chore(deps): update container image tccr.io/truecharts/adminer to latest (#10143)

Signed-off-by: TrueCharts-Bot <bot@truecharts.org>

.all-contributorsrc

@@ -1837,6 +1837,42 @@
       "contributions": [
         "doc"
       ]
+    },
+    {
+      "login": "VictorienXP",
+      "name": "VictorienXP",
+      "avatar_url": "https://avatars.githubusercontent.com/u/1633366?v=4",
+      "profile": "https://github.com/VictorienXP",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "yelhouti",
+      "name": "yelhouti",
+      "avatar_url": "https://avatars.githubusercontent.com/u/5471639?v=4",
+      "profile": "https://github.com/yelhouti",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "svetlemodry",
+      "name": "Jaroslav Lichtblau",
+      "avatar_url": "https://avatars.githubusercontent.com/u/8712544?v=4",
+      "profile": "https://github.com/svetlemodry",
+      "contributions": [
+        "doc"
+      ]
+    },
+    {
+      "login": "Maximilian-Staab",
+      "name": "MaximilianS",
+      "avatar_url": "https://avatars.githubusercontent.com/u/20892091?v=4",
+      "profile": "https://github.com/Maximilian-Staab",
+      "contributions": [
+        "doc"
+      ]
     }
   ],
   "contributorsPerLine": 7,

.github/README.md

@@ -124,7 +124,7 @@ A lot of our work is based on the great effort of others. We would love to exten
 ## Contributors ✨
 
 <!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
-[![All Contributors](https://img.shields.io/badge/all_contributors-196-orange.svg?style=for-the-badge)](#contributors)
+[![All Contributors](https://img.shields.io/badge/all_contributors-200-orange.svg?style=for-the-badge)](#contributors)
 <!-- ALL-CONTRIBUTORS-BADGE:END -->
 
 Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
@@ -388,6 +388,12 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/depasseg"><img src="https://avatars.githubusercontent.com/u/3201827?v=4?s=100" width="100px;" alt="depasseg"/><br /><sub><b>depasseg</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=depasseg" title="Documentation">📖</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/j1mbl3s"><img src="https://avatars.githubusercontent.com/u/44634577?v=4?s=100" width="100px;" alt="j1mbl3s"/><br /><sub><b>j1mbl3s</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=j1mbl3s" title="Documentation">📖</a></td>
     </tr>
+    <tr>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/VictorienXP"><img src="https://avatars.githubusercontent.com/u/1633366?v=4?s=100" width="100px;" alt="VictorienXP"/><br /><sub><b>VictorienXP</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=VictorienXP" title="Code">💻</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/yelhouti"><img src="https://avatars.githubusercontent.com/u/5471639?v=4?s=100" width="100px;" alt="yelhouti"/><br /><sub><b>yelhouti</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=yelhouti" title="Code">💻</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/svetlemodry"><img src="https://avatars.githubusercontent.com/u/8712544?v=4?s=100" width="100px;" alt="Jaroslav Lichtblau"/><br /><sub><b>Jaroslav Lichtblau</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=svetlemodry" title="Documentation">📖</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/Maximilian-Staab"><img src="https://avatars.githubusercontent.com/u/20892091?v=4?s=100" width="100px;" alt="MaximilianS"/><br /><sub><b>MaximilianS</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=Maximilian-Staab" title="Documentation">📖</a></td>
+    </tr>
   </tbody>
 </table>
 

.github/ct-install.yaml

@@ -1,6 +1,6 @@
 remote: origin
 target-branch: master
-helm-extra-args: --timeout 180s
+helm-extra-args: --timeout 250s
 chart-yaml-schema: .github/chart_schema.yaml
 chart-dirs:
   - charts/incubator
@@ -11,8 +11,10 @@ chart-dirs:
   - charts/operators
 excluded-charts:
   - charts/dependency/subchart
+  - charts/incubator/twingate-connector
   - charts/incubator/orbital-sync
   - charts/incubator/plex-meta-manager
+  - charts/incubator/tauticord
   - charts/library/common
   - charts/stable/alertmanager-bot
   - charts/stable/alertmanager-bot
@@ -23,12 +25,12 @@ excluded-charts:
   - charts/stable/foundryvtt
   - charts/stable/foundryvtt
   - charts/stable/heimdall
+  - charts/stable/mc-router
   - charts/stable/multus
   - charts/stable/orbital-sync
   - charts/stable/plex-meta-manager
   - charts/stable/pod-gateway
   - charts/stable/promcord
-  - charts/stable/promcord
   - charts/stable/rdesktop
   - charts/stable/reg
   - charts/stable/romm

.github/scripts/build-catalog.sh

@@ -75,6 +75,21 @@ patch_apps() {
     sed -i "s|^icon:|icon_url:|g" catalog/${train}/${chartname}/item.yaml
     echo "categories:" >> catalog/${train}/${chartname}/item.yaml
     cat ${target}/Chart.yaml | yq '.annotations."truecharts.org/catagories"' -r >> catalog/${train}/${chartname}/item.yaml
+
+    # Generate screenshots
+    screenshots=""
+    if [[ -d "${target}/screenshots" ]]; then
+        screenshots=$(ls ${target}/screenshots)
+    fi
+    if [[ -n $screenshots ]]; then
+        echo "screenshots:" >> catalog/${train}/${chartname}/item.yaml
+        for screenshot in $screenshots; do
+            echo "  - https://truecharts.org/img/hotlink-ok/chart-screenshots/${chartname}/${screenshot}" >> catalog/${train}/${chartname}/item.yaml
+        done
+    else
+        echo "screenshots: []" >> catalog/${train}/${chartname}/item.yaml
+    fi
+    rm -rf ${target}/screenshots
     # Copy changelog from website
     if [[ ! -f "website/docs/charts/${train}/${chartname}/CHANGELOG.md" ]]; then
         touch "website/docs/charts/${train}/${chartname}/CHANGELOG.md"

.github/scripts/tc-lint.sh

@@ -4,6 +4,19 @@ function check_version() {
     chart_path=${1:?"No chart path provided to [Version Check]"}
     target_branch=${2:?"No target branch provided to [Version Check]"}
 
+    # If only docs changed, skip version check
+    # git diff target_branch, filter only on $chart_path and invert match for $chart_path/docs
+    # note that it requires branches to be up to date for this to work.
+    chart_changes=$(git diff --name-status "$target_branch" -- "$chart_path" | grep -v "$chart_path/docs")
+    echo -e "\tChange files: \n\n$chart_changes"
+
+    if [[ -z "$chart_changes" ]]; then
+        echo -e "\tLooks like only docs changed. Skipping chart version check"
+        echo -e "\t✅ Chart version: No bump required"
+        echo ''
+        return
+    fi
+
     new=$(git diff "$target_branch" -- "$chart_path" | sed -nr 's/^\+version: (.*)$/\1/p')
     old=$(git diff "$target_branch" -- "$chart_path" | sed -nr 's/^\-version: (.*)$/\1/p')
 
@@ -23,6 +36,7 @@ function check_version() {
             curr_result=1
         fi
     fi
+    echo ''
 }
 export -f check_version
 
@@ -32,7 +46,9 @@ function check_chart_schema(){
     yamale_output=$(yamale --schema .github/chart_schema.yaml "$chart_path/Chart.yaml")
     yamale_exit_code=$?
     while IFS= read -r line; do
-        echo -e "\t$line"
+        if [[ -n $line ]]; then
+            echo -e "\t$line"
+        fi
     done <<< "$yamale_output"
 
     if [ $yamale_exit_code -ne 0 ]; then
@@ -41,6 +57,7 @@ function check_chart_schema(){
     else
         echo -e "\t✅ Chart Schema: Passed"
     fi
+    echo ''
 }
 export -f check_chart_schema
 
@@ -51,7 +68,9 @@ function helm_lint(){
     helm_lint_output=$(helm lint --quiet "$chart_path")
     helm_lint_exit_code=$?
     while IFS= read -r line; do
-        echo -e "\t$line"
+        if [[ -n $line ]]; then
+            echo -e "\t$line"
+        fi
     done <<< "$helm_lint_output"
 
     if [ $helm_lint_exit_code -ne 0 ]; then
@@ -60,16 +79,46 @@ function helm_lint(){
     else
         echo -e "\t✅ Helm Lint: Passed"
     fi
+    echo ''
 }
 export -f helm_lint
 
+function helm_template(){
+    chart_path=${1:?"No chart path provided to [Helm template]"}
+    values=${2:-}
+
+    if [[ -n "$values" ]]; then
+        values="-f $values"
+    fi
+
+    # Print only errors and warnings
+    helm_template_output=$(helm template $values "$chart_path" 2>&1 >/dev/null)
+    helm_template_exit_code=$?
+    while IFS= read -r line; do
+        if [[ -n $line ]]; then
+            echo -e "\t$line"
+        fi
+    done <<< "$helm_template_output"
+
+    if [ $helm_template_exit_code -ne 0 ]; then
+        echo -e "\t❌ Helm template: Failed"
+        curr_result=1
+    else
+        echo -e "\t✅ Helm template: Passed"
+    fi
+    echo ''
+}
+export -f helm_template
+
 function yaml_lint(){
     file_path=${1:?"No file path provided to [YAML lint]"}
 
     yaml_lint_output=$(yamllint --config-file .github/yaml-lint-conf.yaml "$file_path")
     yaml_lint_exit_code=$?
     while IFS= read -r line; do
-        echo -e "\t$line"
+        if [[ -n $line ]]; then
+            echo -e "\t$line"
+        fi
     done <<< "$yaml_lint_output"
 
     if [ $yaml_lint_exit_code -ne 0 ]; then
@@ -78,6 +127,7 @@ function yaml_lint(){
     else
         echo -e "\t✅ YAML Lint: Passed [$file_path]"
     fi
+    echo ''
 }
 export -f yaml_lint
 
@@ -97,6 +147,18 @@ function lint_chart(){
         echo "👣 Helm Lint - [$chart_path]"
         helm_lint "$chart_path"
 
+        if [[ ! $(ls $chart_path/ci/*values.yaml) ]]; then
+            echo "👣 Helm Template - [$chart_path]"
+            helm_template "$chart_path"
+        fi
+
+        for values in $chart_path/ci/*values.yaml; do
+            if [ -f "${values}" ]; then
+                echo "👣 Helm Template - [$values]"
+                helm_template "$chart_path" "$values"
+            fi
+        done
+
         echo "👣 Chart Version - [$chart_path] against [$target_branch]"
         check_version "$chart_path" "$target_branch"
 
@@ -129,6 +191,7 @@ function lint_chart(){
         echo ''
     } > "$curr_result_file"
     cat "$curr_result_file"
+    # $curr_result starts with 0, and it gets set to 1 only when a linting step fails
     echo $curr_result >> "$status_file"
 }
 export -f lint_chart

.github/workflows/charts-lint.yaml

@@ -75,6 +75,7 @@ jobs:
       - name: Test and Fix Pre-Commit Issues
         shell: bash
         # TODO: Only run pre-commit on changed files
+        # TODO: Commit fixes
         if: inputs.chartChangesDetected == 'true'
         run: |
           echo "Running pre-commit test-and-cleanup..."

