{- $fetchname := printf "%s-authelia-secrets" $basename -}}
+
+{{/* Initialize all keys */}}
+{{- $oidckey := genPrivateKey "rsa" }}
+{{- $oidcsecret := randAlphaNum 32 }}
+{{- $jwtsecret := randAlphaNum 50 }}
+{{- $sessionsecret := randAlphaNum 50 }}
+{{- $encryptionkey := randAlphaNum 100 }}
+
+enabled: true
+data:
+  {{ with (lookup "v1" "Secret" .Release.Namespace $fetchname) }}
+    {{/* Get previous values and decode */}}
+    {{ $sessionsecret = (index .data "SESSION_ENCRYPTION_KEY") | b64dec }}
+    {{ $jwtsecret = (index .data "JWT_TOKEN") | b64dec }}
+    {{ $encryptionkey = (index .data "ENCRYPTION_KEY") | b64dec }}
+
+    {{/* Check if those keys ever existed. as OIDC is optional */}}
+    {{ if and (hasKey .data "OIDC_PRIVATE_KEY") (hasKey .data "OIDC_HMAC_SECRET") }}
+      {{ $oidckey = (index .data "OIDC_PRIVATE_KEY") | b64dec }}
+      {{ $oidcsecret = (index .data "OIDC_HMAC_SECRET") | b64dec }}
+    {{ end }}
+  {{ end }}
+  SESSION_ENCRYPTION_KEY: {{ $sessionsecret }}
+  JWT_TOKEN: {{ $jwtsecret }}
+  ENCRYPTION_KEY: {{ $encryptionkey }}
+
+  {{- if .Values.authentication_backend.ldap.enabled }}
+  LDAP_PASSWORD: {{ .Values.authentication_backend.ldap.plain_password }}
+  {{- end }}
+
+  {{- if and .Values.notifier.smtp.enabled .Values.notifier.smtp.plain_password }}
+  SMTP_PASSWORD: {{ .Values.notifier.smtp.plain_password }}
+  {{- end }}
+
+  {{- if .Values.duo_api.enabled }}
+  DUO_API_KEY: {{ .Values.duo_api.plain_api_key }}
+  {{- end }}
+
+  STORAGE_PASSWORD: {{ $.Values.cnpg.main.creds.password | trimAll "\"" }}
+
+  REDIS_PASSWORD: {{ .Values.redis.creds.redisPassword | trimAll "\"" }}
+  {{- if .Values.redisProvider.high_availability.enabled }}
+  REDIS_SENTINEL_PASSWORD: {{ .Values.redis.sentinelPassword | trimAll "\"" }}
+  {{- end }}
+
+  OIDC_PRIVATE_KEY: |
+    {{- $oidckey | nindent 4 }}
+  OIDC_HMAC_SECRET: {{ $oidcsecret }}
+{{- end -}}

