# Apply: kubectl apply -f manifests/authentik/authentik-proxy-outpost.yaml
# Delete: kubectl delete -f manifests/authentik/authentik-proxy-outpost.yaml
# Description: Authentik proxy outpost deployment and service for forward-auth integration.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: authentik-proxy-outpost
  namespace: authentik
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: authentik-proxy-outpost
  namespace: authentik
spec:
  replicas: 1
  selector:
    matchLabels:
      app: authentik-proxy-outpost
  template:
    metadata:
      labels:
        app: authentik-proxy-outpost
    spec:
      serviceAccountName: authentik-proxy-outpost
      containers:
        - name: proxy
          image: ghcr.io/goauthentik/proxy:2026.2.1
          env:
            - name: AUTHENTIK_HOST
              value: "https://auth.home.arpa"
            - name: AUTHENTIK_INSECURE
              value: "true"
            - name: AUTHENTIK_TOKEN
              valueFrom:
                secretKeyRef:
                  name: authentik-proxy-token
                  key: token
          ports:
            - containerPort: 9000
              name: http
            - containerPort: 9443
              name: https
---
apiVersion: v1
kind: Service
metadata:
  name: authentik-proxy-outpost
  namespace: authentik
spec:
  selector:
    app: authentik-proxy-outpost
  ports:
    - name: http
      port: 9000
      targetPort: 9000