.github/workflows/charts-release.yaml

@@ -184,6 +184,7 @@ jobs:
                 mkdir -p website/docs/charts/${train}/${chart} || echo "chart path already exists, continuing..."
                 yes | cp -rf charts/${train}/${chart}/docs/* website/docs/charts/${train}/${chart}/ 2>/dev/null || :
                 yes | cp -rf charts/${train}/${chart}/icon.png website/static/img/hotlink-ok/chart-icons/${chart}.png 2>/dev/null || :
+                yes | cp -rf charts/${train}/${chart}/screenshots/* website/static/img/hotlink-ok/chart-screenshots/${chart}/ 2>/dev/null || :
 
                 # Copy over kept documents
                 mv -f tmp/website/docs/charts/${train}/${chart}/CHANGELOG.md website/docs/charts/${train}/${chart}/CHANGELOG.md 2>/dev/null || :

.github/workflows/renovate.yml

@@ -12,7 +12,7 @@ jobs:
         with:
           token: ${{ secrets.BOT_TOKEN }}
       - name: Self-hosted Renovate
-        uses: renovatebot/github-action@5aa4bc2e097e751b391105d89ff88c0c80519c1a # v38.1.3
+        uses: renovatebot/github-action@2a87d1192eaa0cac92b6566233afedf68fd3472a # v38.1.8
         with:
           configurationFile: .github/renovate-config.js
           token: ${{ secrets.BOT_TOKEN }}

charts/dependency/clickhouse/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "23.4.2.11"
+appVersion: "23.5.3.24"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.1
+    version: 12.14.6
 deprecated: false
 description: ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP).
 home: https://truecharts.org/charts/dependency/clickhouse
@@ -22,7 +22,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/dependency/clickhouse
   - https://clickhouse.com/
 type: application
-version: 5.0.41
+version: 5.0.48
 annotations:
   truecharts.org/catagories: |
     - database

charts/dependency/clickhouse/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/clickhouse/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/clickhouse
   pullPolicy: IfNotPresent
-  tag: v23.4.2.11@sha256:c12f70ed3f189415fac14cb4e1cb861575817fe6d1e385dc88024341eca10cca
+  tag: v23.5.3.24@sha256:4b53287ef950c880e59faf83963047e486e19ba1b894e484066e6d00ebd2dd26
 
 workload:
   main:

charts/dependency/kube-state-metrics/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "2.9.2"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.1
+    version: 12.14.6
 deprecated: false
 description: kube-state-metrics is a simple service that listens to the Kubernetes API server and generates metrics about the state of the objects.
 home: https://truecharts.org/charts/dependency/kube-state-metrics
@@ -21,7 +21,7 @@ name: kube-state-metrics
 sources:
   - https://github.com/truecharts/charts/tree/master/charts/dependency/kube-state-metrics
 type: application
-version: 1.0.20
+version: 1.0.31
 annotations:
   truecharts.org/catagories: |
     - metrics

charts/dependency/kube-state-metrics/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/kube-state-metrics/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/kube-state-metrics
   pullPolicy: IfNotPresent
-  tag: v2.9.2@sha256:3ec0f0765cae3d8635edad876f3bca1315ea2d69c2ae5cbee9f46c881c85acf5
+  tag: v2.9.2@sha256:6756dd7716b500cd3a96879cd961a189f14d9de91b4cf4fa3b069d39390e146a
 
 service:
   main:

charts/dependency/mariadb/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "10.11.4"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.1
+    version: 12.14.6
 deprecated: false
 description: Fast, reliable, scalable, and easy to use open-source relational database system.
 home: https://truecharts.org/charts/dependency/mariadb
@@ -25,7 +25,7 @@ sources:
   - https://github.com/prometheus/mysqld_exporter
   - https://mariadb.org
 type: application
-version: 7.0.50
+version: 7.0.62
 annotations:
   truecharts.org/catagories: |
     - database

charts/dependency/mariadb/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/mariadb/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/mariadb
   pullPolicy: IfNotPresent
-  tag: v10.11.4@sha256:c36949f30cb56ed38498d794a0a4fb34d58dcf6c45aa9107f292ab9f1df1c54c
+  tag: v10.11.4@sha256:6241a50f28f2401cefb6c44fa6dcf71954c3494ed65e790b7fdc1c7b7980b6f1
 
 workload:
   main:

charts/dependency/memcached/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "1.6.20"
+appVersion: "1.6.21"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.1
+    version: 12.14.6
 deprecated: false
 description: Memcached is a memory-backed database caching solution
 home: https://truecharts.org/charts/dependency/memcached
@@ -23,7 +23,7 @@ sources:
   - https://github.com/bitnami/bitnami-docker-memcached
   - http://memcached.org/
 type: application
-version: 6.0.59
+version: 6.0.69
 annotations:
   truecharts.org/catagories: |
     - database

charts/dependency/memcached/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/memcached/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/memcached
   pullPolicy: IfNotPresent
-  tag: v1.6.20@sha256:ed57e787e5b280440220cd8246d87901dbfd436fa61cb63b640cfd4387e8a07c
+  tag: v1.6.21@sha256:a8eacfc98bb5169f1879c1c21b24a2dc3ca796c6040193063565f43501b6620f
 
 service:
   main:

charts/dependency/mongodb/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "6.0.6"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.1
+    version: 12.14.6
 deprecated: false
 description: Fast, reliable, scalable, and easy to use open-source no-sql database system.
 home: https://truecharts.org/charts/dependency/mongodb
@@ -23,7 +23,7 @@ sources:
   - https://github.com/bitnami/bitnami-docker-mongodb
   - https://www.mongodb.com
 type: application
-version: 6.0.48
+version: 6.0.59
 annotations:
   truecharts.org/catagories: |
     - database

charts/dependency/mongodb/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/mongodb/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/mongodb
   pullPolicy: IfNotPresent
-  tag: v6.0.6@sha256:757f91b38a37e3a33710d3c77015eae68762fd890cb675d84c9b86668790f462
+  tag: v6.0.6@sha256:0e81f3d05478356b43545dd71bae0f878cef555aa399ff8cc127c47383c23f30
 
 workload:
   main:

charts/dependency/node-exporter/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "1.6.0"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.1
+    version: 12.14.6
 deprecated: false
 description: Prometheus exporter for hardware and OS metrics exposed by UNIX kernels, with pluggable metric collectors.
 home: https://truecharts.org/charts/dependency/node-exporter
@@ -21,7 +21,7 @@ name: node-exporter
 sources:
   - https://github.com/truecharts/charts/tree/master/charts/dependency/node-exporter
 type: application
-version: 1.0.22
+version: 1.0.35
 annotations:
   truecharts.org/catagories: |
     - metrics

charts/dependency/node-exporter/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/node-exporter/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/node-exporter
   pullPolicy: IfNotPresent
-  tag: v1.6.0@sha256:c286e5dab7f852d1464a01122c3bbd7c48149ecdec188499aea579aef379238b
+  tag: v1.6.0@sha256:a8accc7b7c9a55ec4df15e5568627e24ed5c831a09f7d9762efcab7a7869667a
 
 service:
   main:
@@ -17,11 +17,12 @@ workload:
       containers:
         main:
           args:
-            - --path.procfs=/host/proc
-            - --path.sysfs=/host/sys
+            - --path.rootfs=/host
+            - --path.procfs=/hostproc
+            - --path.sysfs=/hostsys
             - --web.listen-address=0.0.0.0:{{ .Values.service.main.ports.main.port }}
-            - --collector.filesystem.ignored-mount-points="^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/.+|var/db/system/.+|mnt/[a-zA-Z0-9-_\\.]+/ix-applications/.+)($|/)"
-            - --collector.filesystem.ignored-fs-types="^(autofs|binfmt_misc|cgroup|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|mqueue|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|sysfs|tracefs)$"
+            - --collector.filesystem.mount-points-exclude="^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/.+|var/db/system/.+|mnt/[a-zA-Z0-9-_\\.]+/ix-applications/.+)($|/)"
+            - --collector.filesystem.fs-types-exclude="^(autofs|binfmt_misc|cgroup|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|mqueue|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|sysfs|tracefs)$"
             - --collector.netdev.device-exclude="^veth.*$"
             - --collector.netclass.ignored-devices="^veth.*$"
           probes:
@@ -44,18 +45,21 @@ podOptions:
 persistence:
   host:
     enabled: true
+    type: hostPath
     hostPath: /
     mountPath: /host
     readOnly: true
   proc:
     enabled: true
+    type: hostPath
     hostPath: /proc
-    mountPath: /host/proc
+    mountPath: /hostproc
     readOnly: true
   sys:
     enabled: true
+    type: hostPath
     hostPath: /sys
-    mountPath: /host/sys
+    mountPath: /hostsys
     readOnly: true
 
 metrics:

charts/dependency/redis/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "7.0.11"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.1
+    version: 12.14.6
 deprecated: false
 description: Open source, advanced key-value store.
 home: https://truecharts.org/charts/dependency/redis
@@ -23,7 +23,7 @@ sources:
   - https://github.com/bitnami/bitnami-docker-redis
   - http://redis.io/
 type: application
-version: 6.0.58
+version: 6.0.62
 annotations:
   truecharts.org/catagories: |
     - database

charts/dependency/redis/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/solr/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "9.2.1"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.1
+    version: 12.14.6
 deprecated: false
 description: Apache Solr
 home: https://truecharts.org/charts/dependency/solr
@@ -22,7 +22,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/dependency/solr
   - https://github.com/apache/solr
 type: application
-version: 4.0.48
+version: 4.0.60
 annotations:
   truecharts.org/catagories: |
     - search

charts/dependency/solr/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/solr/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/solr
   pullPolicy: IfNotPresent
-  tag: v9.2.1@sha256:04c6f6e9d7c3fcecf1a5c17ca6899223e5880370bd660c1321e11bf72d892bdd
+  tag: v9.2.1@sha256:1ba6b2e573a30a49337af2682a961a80f7c8b9143112619194cc8f33df9e01e7
 
 workload:
   main:

charts/enterprise/authelia/Chart.yaml

@@ -3,11 +3,11 @@ appVersion: "4.37.5"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.2
+    version: 12.14.6
   - condition: redis.enabled
     name: redis
     repository: https://deps.truecharts.org
-    version: 6.0.58
+    version: 6.0.62
 deprecated: false
 description: Authelia is a Single Sign-On Multi-Factor portal for web apps
 home: https://truecharts.org/charts/enterprise/authelia
@@ -35,7 +35,7 @@ sources:
   - https://github.com/authelia/chartrepo
   - https://github.com/authelia/authelia
 type: application
-version: 15.1.28
+version: 15.1.31
 annotations:
   truecharts.org/catagories: |
     - security

charts/enterprise/authelia/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/enterprise/authelia/docs/Setup-Guide.md