enterprise/authelia/19.0.8/templates/common.yaml

@@ -0,0 +1,77 @@
+{{/* Make sure all variables are set properly */}}
+{{- include "tc.v1.common.loader.init" . }}
+
+{{/* Render configmap for authelia */}}
+{{- $configmapPaths := include "authelia.configmap.paths" . | fromYaml -}}
+{{- if $configmapPaths -}}
+  {{- $_ := set .Values.configmap "authelia-paths" $configmapPaths -}}
+{{- end -}}
+
+{{- $configmapFile := include "authelia.configmap.configfile" . | fromYaml -}}
+{{- if $configmapFile -}}
+  {{- $_ := set .Values.configmap "authelia-configfile" $configmapFile -}}
+{{- end -}}
+
+{{/* Render secrets for authelia */}}
+{{- $secret := include "authelia.secrets" . | fromYaml -}}
+{{- if $secret -}}
+  {{- $_ := set .Values.secret "authelia-secrets" $secret -}}
+{{- end -}}
+
+{{/* Append the general configMap volume to the volumes */}}
+{{- define "authelia.configmapVolume" -}}
+enabled: true
+mountPath: /configuration.yaml
+subPath: configuration.yaml
+readOnly: true
+type: "configmap"
+objectName: authelia-configfile
+{{- end -}}
+
+{{/* Append the general secret volumes to the volumes */}}
+{{- define "authelia.secretVolumes" -}}
+enabled: true
+mountPath: "/secrets"
+readOnly: true
+type: "secret"
+objectName: authelia-secrets
+items:
+  - key: "JWT_TOKEN"
+    path: JWT_TOKEN
+  - key: "SESSION_ENCRYPTION_KEY"
+    path: SESSION_ENCRYPTION_KEY
+  - key: "ENCRYPTION_KEY"
+    path: ENCRYPTION_KEY
+  - key: "STORAGE_PASSWORD"
+    path: STORAGE_PASSWORD
+    {{- if .Values.authentication_backend.ldap.enabled }}
+  - key: "LDAP_PASSWORD"
+    path: LDAP_PASSWORD
+    {{- end }}
+    {{- if and .Values.notifier.smtp.enabled .Values.notifier.smtp.plain_password }}
+  - key: "SMTP_PASSWORD"
+    path: SMTP_PASSWORD
+    {{- end }}
+  - key: "REDIS_PASSWORD"
+    path: REDIS_PASSWORD
+    {{- if .Values.redisProvider.high_availability.enabled}}
+  - key: "REDIS_SENTINEL_PASSWORD"
+    path: REDIS_SENTINEL_PASSWORD
+    {{- end }}
+    {{- if .Values.duo_api.enabled }}
+  - key: "DUO_API_KEY"
+    path: DUO_API_KEY
+    {{- end }}
+    {{- if .Values.identity_providers.oidc.enabled }}
+  - key: "OIDC_PRIVATE_KEY"
+    path: OIDC_PRIVATE_KEY
+  - key: "OIDC_HMAC_SECRET"
+    path: OIDC_HMAC_SECRET
+    {{- end }}
+{{- end -}}
+
+{{- $_ := set .Values.persistence "authelia-configfile" (include "authelia.configmapVolume" . | fromYaml) -}}
+{{- $_ := set .Values.persistence "authelia-secrets" (include "authelia.secretVolumes" . | fromYaml) -}}
+
+{{/* Render the templates */}}
+{{ include "tc.v1.common.loader.apply" . }}

enterprise/blocky/9.0.5/app-changelog.md

@@ -1,9 +0,0 @@
-
-
-## [blocky-9.0.5](https://github.com/truecharts/charts/compare/blocky-9.0.4...blocky-9.0.5) (2023-11-08)
-
-### Chore
-
-- update helm general non-major ([#14454](https://github.com/truecharts/charts/issues/14454))
-  
-  

enterprise/blocky/9.0.6/CHANGELOG.md

@@ -4,6 +4,11 @@
 
 
 
+## [blocky-9.0.6](https://github.com/truecharts/charts/compare/blocky-9.0.5...blocky-9.0.6) (2023-11-08)
+
+
+
+
 ## [blocky-9.0.5](https://github.com/truecharts/charts/compare/blocky-9.0.4...blocky-9.0.5) (2023-11-08)
 
 ### Chore
@@ -92,8 +97,3 @@
 
 ### Chore
 
-- update helm general non-major ([#10955](https://github.com/truecharts/charts/issues/10955))
-  
-  
-
-

enterprise/blocky/9.0.6/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "0.22.0"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.3.3
+    version: 14.3.4
   - condition: redis.enabled
     name: redis
     repository: https://deps.truecharts.org
@@ -25,7 +25,7 @@ sources:
   - https://0xerr0r.github.io/blocky/
   - https://github.com/0xERR0R/blocky
   - https://github.com/Mozart409/blocky-frontend
-version: 9.0.5
+version: 9.0.6
 annotations:
   truecharts.org/category: network
   truecharts.org/SCALE-support: "true"

