Confused about different config options

[manuschillerdev]

Hey,

I want to use Authelia in my Homelab.
It should mainly act as glue between a "Sign in With Google" App (OIDC), i do not need local users.

I am trying to install the helm-chart in my cluster, but although having read through the docs about Secrets and Kubernetes I struggle to decide which parts I need and should configure.

In my understanding a "production" ready environment should have some kind of database instead of being file based, so I went for the following setup:

apiVersion: v2
name: authelia
version: 0.1.0

dependencies:
  - name: authelia
    version: 0.9.14
    repository: https://charts.authelia.com

authelia:
  postgresql:
    auth:
      existingSecret: postgresql-credentials
  configMap:
    storage:
      postgres:
        enabled: true
        deploy: true
        address: "authelia-postgresql:5432"
    notifier:
      filesystem:
        enabled: true
    authentication_backend:
      file:
        enabled: true
    session:
      cookies:
        - domain: "***redacted***"
          subdomain: "sso"
  ingress:
    enabled: true
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-dns-01-cloudflare
      external-dns.alpha.kubernetes.io/ttl: "60"
    tls:
      enabled: true

Everything gets synced properly by argocd, but the authelia pod shows the following errors during startup:

time="2025-01-05T07:05:52Z" level=warning msg="Configuration: access_control: no rules have been specified so the 'default_policy' of 'two_factor' is going to be applied to all requests"
time="2025-01-05T07:05:52Z" level=info msg="Authelia v4.38.16 is starting"
time="2025-01-05T07:05:52Z" level=info msg="Log severity set to info"
time="2025-01-05T07:06:01Z" level=error msg="Error occurred running a startup check" error="error pinging database: failed to connect to `user=authelia database=authelia`: 10.43.121.126:5432 (authelia-postgresql): failed SASL auth: FATAL: password authentication failed for user \"authelia\" (SQLSTATE 28P01)" provider=storage
time="2025-01-05T07:06:01Z" level=error msg="Error checking user authentication YAML database" error="user authentication database file doesn't exist at path '/config/users_database.yml' and has been generated"
time="2025-01-05T07:06:01Z" level=error msg="Error occurred running a startup check" error="one or more errors occurred checking the authentication database" provider=user
time="2025-01-05T07:06:01Z" level=fatal msg="One or more providers had fatal failures performing startup checks, for more detail check the error level logs" providers="[storage user]" stack="github.com/authelia/authelia/v4/internal/commands/root.go:150 doStartupChecks\ngithub.com/authelia/authelia/v4/internal/commands/root.go:88  (*CmdCtx).RootRunE\ngithub.com/spf13/[email protected]/command.go:985                  (*Command).execute\ngithub.com/spf13/[email protected]/command.go:1117                 (*Command).ExecuteC\ngithub.com/spf13/[email protected]/command.go:1041                 (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10       main\ninternal/runtime/atomic/types.go:194                          (*Uint32).Load\nruntime/asm_amd64.s:1700                                      goexit"

I could debug through each message - but: is there any reference on:

• how an existing secret should be structured?
• how the keys should be named?
• which parts should be enabled for production? (Redis? Postgres?)

Are there any minimal example configurations available for this chart?

[james-d-elliott]

Hey apologies for not getting back sooner, will aim to dedicate some time this week to look at this.