@@ -30,9 +30,8 @@ LLDAP is a `Stable` train chart and therefore isn't supported at the same level
 
 ### App Configuration
 
-Domain: `mydomain.com` <- Your domain without https://
-Default Redirection URL: `auth.mydomain.com`
-  - Can be anything, but we'll stick to auth.mydomain.com. As well, this will be the ingress URL for `Authelia`
+- Domain: `mydomain.com` <- Your domain without https://
+- Default Redirection URL: `https://auth.mydomain.com` <- Can be anything, but we'll stick to auth.mydomain.com. As well, this will be the ingress URL for `Authelia`
 
 ### LDAP Backend Configuration
 
@@ -97,6 +96,13 @@ Leave the default `one_factor` unless you've setup TOTP above. Then click `Add`
   - `Remote-Name`
   - `Remote-Email`
 
+### Adding the forwardauth to your Apps
+
+The last step is adding the `forwardauth` along with the standard `ingress` settings for your app, for more info on setting ingress see the [ClusterIssuer Guide](https://truecharts.org/charts/enterprise/clusterissuer/how-to). What changes versus a standard setup is the `Traefik Middlewares` section, where you must add your `forwardauth` to the section.
+
+- In this example we use the same name as above, or `auth`. Click `Add` to the `Traefik Middlewares` section, and enter your `forwardauth` name.
+
+![TraefikForwardAuthMiddleware](img/TraefikForwardAuthMiddleware.png)
 ### References
 
 The origin material for this guide is available on the [LLDAP Github](https://github.com/lldap/lldap). While further information on Authelia can be found on their [Github](https://github.com/authelia/authelia) and [website](https://www.authelia.com/).

charts/enterprise/authelia/docs/validation.md

@@ -0,0 +1,23 @@
+# Input Validation
+
+**`Default Redirection URL`**
+
+Accepts:
+
+- `https://`
+- DNS host
+- Characters (`0-9`, `a-z`, `A-Z`, `-`, `.`)
+
+Accepted formats are:
+
+- `https://dnshost`
+- `https://DNSHOST`
+- `https://DNS-HOST`
+- `https://dns-host`
+
+Regex used to match this: `^https?:\/\/(.*)`
+You can try live [here](https://regex101.com/r/zFt9zy/1)
+
+---
+
+_If you find a field that you think it needs validation, please open an issue on github_

charts/enterprise/authelia/questions.yaml

@@ -28,6 +28,7 @@ questions:
     schema:
       type: string
       default: ""
+      valid_chars: '^https?:\/\/(.*)'
   - variable: theme
     group: "App Configuration"
     label: "Theme"