enterprise/blocky/9.0.6/app-changelog.md

@@ -0,0 +1,4 @@
+
+
+## [blocky-9.0.6](https://github.com/truecharts/charts/compare/blocky-9.0.5...blocky-9.0.6) (2023-11-08)
+

enterprise/clusterissuer/4.2.7/app-changelog.md

@@ -1,9 +0,0 @@
-
-
-## [clusterissuer-4.2.7](https://github.com/truecharts/charts/compare/clusterissuer-4.2.6...clusterissuer-4.2.7) (2023-11-08)
-
-### Chore
-
-- update helm general non-major ([#14454](https://github.com/truecharts/charts/issues/14454))
-  
-  

enterprise/clusterissuer/4.2.8/CHANGELOG.md

@@ -4,6 +4,11 @@
 
 
 
+## [clusterissuer-4.2.8](https://github.com/truecharts/charts/compare/clusterissuer-4.2.7...clusterissuer-4.2.8) (2023-11-08)
+
+
+
+
 ## [clusterissuer-4.2.7](https://github.com/truecharts/charts/compare/clusterissuer-4.2.6...clusterissuer-4.2.7) (2023-11-08)
 
 ### Chore
@@ -92,8 +97,3 @@
   
   
 
-
-## [clusterissuer-4.1.3](https://github.com/truecharts/charts/compare/clusterissuer-4.1.2...clusterissuer-4.1.3) (2023-10-14)
-
-### Chore
-

enterprise/clusterissuer/4.2.8/Chart.yaml

@@ -10,7 +10,7 @@ keywords:
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.3.3
+    version: 14.3.4
 kubeVersion: ">=1.16.0-0"
 maintainers:
   - email: info@truecharts.org
@@ -21,7 +21,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/enterprise/clusterissuer
   - https://cert-manager.io/
 type: application
-version: 4.2.7
+version: 4.2.8
 annotations:
   truecharts.org/category: core
   truecharts.org/SCALE-support: "true"

enterprise/clusterissuer/4.2.8/LICENSE

@@ -0,0 +1,106 @@
+Business Source License 1.1
+
+Parameters
+
+Licensor:             The TrueCharts Project, it's owner and it's contributors
+Licensed Work:        The TrueCharts "Cert-Manager" Helm Chart
+Additional Use Grant: You may use the licensed work in production, as long
+                      as it is directly sourced from a TrueCharts provided
+                      official repository, catalog or source. You may also make private
+                      modification to the directly sourced licenced work,
+                      when used in production.
+
+                      The following cases are, due to their nature, also
+                      defined as 'production use' and explicitly prohibited:
+                      - Bundling, including or displaying the licensed work
+                      with(in) another work intended for production use,
+                      with the apparent intend of facilitating and/or
+                      promoting production use by third parties in
+                      violation of this license.
+
+Change Date:          2050-01-01
+
+Change License:       3-clause BSD license
+
+For information about alternative licensing arrangements for the Software,
+please contact: legal@truecharts.org
+
+Notice
+
+The Business Source License (this document, or the “License”) is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
+“Business Source License” is a trademark of MariaDB Corporation Ab.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license
+your works, and to refer to it using the trademark “Business Source License”,
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License’s text and the “Business
+Source License” name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where “compatible” means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text “None”.
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

enterprise/clusterissuer/4.2.8/app-changelog.md

@@ -0,0 +1,4 @@
+
+
+## [clusterissuer-4.2.8](https://github.com/truecharts/charts/compare/clusterissuer-4.2.7...clusterissuer-4.2.8) (2023-11-08)
+

enterprise/external-dns/1.0.1/app-changelog.md

@@ -1,9 +0,0 @@
-
-
-## [external-dns-1.0.1](https://github.com/truecharts/charts/compare/external-dns-1.0.0...external-dns-1.0.1) (2023-11-08)
-
-### Chore
-
-- update helm general non-major ([#14454](https://github.com/truecharts/charts/issues/14454))
-  
-  

enterprise/external-dns/1.0.2/CHANGELOG.md

@@ -4,6 +4,11 @@
 
 
 
