From d37e399a7c56fa430e68f450e511e406d69bee81 Mon Sep 17 00:00:00 2001
From: Zoe Roux <zoe.roux@zoriya.dev>
Date: Wed, 16 Jul 2025 14:13:23 +0200
Subject: [PATCH] Add authentik cert for postgres

---
 apps/authentik.yaml | 52 ++++++++++++++++++++++++++++++++++-----------
 1 file changed, 40 insertions(+), 12 deletions(-)

diff --git a/apps/authentik.yaml b/apps/authentik.yaml
index 1df3317..483c3fb 100644
--- a/apps/authentik.yaml
+++ b/apps/authentik.yaml
@@ -26,6 +26,17 @@ spec:
             host: postgres-cluster-rw.postgres
 
         server:
+          env:
+            - name: AUTHENTIK_POSTGRESQL__SSLCERT
+              value: /var/postgres-ssl/tls.crt
+          volumeMounts:
+            - name: postgres-cert
+              mountPath: /var/postgres-ssl
+          volumes:
+            - name: postgres-cert
+              secret:
+                secretName: postgres-authentik
+
           ingress:
             enabled: true
             ingressClassName: cilium
@@ -35,15 +46,32 @@ spec:
         # don't use bitnami's postgres
         postgresql:
           enabled: false
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: authentik-db
-  namespace: postgres
-spec:
-  name: authentik
-  owner: authentik
-  cluster:
-    name: postgres-cluster
-  databaseReclaimPolicy: delete
+
+        additionalObjects:
+          - apiVersion: postgresql.cnpg.io/v1
+            kind: Database
+            metadata:
+              name: authentik-db
+              namespace: postgres
+            spec:
+              name: authentik
+              owner: authentik
+              cluster:
+                name: postgres-cluster
+              databaseReclaimPolicy: delete
+
+          - apiVersion: cert-manager.io/v1
+            kind: Certificate
+            metadata:
+              name: postgres-authentik
+              namespace: postgres
+            spec:
+              secretName: postgres-authentik
+              usages:
+                - client auth
+              # same as pg user
+              commonName: authentik
+              issuerRef:
+                name: postgres-ca
+                kind: Issuer
+                group: cert-manager.io