charts/enterprise/authelia/templates/_configmap.tpl

@@ -32,41 +32,41 @@ enabled: true
 data:
   configuration.yaml: |
     ---
-    theme: {{ default "light" .Values.theme }}
+    theme: {{ .Values.theme | default "light" }}
     default_redirection_url: {{ default (printf "https://www.%s" .Values.domain) .Values.default_redirection_url }}
     ntp:
-      address:  {{ default "time.cloudflare.com:123" .Values.ntp.address }}
-      version: {{ default 4 .Values.ntp.version }}
-      max_desync: {{ default "3s" .Values.ntp.max_desync }}
-      disable_startup_check: {{ default false .Values.ntp.disable_startup_check }}
-      disable_failure: {{ default true .Values.ntp.disable_failure }}
+      address:  {{ .Values.ntp.address | default "time.cloudflare.com:123" }}
+      version: {{ .Values.ntp.version | default 4 }}
+      max_desync: {{ .Values.ntp.max_desync | default "3s" }}
+      disable_startup_check: {{ .Values.ntp.disable_startup_check | default false }}
+      disable_failure: {{ .Values.ntp.disable_failure |  default true }}
     server:
       host: 0.0.0.0
-      port: {{ default 9091 .Values.server.port }}
-      {{- if not (eq "" (default "" .Values.server.path)) }}
+      port: {{ .Values.server.port | default 9091 }}
+      {{- if ne "" (.Values.server.path | default "") }}
       path: {{ .Values.server.path }}
       {{- end }}
       buffers:
-        write: {{ default 4096 .Values.server.write_buffer_size }}
-        read: {{ default 4096 .Values.server.read_buffer_size }}
-      enable_pprof: {{ default false .Values.server.enable_pprof }}
-      enable_expvars: {{ default false .Values.server.enable_expvars }}
+        write: {{ .Values.server.write_buffer_size | default 4096 }}
+        read: {{ .Values.server.read_buffer_size | default 4096 }}
+      enable_pprof: {{ .Values.server.enable_pprof | default false }}
+      enable_expvars: {{ .Values.server.enable_expvars | default false }}
     log:
-      level: {{ default "info" .Values.log.level }}
-      format: {{ default "text" .Values.log.format }}
-      {{- if not (eq "" (default "" .Values.log.file_path)) }}
+      level: {{ .Values.log.level | default "info" }}
+      format: {{ .Values.log.format | default "text" }}
+      {{- if ne "" (.Values.log.file_path | default "") }}
       file_path: {{ .Values.log.file_path }}
       keep_stdout: true
       {{- end }}
     totp:
-      issuer: {{ default .Values.domain .Values.totp.issuer }}
-      period: {{ default 30 .Values.totp.period }}
-      skew: {{ default 1 .Values.totp.skew }}
+      issuer: {{ .Values.totp.issuer | default .Values.domain }}
+      period: {{ .Values.totp.period | default 30 }}
+      skew: {{ .Values.totp.skew | default 1 }}
     {{- if .Values.duo_api.enabled }}
     duo_api:
       hostname: {{ .Values.duo_api.hostname }}
       integration_key: {{ .Values.duo_api.integration_key }}
-    {{- end }}
+    {{- end -}}
     {{- with $auth := .Values.authentication_backend }}
     authentication_backend:
       password_reset:
@@ -74,95 +74,121 @@ data:
     {{- if $auth.file.enabled }}
       file:
         path: {{ $auth.file.path }}
-        password: {{ toYaml $auth.file.password | nindent 10 }}
-    {{- end }}
+        password:
+          {{- $p := $auth.file.password -}}
+          {{- if $p.algorithm }}
+          algorithm: {{ $p.algorithm }}
+          {{- end -}}
+          {{- if $p.iterations }}
+          iterations: {{ $p.iterations }}
+          {{- end -}}
+          {{- if $p.key_length }}
+          key_length: {{ $p.key_length }}
+          {{- end -}}
+          {{- if $p.salt_length }}
+          salt_length: {{ $p.salt_length }}
+          {{- end -}}
+          {{- if $p.memory }}
+          memory: {{ $p.memory }}
+          {{- end -}}
+          {{- if $p.parallelism }}
+          parallelism: {{ $p.parallelism }}
+          {{- end -}}
+    {{- end -}}
     {{- if $auth.ldap.enabled }}
       ldap:
-        implementation: {{ default "custom" $auth.ldap.implementation }}
+        implementation: {{ $auth.ldap.implementation | default "custom" }}
         url: {{ $auth.ldap.url }}
-        timeout: {{ default "5s" $auth.ldap.timeout }}
+        timeout: {{ $auth.ldap.timeout | default "5s" }}
         start_tls: {{ $auth.ldap.start_tls }}
         tls:
           {{- if hasKey $auth.ldap.tls "server_name" }}
-          server_name: {{ default $auth.ldap.host $auth.ldap.tls.server_name }}
+          server_name: {{ $auth.ldap.tls.server_name | default $auth.ldap.host }}
           {{- end }}
-          minimum_version: {{ default "TLS1.2" $auth.ldap.tls.minimum_version }}
-          skip_verify: {{ default false $auth.ldap.tls.skip_verify }}
+          minimum_version: {{ $auth.ldap.tls.minimum_version | default "TLS1.2" }}
+          skip_verify: {{ $auth.ldap.tls.skip_verify | default false }}
     {{- if $auth.ldap.base_dn }}
         base_dn: {{ $auth.ldap.base_dn }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.username_attribute }}
         username_attribute: {{ $auth.ldap.username_attribute }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.additional_users_dn }}
         additional_users_dn: {{ $auth.ldap.additional_users_dn }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.users_filter }}
         users_filter: {{ $auth.ldap.users_filter }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.additional_groups_dn }}
         additional_groups_dn: {{ $auth.ldap.additional_groups_dn }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.groups_filter }}
         groups_filter: {{ $auth.ldap.groups_filter }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.group_name_attribute }}
         group_name_attribute: {{ $auth.ldap.group_name_attribute }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.mail_attribute }}
         mail_attribute: {{ $auth.ldap.mail_attribute }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.display_name_attribute }}
         display_name_attribute: {{ $auth.ldap.display_name_attribute }}
     {{- end }}
         user: {{ $auth.ldap.user }}
-    {{- end }}
-    {{- end }}
+    {{- end -}}
+    {{- end -}}
     {{- with $session := .Values.session }}
     session:
-      name: {{ default "authelia_session" $session.name }}
+      name: {{ $session.name | default "authelia_session" }}
       domain: {{ required "A valid .Values.domain entry required!" $.Values.domain }}
-      same_site: {{ default "lax" $session.same_site }}
-      expiration: {{ default "1M" $session.expiration }}
-      inactivity: {{ default "5m" $session.inactivity }}
-      remember_me_duration: {{ default "1M" $session.remember_me_duration }}
+      same_site: {{ $session.same_site | default "lax" }}
+      expiration: {{ $session.expiration | default "1M" }}
+      inactivity: {{ $session.inactivity | default "5m" }}
+      remember_me_duration: {{ $session.remember_me_duration | default "1M" }}
     {{- end }}
       redis:
         host: {{ .Values.redis.creds.plain }}
       {{- with $redis := .Values.redisProvider }}
-        port: {{ default 6379 $redis.port }}
+        port: {{ $redis.port | default 6379 }}
         {{- if not (eq $redis.username "") }}
         username: {{ $redis.username }}
         {{- end }}
-        maximum_active_connections: {{ default 8 $redis.maximum_active_connections }}
-        minimum_idle_connections: {{ default 0 $redis.minimum_idle_connections }}
+        maximum_active_connections: {{ $redis.maximum_active_connections | default 8 }}
+        minimum_idle_connections: {{ $redis.minimum_idle_connections | default 0 }}
     {{- if $redis.tls.enabled }}
         tls:
           server_name: {{ $redis.tls.server_name }}
-          minimum_version: {{ default "TLS1.2" $redis.tls.minimum_version }}
+          minimum_version: {{ $redis.tls.minimum_version | default "TLS1.2" }}
           skip_verify: {{ $redis.tls.skip_verify }}
     {{- end }}
     {{- if $redis.high_availability.enabled }}
         high_availability:
           sentinel_name: {{ $redis.high_availability.sentinel_name }}
     {{- if $redis.high_availability.nodes }}
-          nodes: {{ toYaml $redis.high_availability.nodes | nindent 10 }}
+          nodes:
+          {{- range $node := $redis.high_availability.nodes }}
+          - host: {{ $node.host }}
+            port: {{ $node.port | default 26379 }}
+          {{- end -}}
     {{- end }}
           route_by_latency: {{ $redis.high_availability.route_by_latency }}
           route_randomly: {{ $redis.high_availability.route_randomly }}
       {{- end }}
     {{- end }}
-    regulation: {{ toYaml .Values.regulation | nindent 6 }}
+    regulation:
+      max_retries: {{ .Values.regulation.max_retries | default 3 }}
+      find_time: {{ .Values.regulation.find_time | default "1m" }}
+      ban_time: {{ .Values.regulation.ban_time | default "5m" }}
     storage:
       postgres:
         host: {{ $.Values.cnpg.main.creds.host }}
     {{- with $storage := .Values.storage }}
-        port: {{ default 5432 $storage.postgres.port }}
-        database: {{ default "authelia" $storage.postgres.database }}
-        username: {{ default "authelia" $storage.postgres.username }}
-        timeout: {{ default "5s" $storage.postgres.timeout }}
+        port: {{ $storage.postgres.port | default 5432 }}
+        database: {{ $storage.postgres.database | default "authelia" }}
+        username: {{ $storage.postgres.username | default "authelia" }}
+        timeout: {{ $storage.postgres.timeout | default "5s" }}
         ssl:
-          mode: {{ default "disable" $storage.postgres.sslmode }}
+          mode: {{ $storage.postgres.sslmode | default "disable" }}
     {{- end }}
     {{- with $notifier := .Values.notifier }}
     notifier:
@@ -174,8 +200,8 @@ data:
     {{- if $notifier.smtp.enabled }}
       smtp:
         host: {{ $notifier.smtp.host }}
-        port: {{ default 25 $notifier.smtp.port }}
-        timeout: {{ default "5s" $notifier.smtp.timeout }}
+        port: {{ $notifier.smtp.port | default 25 }}
+        timeout: {{ $notifier.smtp.timeout | default "5s" }}
         {{- with $notifier.smtp.username }}
         username: {{ . }}
         {{- end }}
@@ -186,50 +212,65 @@ data:
         disable_require_tls: {{ $notifier.smtp.disable_require_tls }}
         disable_html_emails: {{ $notifier.smtp.disable_html_emails }}
         tls:
-          server_name: {{ default $notifier.smtp.host $notifier.smtp.tls.server_name }}
-          minimum_version: {{ default "TLS1.2" $notifier.smtp.tls.minimum_version }}
-          skip_verify: {{ default false $notifier.smtp.tls.skip_verify }}
+          server_name: {{ $notifier.smtp.tls.server_name | default $notifier.smtp.host }}
+          minimum_version: {{ $notifier.smtp.tls.minimum_version | default "TLS1.2" }}
+          skip_verify: {{ $notifier.smtp.tls.skip_verify | default false }}
     {{- end }}
     {{- end }}
     {{- if .Values.identity_providers.oidc.enabled }}
     identity_providers:
       oidc:
-        access_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.access_token_lifespan }}
-        authorize_code_lifespan: {{ default "1m" .Values.identity_providers.oidc.authorize_code_lifespan }}
-        id_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.id_token_lifespan }}
-        refresh_token_lifespan: {{ default "90m" .Values.identity_providers.oidc.refresh_token_lifespan }}
-        enable_client_debug_messages: {{ default false .Values.identity_providers.oidc.enable_client_debug_messages }}
-        minimum_parameter_entropy: {{ default 8 .Values.identity_providers.oidc.minimum_parameter_entropy }}
-        {{- if gt (len .Values.identity_providers.oidc.clients) 0 }}
+        access_token_lifespan: {{ .Values.identity_providers.oidc.access_token_lifespan | default "1h" }}
+        authorize_code_lifespan: {{ .Values.identity_providers.oidc.authorize_code_lifespan | default "1m" }}
+        id_token_lifespan: {{ .Values.identity_providers.oidc.id_token_lifespan | default "1h" }}
+        refresh_token_lifespan: {{ .Values.identity_providers.oidc.refresh_token_lifespan | default "90m" }}
+        enable_client_debug_messages: {{ .Values.identity_providers.oidc.enable_client_debug_messages | default false }}
+        minimum_parameter_entropy: {{ .Values.identity_providers.oidc.minimum_parameter_entropy | default 8 }}
+        {{- if .Values.identity_providers.oidc.clients  }}
         clients:
     {{- range $client := .Values.identity_providers.oidc.clients }}
         - id: {{ $client.id }}
-          description: {{ default $client.id $client.description }}
-          secret: {{ default (randAlphaNum 128) $client.secret }}
+          description: {{ $client.description | default $client.id }}
+          secret: {{ $client.secret | default (randAlphaNum 128) }}
           {{- if $client.public }}
           public: {{ $client.public }}
           {{- end }}
-          authorization_policy: {{ default "two_factor" $client.authorization_policy }}
-          consent_mode: {{ default "auto" $client.consent_mode}}
+          authorization_policy: {{ $client.authorization_policy | default "two_factor" }}
+          consent_mode: {{ $client.consent_mode | default "auto" }}
           redirect_uris:
           {{- range $client.redirect_uris }}
           - {{ . }}
           {{- end }}
           {{- if $client.audience }}
-          audience: {{ toYaml $client.audience | nindent 10 }}
+          audience:
+            {{- range $client.audience }}
+            - {{ . }}
+            {{- end }}
+          {{- end }}
+          scopes:
+          {{- range ($client.scopes | default (list "openid" "profile" "email" "groups")) }}
+            - {{ . }}
+          {{- end }}
+          grant_types:
+          {{- range ($client.grant_types | default (list "refresh_token" "authorization_code")) }}
+            - {{ . }}
+          {{- end }}
+          response_types:
+          {{- range ($client.response_types | default (list "code")) }}
+            - {{ . }}
           {{- end }}
-          scopes: {{ toYaml (default (list "openid" "profile" "email" "groups") $client.scopes) | nindent 10 }}
-          grant_types: {{ toYaml (default (list "refresh_token" "authorization_code") $client.grant_types) | nindent 10 }}
-          response_types: {{ toYaml (default (list "code") $client.response_types) | nindent 10 }}
           {{- if $client.response_modes }}
-          response_modes: {{ toYaml $client.response_modes | nindent 10 }}
+          response_modes:
+          {{- range $client.response_modes }}
+            - {{ . }}
           {{- end }}
-          userinfo_signing_algorithm: {{ default "none" $client.userinfo_signing_algorithm }}
+          {{- end }}
+          userinfo_signing_algorithm: {{ $client.userinfo_signing_algorithm | default "none" }}
     {{- end }}
     {{- end }}
     {{- end }}
     access_control:
-    {{- if (eq (len .Values.access_control.rules) 0) }}
+    {{- if not .Values.access_control.rules }}
       {{- if (eq .Values.access_control.default_policy "bypass") }}
       default_policy: one_factor
       {{- else if (eq .Values.access_control.default_policy "deny") }}
@@ -240,15 +281,69 @@ data:
     {{- else }}
       default_policy: {{ .Values.access_control.default_policy }}
     {{- end }}
-    {{- if (eq (len .Values.access_control.networks) 0) }}
+
+    {{- if not .Values.access_control.networks }}
       networks: []
     {{- else }}
-      networks: {{ toYaml .Values.access_control.networks | nindent 6 }}
+      networks:
+    {{- range $net := .Values.access_control.networks }}
+      - name: {{ $net.name }}
+        networks:
+          {{- range $net.networks }}
+          - {{ . | squote }}
+          {{- end }}
     {{- end }}
-    {{- if (eq (len .Values.access_control.rules) 0) }}
+    {{- end }}
+
+    {{- if not .Values.access_control.rules }}
       rules: []
     {{- else }}
-      rules: {{ toYaml .Values.access_control.rules | nindent 6 }}
+      rules:
+    {{- range $rule := .Values.access_control.rules }}
+      {{- if $rule.domain }}
+      - domain:
+        {{- if kindIs "string" $rule.domain }}
+          - {{ $rule.domain | squote }}
+        {{- else -}}
+          {{- range $rule.domain }}
+          - {{ . | squote }}
+          {{- end }}
+        {{- end }}
+      {{- end -}}
+      {{- with $rule.policy }}
+        policy: {{ . }}
+      {{- end -}}
+      {{- if $rule.networks }}
+        networks:
+        {{- if kindIs "string" $rule.networks }}
+          - {{ $rule.networks | squote }}
+        {{- else -}}
+          {{- range $rule.networks }}
+            - {{ . | squote }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+      {{- if $rule.subject }}
+        subject:
+        {{- if kindIs "string" $rule.subject }}
+          - {{ $rule.subject | squote }}
+        {{- else -}}
+          {{- range $rule.subject }}
+            - {{ . | squote }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+      {{- if $rule.resources }}
+        resources:
+        {{- if kindIs "string" $rule.resources }}
+          - {{ $rule.resources | squote }}
+        {{- else -}}
+          {{- range $rule.resources }}
+            - {{ . | squote }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
     {{- end }}
     ...
 {{- end -}}

charts/enterprise/blocky/Chart.yaml

@@ -3,11 +3,11 @@ appVersion: "0.21.0"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.2
+    version: 12.14.6
   - condition: redis.enabled
     name: redis
     repository: https://deps.truecharts.org
-    version: 6.0.58
+    version: 6.0.62
 description: Blocky is a DNS proxy, DNS enhancer and ad-blocker for the local network written in Go
 home: https://truecharts.org/charts/enterprise/blocky
 icon: https://truecharts.org/img/hotlink-ok/chart-icons/blocky.png
@@ -25,7 +25,7 @@ sources:
   - https://0xerr0r.github.io/blocky/
   - https://github.com/0xERR0R/blocky
   - https://github.com/Mozart409/blocky-frontend
-version: 5.0.42
+version: 5.0.44
 annotations:
   truecharts.org/catagories: |
     - network

charts/enterprise/blocky/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/enterprise/blocky/docs/setup-guide.md

@@ -8,64 +8,67 @@ Blocky has multiple DNS entries configured by default these can be overridden to
 
 Blocky supports 3 methods for upstream DNS.
 