+## [external-dns-1.0.2](https://github.com/truecharts/charts/compare/external-dns-1.0.1...external-dns-1.0.2) (2023-11-08)
+
+
+
+
 ## [external-dns-1.0.1](https://github.com/truecharts/charts/compare/external-dns-1.0.0...external-dns-1.0.1) (2023-11-08)
 
 ### Chore

enterprise/external-dns/1.0.2/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "0.13.6"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.3.3
+    version: 14.3.4
 deprecated: false
 description: ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with DNS providers.
 home: https://truecharts.org/charts/enterprise/external-dns
@@ -22,7 +22,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/enterprise/external-dns
   - https://github.com/kubernetes-sigs/external-dns
 type: application
-version: 1.0.1
+version: 1.0.2
 annotations:
   truecharts.org/category: networking
   truecharts.org/SCALE-support: "true"

enterprise/external-dns/1.0.2/app-changelog.md

@@ -0,0 +1,4 @@
+
+
+## [external-dns-1.0.2](https://github.com/truecharts/charts/compare/external-dns-1.0.1...external-dns-1.0.2) (2023-11-08)
+

enterprise/grafana/9.0.36/app-changelog.md

@@ -1,9 +0,0 @@
-
-
-## [grafana-9.0.36](https://github.com/truecharts/charts/compare/grafana-9.0.35...grafana-9.0.36) (2023-11-08)
-
-### Chore
-
-- update container image tccr.io/truecharts/grafana to v10.2.0 ([#14461](https://github.com/truecharts/charts/issues/14461))
-  
-  

enterprise/grafana/9.0.37/CHANGELOG.md

@@ -4,6 +4,11 @@
 
 
 
+## [grafana-9.0.37](https://github.com/truecharts/charts/compare/grafana-9.0.36...grafana-9.0.37) (2023-11-08)
+
+
+
+
 ## [grafana-9.0.36](https://github.com/truecharts/charts/compare/grafana-9.0.35...grafana-9.0.36) (2023-11-08)
 
 ### Chore
@@ -92,8 +97,3 @@
 
 - update container image tccr.io/truecharts/grafana to v10.1.4 ([#13551](https://github.com/truecharts/charts/issues/13551))
   
-  
-
-
-## [grafana-9.0.26](https://github.com/truecharts/charts/compare/grafana-9.0.25...grafana-9.0.26) (2023-10-11)
-

enterprise/grafana/9.0.37/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "10.2.0"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.3.3
+    version: 14.3.4
 deprecated: false
 description: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, Elasticsearch, OpenTSDB, Prometheus and InfluxDB.
 home: https://truecharts.org/charts/enterprise/grafana
@@ -24,7 +24,7 @@ sources:
   - https://github.com/bitnami/bitnami-docker-grafana
   - https://grafana.com/
 type: application
-version: 9.0.36
+version: 9.0.37
 annotations:
   truecharts.org/category: metrics
   truecharts.org/SCALE-support: "true"

enterprise/grafana/9.0.37/app-changelog.md

@@ -0,0 +1,4 @@
+
+
+## [grafana-9.0.37](https://github.com/truecharts/charts/compare/grafana-9.0.36...grafana-9.0.37) (2023-11-08)
+

enterprise/kubernetes-reflector/1.0.3/app-changelog.md

@@ -1,9 +0,0 @@
-
-
-## [kubernetes-reflector-1.0.3](https://github.com/truecharts/charts/compare/kubernetes-reflector-1.0.2...kubernetes-reflector-1.0.3) (2023-11-08)
-
-### Chore
-
-- update helm general non-major ([#14454](https://github.com/truecharts/charts/issues/14454))
-  
-  

enterprise/kubernetes-reflector/1.0.4/CHANGELOG.md

@@ -4,6 +4,11 @@
 
 
 