-UDP - Basic DNS  
-DoT - DNS over TLS  
-DoH - DNS over HTTPS  
+- UDP - Basic DNS
+- DoT - DNS over TLS
+- DoH - DNS over HTTPS
 
 While UDP provides no security for DNS both DoT and DoH will encrypt DNS request. DoH has the added benefit of privacy since DNS traffic will appear as HTTPS traffic.
 
 ### UDP DNS Setup
 
-Google DNS: `8.8.8.8` `8.8.4.4`  
-Cloudflare DNS: `1.1.1.1` `1.0.0.1`  
+- Google DNS: `8.8.8.8` `8.8.4.4`
+- Cloudflare DNS: `1.1.1.1` `1.0.0.1`
 
 ![blocky-udp-upstream-google](./img/blocky-udp-upstream-google.png)
 
 ### DoT DNS Setup
 
-Google DNS ([Bootstrap DNS Required](#bootstrap-dns)): `tcp-tls:dns.google:853`  
-Cloudflare DNS: `tcp-tls:1.1.1.1:853` `tcp-tls:1.0.0.1:853`  
+- Google DNS ([Bootstrap DNS Required](#bootstrap-dns)): `tcp-tls:dns.google:853`
+- Cloudflare DNS: `tcp-tls:1.1.1.1:853` `tcp-tls:1.0.0.1:853`
 
 ![blocky-dot-upstream-google](./img/blocky-dot-upstream-google.png)
 
 ### DoH Upstream
 
-Google DNS ([Bootstrap DNS Required](#bootstrap-dns)): `https://dns.google/dns-query`  
-Cloudflare DNS: `https://1.1.1.1/dns-query` `https://1.0.0.1/dns-query`  
+- Google DNS ([Bootstrap DNS Required](#bootstrap-dns)): `https://dns.google/dns-query`
+- Cloudflare DNS: `https://1.1.1.1/dns-query` `https://1.0.0.1/dns-query`
 
 ![blocky-doh-upstream-google](./img/blocky-doh-upstream-google.png)
 
 ## Bootstrap DNS
 
-For DNS providers that do not use an IP address for DoT or DoH a bootstrap DNS provider is needed to resolve the DoT or DoH address. This provider can be any UDP upstream DNS. In the below example I am using Google DNS.
+For DNS providers that do not use an IP address for DoT or DoH a bootstrap DNS provider
+ is needed to resolve the DoT or DoH address. This provider can be any UDP upstream DNS.
+ In the below example I am using Google DNS.
 
 ![blocky-bootstrap-google](./img/blocky-bootstrap-google.png)
 
 ## DNS Blacklists
 
-DNS Blacklists are used to prevent DNS resolution of advertisement, malware, trackers and adult sites domains. This is completed with public maintained blocklists. A good source for these is [firebog.net](https://firebog.net).
+DNS Blacklists are used to prevent DNS resolution of advertisement, malware, trackers
+and adult sites domains. This is completed with public maintained blocklists.
+A good source for these is [firebog.net](https://firebog.net).
 
 :::warning Warning
 
-While publicly maintained blocklists usually do a good job of allowing legitimate traffic they can sometimes be too broad and catch traffic that you wish to allow. You may need to disable certain blocklists if you find legitimate traffic being blocked.
+While publicly maintained blocklists usually do a good job of allowing legitimate traffic they
+can sometimes be too broad and catch traffic that you wish to allow. You may need to disable
+certain blocklists if you find legitimate traffic being blocked.
 
 :::
 
 1. Pick a Group Name for your blocklists.
-
 2. Add List entries for each blocklist by URL.
-
-![blocky-blacklist](./img/blocky-blacklist.png)
-
+  ![blocky-blacklist](./img/blocky-blacklist.png)
 3. Add a Clients Group Block and set Client Group Name to `default`
-
 4. Under Groups Entry enter the Group name you used above.
-
-![blocky-blacklist-group](./img/blocky-blacklist-group.png)
+  ![blocky-blacklist-group](./img/blocky-blacklist-group.png)
 
 ## k8s-Gateway Configuration
 
-k8s-Gateway will automatically provide split DNS for your local domain. This will allow you to resolve all ingress configured subdomains locally. All that is required for setup is to add your root domain in the Domain name block.
+k8s-Gateway will automatically provide split DNS for your local domain. This will allow
+you to resolve all ingress configured subdomains locally. All that is required for setup
+is to add your root domain in the Domain name block.
 
 ![blocky-k8s-gateway](./img/blocky-k8s-gateway.png)
 

charts/enterprise/blocky/values.yaml

@@ -325,7 +325,7 @@ metrics:
   main:
     # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
     # @default -- See values.yaml
-    enabled: true
+    enabled: false
     type: "servicemonitor"
     endpoints:
       - port: main

charts/enterprise/clusterissuer/Chart.yaml

@@ -10,7 +10,7 @@ keywords:
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.2
+    version: 12.14.6
 kubeVersion: ">=1.16.0-0"
 maintainers:
   - email: info@truecharts.org
@@ -21,7 +21,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/enterprise/clusterissuer
   - https://cert-manager.io/
 type: application
-version: 1.0.6
+version: 1.0.10
 annotations:
   truecharts.org/catagories: |
     - core

charts/enterprise/clusterissuer/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/enterprise/clusterissuer/docs/how-to.md

@@ -4,26 +4,17 @@ This guide will walk you through setting up `clusterissuer`, certificate managem
 
 ## Prerequisites
 
-Ensure you have the `enterprise` train enabled for `TrueCharts` as discussed [here](https://truecharts.org/manual/SCALE/guides/getting-started/#adding-truecharts).
+- Ensure you have the `enterprise` train enabled for `TrueCharts` as discussed [here](https://truecharts.org/manual/SCALE/guides/getting-started/#adding-truecharts).
+- Traefik is installed from enterprise train
 
-Ensure you have traefik installed, required for Ingress.
+## Set Scale Nameservers
 
-Search for clusterissuer in the `Apps` menu | `Available Applications` tab and click **Install**.
+It is important to configure Scale with reliable nameserver to avoid issues handling DNS-01 challenges. Under Network -> Global Configuration-> Nameservers, we recommend setting 1.1.1.1, 9.9.9.9 or 8.8.8.8.
 
-## Cloudflare DNS-Provider
+![clusterissuer scale nameservers](img/scale-network-nameserver.png)
 
-You can setup multiple domains with a single `clusterissuer` app, all you have to do is either add the global API key (**not recommended**) or `Add` multiple `ACME Issuer` entries for each domain and create an API token for each at [Cloudflare API Tokens](https://dash.cloudflare.com/profile/api-tokens).
 
-- Give the certificate a name (eg domain or "maincert", etc).
-- Select the correct provider, for example `Cloudflare`.
-- Set **Server** to **Letsencrypt-Production**.
-- Set Email to the account email.
-- Optionally set Cloudflare API key (**not recommended**)
-- Set the Cloudflare API Token to the one created earlier.
-
-![clusterissuer edit dialog](img/clusterissuer1.png)
-
-## clusterissuer App
+## Install clusterissuer App
 
 :::note
 
@@ -33,7 +24,47 @@ It is by design that the app does not run, there are no events, no logs and no s
 
 ![clusterissuer app card](img/clusterissuer2.png)
 
-## How to Add Ingress to Apps with clusterissuer
+## Configure ACME Issuer
+
+You can setup multiple domains and/or DNS providers with a single `clusterissuer` app.
+
+### Cloudflare DNS Provider
+
+#### Create a Cloudflare API token
+
+Login to Cloudflare dashboard and go to the [Cloudflare API Tokens](https://dash.cloudflare.com/profile/api-tokens) page. Select Edit Zone DNS template.
+
+![clusterissuer app card](img/cf-apitokens-template.png)
+
+The recommended  `API Token` permissions are below:
+![clusterissuer app card](img/cf-apitokens-perms.png)
+
+#### Cloudflare ACME Issuer Settings
+
+- **Name**: Name of the issuer entry; such as "cert" or "cloudflareprod". This name will be used later in the app ingress configuration
+- **Type of DNS Provider**: `Cloudflare`
+- **Server**: `Letsencrypt-Production`
+- **Email**: The email address you register with Let's Encrypt for renewal/expiration notices
+- **Cloudflare API key**: Leave blank since API token will be used
+- **Cloudflare API Token**: Populate with token created from above.
+
+![clusterissuer edit dialog](img/clusterissuer-appconfig.png)
+
+More detail can be found on the upstream [Cert-Manager](https://cert-manager.io/) documentaition for [Cloudflare](https://cert-manager.io/docs/configuration/acme/dns01/cloudflare/).
+
+### Route 53 DNS Provider
+
+To be completed
+
+### Akamai DNS Provider
+
+To be completed
+
+### Digital Ocean DNS Provider
+
+To be completed
+
+## Configure Ingress using clusterissuer
 
 Here's an example on how to add ingress to an app with clusterissuer for a single domain only.
 
@@ -45,9 +76,9 @@ Do **NOT** use this combined with the `TLS-Settings`.
 
 :::
 
-![how to add ingress using clusterissuer ](img/clusterissuer3.png)
+![configure ingress using clusterissuer ](img/clusterissuer-ingressconfig.png)
 
-If you want to support multiple domains, use the `TLS-Settings` option to create each one, basically an extra step each time.
+If you want to support multiple domains on a single app, under `Show Advanced Settings` checkbox, use the `TLS-Settings` option to create each one with the Add button.
 
 ## Verifying clusterissuer is working
 
@@ -56,4 +87,4 @@ Once installed using the Ingress settings above, you can see the `Application Ev
 ![clusterissuer4](img/clusterissuer4.png)
 ![clusterissuer5](img/clusterissuer5.png)
 
-All is automated by `clusterissuer`
+Renewals are handled automatically by `clusterissuer`.

charts/enterprise/clusterissuer/questions.yaml

@@ -52,7 +52,6 @@ questions:
                       description: "Server for ACME, for example: letsencrypt"
                       schema:
                         type: string
-                        show_if: [["type", "!=", "HTTP01"]]
                         default: 'Letsencrypt-Production'
                         enum:
                           - value: 'https://acme-v02.api.letsencrypt.org/directory'
@@ -78,7 +77,6 @@ questions:
                       schema:
                         type: string
                         required: true
-                        show_if: [["type", "!=", "HTTP01"]]
                         default: "something@example.com"
                     - variable: cfapikey
                       label: CloudFlare API key

charts/enterprise/clusterissuer/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: tccr.io/truecharts/scratch
-  tag: latest@sha256:9dd0f68d32ace452a3a75273bd8e3a074d0a14e4d38683389c73887432832fc3
+  tag: latest@sha256:60efd806894fa4959708abf5ff7386bc67ffc7ca0d2e76a4fc5212591f2b37e3
   pullPolicy: IfNotPresent
 manifestManager:
   enabled: true

charts/enterprise/grafana/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "9.5.3"
+appVersion: "9.5.5"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.2
+    version: 12.14.6
 deprecated: false
 description: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, Elasticsearch, OpenTSDB, Prometheus and InfluxDB.
 home: https://truecharts.org/charts/enterprise/grafana
@@ -24,7 +24,7 @@ sources:
   - https://github.com/bitnami/bitnami-docker-grafana
   - https://grafana.com/
 type: application
-version: 7.0.50
+version: 7.0.57
 annotations:
   truecharts.org/catagories: |
     - metrics

charts/enterprise/grafana/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/enterprise/grafana/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/grafana
   pullPolicy: IfNotPresent
-  tag: v9.5.3@sha256:3f22fc64031f0a9e432ef397f8dd94173fd09c96777c5ba54fbe15ddce19e318
+  tag: v9.5.5@sha256:ff0ba5eecd7ead218a1c9769d9f318873c92a9daa7edbeead429f9ad581ee6d3
 manifestManager:
   enabled: true
 securityContext:

charts/enterprise/metallb-config/Chart.yaml

@@ -10,7 +10,7 @@ keywords:
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.2
+    version: 12.14.6
 kubeVersion: ">=1.16.0-0"
 maintainers:
   - email: info@truecharts.org
@@ -22,7 +22,7 @@ sources:
   - https://github.com/metallb/metallb
   - https://metallb.universe.tf
 type: application
-version: 1.1.8
+version: 1.1.11
 annotations:
   truecharts.org/catagories: |
     - core

charts/enterprise/metallb-config/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/enterprise/metallb-config/docs/setup-guide.md

@@ -20,7 +20,10 @@ With MetalLB installed, apps will not be reachable using the integrated loadbala
 
 Install `metallb` from `operators` train first. There is no config, so just hit save.
 
-If you previously had `metallb` installed and are attempting to upgrade, follow the steps specified below in [Migrating an existing MetalLB config to operator-based version](#migrating-an-existing-metallb-config-to-operator-version)
+If you encounter an error upon install, run the following command as root from system settings -> shell and attempt the install again:
+```k3s kubectl delete  --grace-period 30 --v=4 -k https://github.com/truecharts/manifests/delete```
+
+If you previously had `metallb` installed and encounter an error, delete the old version, then run the above command before proceeding to install the `metallb` operator.
 
 ## 2. Set Address Pool & L2 Advertisement in MetalLB-Config
 
@@ -87,9 +90,3 @@ Known Issue: On the SCALE Installed Applications page, the **Open** buttons on e
 :::
 
 For details on other configuration options, please reference the [MetaLB documentation](https://metallb.universe.tf/configuration/)
-
-## Migrating an existing MetalLB config to operator version
-
-- remove the old `metallb` chart coming from the `enterprise` train
-- run this in a **root** shell: `k3s kubectl delete  --grace-period 30 --v=4 -k https://github.com/truecharts/manifests/delete`
-- Proceed with Steps 1 & 2 in the setup guide above

charts/enterprise/metallb-config/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: tccr.io/truecharts/scratch
-  tag: latest@sha256:9dd0f68d32ace452a3a75273bd8e3a074d0a14e4d38683389c73887432832fc3
+  tag: latest@sha256:60efd806894fa4959708abf5ff7386bc67ffc7ca0d2e76a4fc5212591f2b37e3
   pullPolicy: IfNotPresent
 manifestManager:
   enabled: false

charts/enterprise/prometheus/Chart.yaml

@@ -3,15 +3,15 @@ appVersion: "2.44.0"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.2
+    version: 12.14.6
   - condition: exporters.enabled,exporters.node-exporter.enabled
     name: node-exporter
     repository: https://deps.truecharts.org
-    version: 1.0.22
+    version: 1.0.34
   - condition: exporters.enabled,exporters.kube-state-metrics.enabled
     name: kube-state-metrics
     repository: https://deps.truecharts.org
-    version: 1.0.20
+    version: 1.0.31
 deprecated: false
 description: kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
 icon: https://truecharts.org/img/hotlink-ok/chart-icons/prometheus.png
@@ -29,7 +29,7 @@ sources:
   - https://github.com/prometheus-community/helm-charts
   - https://github.com/prometheus-operator/kube-prometheus
 type: application
-version: 9.0.21
+version: 9.0.27
 annotations:
   truecharts.org/catagories: |
     - metrics

charts/enterprise/prometheus/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/enterprise/prometheus/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: tccr.io/truecharts/prometheus
-  tag: v2.44.0@sha256:e35ebfcbc50d3655030eb4162ab1a33438a5d2dbadac2dcb4bcc0d794a8dadf7
+  tag: v2.44.0@sha256:0e799757a47bdc11f8a894e59c96a23c4afefa4db11e005bc37061cf4e3d57a3
 
 thanosImage:
   repository: tccr.io/truecharts/thanos

charts/enterprise/traefik/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "2.10.1"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.2
+    version: 12.14.6
 deprecated: false
 description: Traefik is a flexible reverse proxy and Ingress Provider.
 home: https://truecharts.org/charts/enterprise/traefik
@@ -23,7 +23,7 @@ sources:
   - https://github.com/traefik/traefik-helm-chart
   - https://traefik.io/
 type: application
-version: 18.0.15
+version: 18.0.18
 annotations:
   truecharts.org/catagories: |
     - network

charts/enterprise/traefik/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/enterprise/traefik/docs/how-to.md

@@ -1,7 +1,3 @@
----
-sidebar_position: 1
----
-
 # Installing Traefik
 
 Within TrueCharts, our aim is to make it as easy as possible to secure your Apps.

charts/enterprise/traefik/questions.yaml

@@ -293,6 +293,7 @@ questions:
                           - variable: tls
                             label: "websecure Entrypoints Configuration"
                             schema:
+                              additional_attrs: true
                               type: dict
                               hidden: true
                               attrs:

charts/enterprise/traefik/templates/_portalhook.tpl

@@ -1,12 +1,15 @@
 {{/* Define the portalHook */}}
 {{- define "traefik.portalhook" -}}
-{{- if .Values.portalhook.enabled }}
+{{- if .Values.portalhook.enabled -}}
+  {{- $name := "portalhook" -}}
+  {{- if $.Values.ingressClass.enabled -}}
+    {{- $name = printf "portalhook-%v" .Release.Name -}}
+  {{- end }}
 ---
-
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ ternary "portalhook" (printf "portalhook-%v" .Release.Name ) $.Values.ingressClass.enabled }}
+  name: {{ $name }}
   namespace: tc-system
 data:
   {{- $ports := dict }}

charts/enterprise/traefik/values.yaml

@@ -129,7 +129,7 @@ logs:
 
 metrics:
   main:
-    enabled: true
+    enabled: false
     type: servicemonitor
     endpoints:
       - port: metrics

charts/enterprise/vaultwarden/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "1.28.1"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.2
+    version: 12.14.6
 deprecated: false
 description: Unofficial Bitwarden compatible server written in Rust
 home: https://truecharts.org/charts/enterprise/vaultwarden
@@ -25,7 +25,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/enterprise/vaultwarden
   - https://github.com/dani-garcia/vaultwarden
 type: application
-version: 20.0.33
+version: 20.0.34
 annotations:
   truecharts.org/catagories: |
     - security

charts/enterprise/vaultwarden/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/acestream/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/adguardhome-sync/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/alienswarm-reactivedrop/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/alienswarm/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/americasarmy-pg/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/android-8-0/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/androiddebugbridge/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/anki-sync-server/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/anope/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/apache-webdav/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/apprise-api/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/appsmith/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/archiveteam-warrior/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/arksurvivalevolved/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/arma3/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/arma3exilemod/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/artifactory-oss/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/assettocorsa/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/aurora-files/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/authentik/Chart.yaml

@@ -1,14 +1,14 @@
 apiVersion: v2
-appVersion: "2023.4.1"
+appVersion: "2023.5.3"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.14.2
+    version: 12.14.6
   - condition: redis.enabled
     name: redis
     repository: https://deps.truecharts.org
-    version: 6.0.58
-description: authentik is an open-source Identity Provider focused on flexibility and versatility.
+    version: 6.0.62
+description: Authentik is an open-source Identity Provider focused on flexibility and versatility.
 home: https://truecharts.org/charts/incubator/authentik
 icon: https://truecharts.org/img/hotlink-ok/chart-icons/authentik.png
 keywords:
@@ -23,9 +23,8 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/authentik
   - https://github.com/goauthentik/authentik
   - https://goauthentik.io/docs/
-version: 12.0.2
+version: 13.0.5
 annotations:
   truecharts.org/catagories: |
     - authentication
   truecharts.org/SCALE-support: "true"
-  truecharts.org/grade: U

charts/incubator/authentik/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/incubator/authentik/ci/outposts-values.yaml