+## [kubernetes-reflector-1.0.4](https://github.com/truecharts/charts/compare/kubernetes-reflector-1.0.3...kubernetes-reflector-1.0.4) (2023-11-08)
+
+
+
+
 ## [kubernetes-reflector-1.0.3](https://github.com/truecharts/charts/compare/kubernetes-reflector-1.0.2...kubernetes-reflector-1.0.3) (2023-11-08)
 
 ### Chore

enterprise/kubernetes-reflector/1.0.4/Chart.yaml

@@ -13,7 +13,7 @@ keywords:
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.3.3
+    version: 14.3.4
 kubeVersion: ">=1.16.0-0"
 maintainers:
   - email: info@truecharts.org
@@ -24,7 +24,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/enterprise/kubernetes-reflector
   - https://github.com/emberstack/kubernetes-reflector
 type: application
-version: 1.0.3
+version: 1.0.4
 annotations:
   truecharts.org/category: operators
   truecharts.org/SCALE-support: "true"

enterprise/kubernetes-reflector/1.0.4/app-changelog.md

@@ -0,0 +1,4 @@
+
+
+## [kubernetes-reflector-1.0.4](https://github.com/truecharts/charts/compare/kubernetes-reflector-1.0.3...kubernetes-reflector-1.0.4) (2023-11-08)
+

enterprise/metallb-config/3.0.8/app-changelog.md

@@ -1,9 +0,0 @@
-
-
-## [metallb-config-3.0.8](https://github.com/truecharts/charts/compare/metallb-config-3.0.7...metallb-config-3.0.8) (2023-11-08)
-
-### Chore
-
-- update helm general non-major ([#14454](https://github.com/truecharts/charts/issues/14454))
-  
-  

enterprise/metallb-config/3.0.9/CHANGELOG.md

@@ -4,6 +4,11 @@
 
 
 
+## [metallb-config-3.0.9](https://github.com/truecharts/charts/compare/metallb-config-3.0.8...metallb-config-3.0.9) (2023-11-08)
+
+
+
+
 ## [metallb-config-3.0.8](https://github.com/truecharts/charts/compare/metallb-config-3.0.7...metallb-config-3.0.8) (2023-11-08)
 
 ### Chore
@@ -92,8 +97,3 @@
   
   
 
-
-## [metallb-config-2.0.1](https://github.com/truecharts/charts/compare/metallb-config-2.0.0...metallb-config-2.0.1) (2023-07-29)
-
-### Chore
-

enterprise/metallb-config/3.0.9/Chart.yaml

@@ -10,7 +10,7 @@ keywords:
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 14.3.3
+    version: 14.3.4
 kubeVersion: ">=1.16.0-0"
 maintainers:
   - email: info@truecharts.org
@@ -22,7 +22,7 @@ sources:
   - https://github.com/metallb/metallb
   - https://metallb.universe.tf
 type: application
-version: 3.0.8
+version: 3.0.9
 annotations:
   truecharts.org/category: core
   truecharts.org/SCALE-support: "true"

enterprise/metallb-config/3.0.9/README.md

@@ -0,0 +1,27 @@
+# README
+
+## General Info
+
+TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
+However only installations using the TrueNAS SCALE Apps system are supported.
+
+For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/enterprise/)
+
+**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
+
+
+## Support
+
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
+- See the [Website](https://truecharts.org)
+- Check our [Discord](https://discord.gg/tVsPTHWTtr)
+- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
+
+---
+
+## Sponsor TrueCharts
+
+TrueCharts can only exist due to the incredible effort of our staff.
+Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
+
+*All Rights Reserved - The TrueCharts Project*

enterprise/metallb-config/3.0.9/app-changelog.md

@@ -0,0 +1,4 @@
+
+
+## [metallb-config-3.0.9](https://github.com/truecharts/charts/compare/metallb-config-3.0.8...metallb-config-3.0.9) (2023-11-08)
+