@@ -0,0 +1,18 @@
+authentik:
+  credentials:
+    bootstrapToken: some_super_secret_token
+  outposts:
+    disableEmbeddedOutpost: true
+    proxy:
+      enabled: true
+      token: some_super_secret_token
+    radius:
+      # Can't enable it before creating a
+      # provider in the GUI
+      enabled: false
+      token: some_super_secret_token
+    ldap:
+      # Can't enable it before creating a
+      # provider in the GUI
+      enabled: false
+      token: some_super_secret_token

charts/incubator/authentik/docs/how_to.md

@@ -10,7 +10,7 @@ This can be applied to other systems but this specific guide has been tested and
 
 ## Prerequisites
 
-This guide assumes you're using Traefik as your Reverse Proxy / Ingress provider and have through the configuration listen in our [Quick-Start guides](https://truecharts.org/docs/manual/SCALE%20Apps/adding-letsencrypt) and/or the [Traefik documents](https://truecharts.org/docs/charts/stable/traefik/how-to/). Please ensure that you can access your domain properly with Ingress before attempting any further steps.
+This guide assumes you're using Traefik as your Reverse Proxy / Ingress provider and have through the configuration listen in our [Quick-Start guides](https://truecharts.org/docs/manual/SCALE%20Apps/adding-letsencrypt) and/or the [Traefik documents](https://truecharts.org/charts/enterprise/traefik/how-to/). Please ensure that you can access your domain properly with Ingress before attempting any further steps.
 
 ## Authentik Chart Setup
 
@@ -26,6 +26,12 @@ All of the defaults are fine to start off, you must choose a password, however `
 
 **Ingress Example**
 
+:::note
+
+Note that the `*.mydomain.com` host config is only needed if you want to use `Forward auth (single application)` in `authentik`.
+
+:::
+
 ![Ingress-Auth](img/Ingress-Auth.png)
 
 ## Authentik GUI Setup
@@ -54,6 +60,14 @@ Default username is `akadmin` and password is whatever you entered in the initia
 
 ![New-Provider-2](img/New-Provider-2.png)
 
+- If you want to use subdomain-level access control, select `Forward auth (single application)` and enter the URL you have chosen for your apps' ingress.
+- The example uses `https://application.mydomain.com/`, make sure your app is reachable and uses a valid certificate beforehand. 
+- You can set HTTP-Basic Authentication Attributes under `Authentication settings` for your service here. 
+  - Don't use a `basicAuth` middleware in the apps' ingress settings. Only use this if your app has build in basic auth support. 
+  - Add the attributes in a `authentik` group, then assign any user you want to be able to access the application to this group.
+
+![New-Provider-3](image.png)
+
 - Once done use that new `Provider` you created
 
 ![Create-Applications-3](img/Create-Applications-3.png)
@@ -86,12 +100,19 @@ Once `authentik` is setup and running, you must create a `forwardAuth` inside `T
 
 The main thing about this screen is to use the internal DNS name for simplicity
 
+- I have successfully used an `authentik` instance on a difference host together with `external-service` using this URL: 
+  - `https://authentik-external-service.ix-authentik.svc.cluster.local:9443/outpost.goauthentik.io/auth/traefik`
+- Use `heavyscript dns -a` to get the internal DNS name for your `authentik` instance in that case. 
+- I suggest using the `https` endpoint and port because it is what worked for me.
+
 :::
 
 ```
 http://authentik-http.ix-authentik.svc.cluster.local:10230/outpost.goauthentik.io/auth/traefik
 ```
 
+**Double-check the DNS name and port.**
+
 There's also a list of `authResponseHeaders` inside `authentik` listed for use with `Traefik`, so in case you need them here they are.
 
 - `X-authentik-username`
@@ -106,6 +127,8 @@ There's also a list of `authResponseHeaders` inside `authentik` listed for use w
 - `X-authentik-meta-app`
 - `X-authentik-meta-version`
 
+Add the `authorization` header to pass the HTTP-Basic headers from `authentik` to you application.
+
 ### Add Traefik forwardAuth to Charts
 
 - Once that is done all you need to add the `middleware` to your Charts under the `Ingress section`, as in my case it's called `auth`.

charts/incubator/authentik/docs/installation_notes.md

@@ -6,23 +6,5 @@ Default username: `akadmin`
 
 ## Outposts
 
-Enable each outpost by simple setting `enabled` to `true`.
-Scale users, just have to check the checkbox
-
-> You have to create an outpost in the GUI first.
-> And afterwards enable it.
-> Applications > Outposts
-
-### Host
-
-`host` should not need to be overridden. Defaults to `https://localhost:9443`
-
-### Host Browser
-
-`host_browser` by default is set to the first ingress host you set
-
-### Token
-
-`token` is only needed if you accidentally deleted the bootstrap token within the UI.
-
-> You can get one from Applications > Outposts > View Deployment Info
+You need to create an outpost in the GUI first.
+Generate a token and then enable it.

charts/incubator/authentik/questions.yaml

@@ -6,7 +6,6 @@ questions:
 # Include{global}
 # Include{workload}
 # Include{workloadDeployment}
-
 # Include{replicas1}
 # Include{podSpec}
 # Include{containerMain}
@@ -25,13 +24,37 @@ questions:
             additional_attrs: true
             type: dict
             attrs:
+              - variable: email
+                label: Email
+                description: |
+                  Set the default email address for the akadmin user.</br>
+                  Only read on initial install, changing this will have no effect.
+                schema:
+                  type: string
+                  required: true
+                  immutable: true
+                  default: ""
               - variable: password
-                label: Password (Initial install only)
-                description: Password for <akadmin> user. Can be used for any flow executor
+                label: Password
+                description: |
+                  Set the default password for the akadmin user.</br>
+                  Only read on initial install, changing this will have no effect.
                 schema:
                   type: string
                   private: true
                   required: true
+                  immutable: true
+                  default: ""
+              - variable: bootstrapToken
+                label: (Optional) Bootstrap Token
+                description: |
+                  Set the bootstrap token for the authentik server.</br>
+                  Only read on initial install, changing this will have no effect. </br>
+                  Only set this token if you plan to use the API right after installation.
+                schema:
+                  type: string
+                  private: true
+                  immutable: true
                   default: ""
         - variable: general
           label: General
@@ -39,42 +62,49 @@ questions:
             additional_attrs: true
             type: dict
             attrs:
-              - variable: disable_update_check
+              - variable: disableUpdateCheck
                 label: Disable Update Check
                 description: Disable the inbuilt update-checker
                 schema:
                   type: boolean
                   default: false
-              - variable: disable_startup_analytics
+              - variable: disableStartupAnalytics
                 label: Disable Startup Analytics
                 description: Disable startup analytics
                 schema:
                   type: boolean
                   default: true
-              - variable: allow_user_name_change
-                label: Allow User Name Change
+              - variable: allowUserChangeName
+                label: Allow User Change Name
                 description: Enable the ability for users to change their Name
                 schema:
                   type: boolean
                   default: true
-              - variable: allow_user_mail_change
-                label: Allow User Mail Change
+              - variable: allowUserChangeEmail
+                label: Allow User Change Mail
                 description: Enable the ability for users to change their Email address
                 schema:
                   type: boolean
                   default: true
-              - variable: allow_user_username_change
-                label: Allow User Username Change
+              - variable: allowUserChangeUsername
+                label: Allow User Change Username
                 description: Enable the ability for users to change their Usernames
                 schema:
                   type: boolean
                   default: true
-              - variable: gdpr_compliance
+              - variable: gdprCompliance
                 label: GDPR Compliance
                 description: When enabled, all the events caused by a user will be deleted upon the user's deletion
                 schema:
                   type: boolean
                   default: true
+              - variable: tokenLength
+                label: Token Length
+                description: Configure the length of generated tokens
+                schema:
+                  type: int
+                  min: 60
+                  default: 128
               - variable: impersonation
                 label: Impersonation
                 description: Globally enable / disable impersonation
@@ -85,22 +115,49 @@ questions:
                 label: Avatars
                 description: Configure how authentik should show avatars for users
                 schema:
-                  type: string
-                  default: gravatar,initials
-              - variable: token_length
-                label: Token Length
-                description: Configure the length of generated tokens
-                schema:
-                  type: int
-                  default: 128
-              - variable: footer_links
+                  type: list
+                  default:
+                    - gravatar
+                    - initials
+                  items:
+                    - variable: avatar
+                      label: Avatar
+                      description: Avatar type
+                      schema:
+                        type: string
+                        default: ""
+                        required: true
+              - variable: footerLinks
                 label: Footer Links
                 description: This option configures the footer links on the flow executor pages
                 schema:
-                  type: string
-                  default: ""
-        - variable: mail
-          label: e-Mail
+                  type: list
+                  default:
+                    - name: Authentik
+                      href: https://goauthentik.io
+                  items:
+                    - variable: footerLink
+                      label: Footer Link
+                      schema:
+                        additional_attrs: true
+                        type: dict
+                        attrs:
+                          - variable: name
+                            label: Name
+                            description: Name of the link
+                            schema:
+                              type: string
+                              default: ""
+                              required: true
+                          - variable: href
+                            label: Href
+                            description: URL of the link
+                            schema:
+                              type: string
+                              default: ""
+                              required: true
+        - variable: email
+          label: Email
           schema:
             additional_attrs: true
             type: dict
@@ -116,16 +173,29 @@ questions:
                 description: Sets port of mail server
                 schema:
                   type: int
-                  default: 25
-              - variable: tls
+                  default: 587
+              - variable: username
+                label: Username
+                description: Sets username of mail server
+                schema:
+                  type: string
+                  default: ""
+              - variable: password
+                label: Password
+                description: Sets password of mail server
+                schema:
+                  type: string
+                  private: true
+                  default: ""
+              - variable: useTLS
                 label: Use TLS for authentication
-                description: Sets tls for mail server authentication
+                description: Sets TLS for mail server authentication
                 schema:
                   type: boolean
-                  default: false
-              - variable: ssl
+                  default: true
+              - variable: useSSL
                 label: Use SSL for authentication
-                description: Sets ssl for mail server authentication
+                description: Sets SSL for mail server authentication
                 schema:
                   type: boolean
                   default: false
@@ -135,51 +205,32 @@ questions:
                 schema:
                   type: int
                   default: 10
-              - variable: user
-                label: Username
-                description: Sets username of mail server
-                schema:
-                  type: string
-                  default: ""
-              - variable: pass
-                label: Password
-                description: Sets password of mail server
-                schema:
-                  type: string
-                  private: true
-                  default: ""
               - variable: from
                 label: From Address
                 description: Email address authentik will send from
                 schema:
                   type: string
                   default: ""
-        - variable: error_reporting
-          label: Error Reporting
+        - variable: ldap
+          label: LDAP
           schema:
             additional_attrs: true
             type: dict
             attrs:
-              - variable: enabled
-                label: Enable Reporting
-                description: Enables error reporting
+              - variable: tls_ciphers
+                label: TLS Ciphers
+                description: |
+                  Allows configuration of TLS Ciphers for LDAP connections used by LDAP sources.</br>
+                  Setting applies to all sources
                 schema:
-                  type: boolean
-                  default: false
-                  show_subquestions_if:
-                  subquestions:
-                    - variable: send_pii
-                      label: Send Personal Data
-                      description: Whether or not to send personal data, like usernames
-                      schema:
-                        type: boolean
-                        default: false
-                    - variable: environment
-                      label: Environment
-                      description: Unique environment that is attached to your error reports, should be set to your email address for example.
-                      schema:
-                        type: string
-                        default: customer
+                  type: string
+                  default: "null"
+              - variable: taskTimeoutHours
+                label: Task Timeout Hours
+                description: Timeout in hours for LDAP synchronization tasks
+                schema:
+                  type: int
+                  default: 2
         - variable: logging
           label: Logging
           schema:
@@ -203,235 +254,176 @@ questions:
                       description: warning
                     - value: error
                       description: error
-        - variable: ldap
-          label: LDAP
-          schema:
-            additional_attrs: true
-            type: dict
-            attrs:
-              - variable: tls_ciphers
-                label: TLS Ciphers
-                description: Allows configuration of TLS Ciphers for LDAP connections used by LDAP sources. Setting applies to all sources
-                schema:
-                  type: string
-                  default: "null"
-  - variable: outposts
-    group: App Configuration
-    label: Outpost Configuration
-    schema:
-      additional_attrs: true
-      type: dict
-      attrs:
-        - variable: ldap
-          label: LDAP
+        - variable: error_reporting
+          label: Error Reporting
           schema:
             additional_attrs: true
             type: dict
             attrs:
               - variable: enabled
-                label: Enable LDAP outpost
+                label: Enable Reporting
+                description: Enables error reporting
                 schema:
                   type: boolean
                   default: false
-                  show_subquestions_if: true
+                  show_subquestions_if:
                   subquestions:
-                    - variable: overrideHost
-                      label: Override Host
+                    - variable: sendPII
+                      label: Send Personal Data
+                      description: Whether or not to send personal data, like usernames
                       schema:
                         type: boolean
                         default: false
-                        show_subquestions_if: true
-                        subquestions:
-                          - variable: host
-                            label: Authentik Host
-                            description: "URL of your Authentik server. (e.g. https://auth.domain.com)"
-                            schema:
-                              type: string
-                              # TODO: Make them required again once Scale stable supports nested subquestions
-                              # required: true
-                              default: ""
-                          - variable: insecure
-                            label: Insecure
-                            description: Check only if you accessing Authentik in an unsecure way
-                            schema:
-                              type: boolean
-                              default: false
-                    - variable: overrideToken
-                      label: Override Token
-                      description: Overrides the random generated token to provide your own
+                    - variable: environment
+                      label: Environment
+                      description: The environment tag associated with all data sent to Sentry
                       schema:
-                        type: boolean
-                        default: false
-                        show_subquestions_if: true
-                        subquestions:
-                        - variable: token
-                          label: API Token
-                          description: You can get this from Applications > Outposts > View Deployment Info
-                          schema:
-                            type: string
-                            private: true
-                            # TODO: Make them required again once Scale stable supports nested subquestions
-                            # required: true
-                            default: ""
-                    - variable: overrideBrowserHost
-                      label: Override Host Browser
-                      description: Overrides the Browser Host, by default the first ingress host is used
+                        type: string
+                        default: customer
+                    - variable: sentryDSN
+                      label: Sentry DSN
+                      description: Sets the DSN for the Sentry API endpoint.
                       schema:
-                        type: boolean
-                        default: false
-                        show_subquestions_if: true
-                        subquestions:
-                        - variable: host_browser
-                          label: Host Browser
-                          description: URL to use in the browser, when it differs from << host >>
-                          schema:
-                            type: string
-                            # TODO: Make them required again once Scale stable supports nested subquestions
-                            # required: true
-                            default: ""
-        - variable: proxy
-          label: Proxy
+                        type: string
+                        private: true
+                        default: ""
+        - variable: geoip
+          label: GeoIP
           schema:
             additional_attrs: true
             type: dict
             attrs:
               - variable: enabled
-                label: Enable Proxy outpost
+                label: Enabled
+                description: |
+                  Enables and configures the GeoIP container.</br>
+                  This will deploy the GeoIP container.
                 schema:
                   type: boolean
                   default: false
                   show_subquestions_if: true
                   subquestions:
-                    - variable: overrideHost
-                      label: Override Host
+                    - variable: editionID
+                      label: Edition ID
+                      description: |
+                        The edition ID of the database to download.</br>
+                        Only one seems to be supported by Authentik.
                       schema:
-                        type: boolean
-                        default: false
-                        show_subquestions_if: true
-                        subquestions:
-                          - variable: host
-                            label: Authentik Host
-                            description: "URL of your Authentik server. (e.g. https://auth.domain.com)"
-                            schema:
-                              type: string
-                              # TODO: Make them required again once Scale stable supports nested subquestions
-                              # required: true
-                              default: ""
-                          - variable: insecure
-                            label: Insecure
-                            description: Check only if you accessing Authentik in an unsecure way
-                            schema:
-                              type: boolean
-                              default: false
-                    - variable: overrideToken
-                      label: Override Token
-                      description: Overrides the random generated token to provide your own
+                        type: string
+                        default: GeoLite2-City
+                    - variable: frequency
+                      label: Frequency
+                      description: The number of hours between geoipupdate runs.
                       schema:
-                        type: boolean
-                        default: false
-                        show_subquestions_if: true
-                        subquestions:
-                        - variable: token
-                          label: API Token
-                          description: You can get this from Applications > Outposts > View Deployment Info
-                          schema:
-                            type: string
-                            private: true
-                            # TODO: Make them required again once Scale stable supports nested subquestions
-                            # required: true
-                            default: ""
-                    - variable: overrideBrowserHost
-                      label: Override Host Browser
-                      description: Overrides the Browser Host, by default the first ingress host is used
+                        type: int
+                        min: 1
+                        default: 8
+                    - variable: accountID
+                      label: Account ID
+                      description: Your MaxMind account ID
                       schema:
-                        type: boolean
-                        default: false
-                        show_subquestions_if: true
-                        subquestions:
-                        - variable: host_browser
-                          label: Host Browser
-                          description: URL to use in the browser, when it differs from << host >>
-                          schema:
-                            type: string
-                            # TODO: Make them required again once Scale stable supports nested subquestions
-                            # required: true
-                            default: ""
-  - variable: geoip
-    group: App Configuration
-    label: GeoIP Configuration
-    schema:
-      additional_attrs: true
-      type: dict
-      attrs:
-        - variable: enabled
-          label: Enable GeoIP Container
-          description: Enables GeoIP container
+                        type: string
+                        private: true
+                        required: true
+                        default: ""
+                    - variable: licenseKey
+                      label: License Key
+                      description: Your MaxMind license key
+                      schema:
+                        type: string
+                        private: true
+                        required: true
+                        default: ""
+        - variable: outposts
+          label: Outposts
           schema:
-            type: boolean
-            default: false
-            show_subquestions_if: true
-            subquestions:
-              - variable: account_id
-                label: Account ID
-                description: Your MaxMind account ID
-                schema:
-                  type: string
-                  private: true
-                  required: true
-                  default: ""
-              - variable: license_key
-                label: License Key
-                description: Your case-sensitive MaxMind license key
-                schema:
-                  type: string
-                  private: true
-                  required: true
-                  default: ""
-              - variable: edition_ids
-                label: Edition IDs
-                description: List of space-separated database edition IDs. Edition IDs may consist of letters, digits, and dashes
-                schema:
-                  type: string
-                  required: true
-                  default: GeoLite2-City
-              - variable: frequency
-                label: Frequency
-                description: The number of hours between geoipupdate runs
-                schema:
-                  type: int
-                  min: 1
-                  default: 8
-              - variable: host_server
-                label: Host Server
-                description: The host name of the server to use
-                schema:
-                  type: string
-                  default: updates.maxmind.com
-              - variable: preserve_file_times
-                label: Preserve File Times
-                description: Whether to preserve modification times of files downloaded from the server
-                schema:
-                  type: boolean
-                  default: false
-              - variable: verbose
-                label: Verbose
-                description: Enable verbose mode. Prints out the steps that geoipupdate takes
+            additional_attrs: true
+            type: dict
+            attrs:
+              - variable: disableEmbeddedOutpost
+                label: EXPERIMENTAL - Disable Embedded Outpost
+                description: |
+                  Disables the embedded outpost.</br>
+                  This will disable the embedded outpost, and will require you to deploy your own outpost.</br>
+                  Only use this for testing, it might be removed without notice.
                 schema:
                   type: boolean
                   default: false
               - variable: proxy
                 label: Proxy
-                description: The proxy host name or IP address
                 schema:
-                  type: string
-                  default: ""
-              - variable: proxy_user_pass
-                label: Proxy Pass
-                description: The proxy user name and password, separated by a colon
+                  additional_attrs: true
+                  type: dict
+                  attrs:
+                    - variable: enabled
+                      label: Enabled
+                      description: |
+                        Enables and configures the Proxy container.</br>
+                        This will deploy the Proxy container.
+                      schema:
+                        type: boolean
+                        default: false
+                        show_subquestions_if: true
+                        subquestions:
+                          - variable: token
+                            label: Token
+                            description: |
+                              The token used to authenticate with the authentik server.
+                            schema:
+                              type: string
+                              private: true
+                              required: true
+                              default: ""
+              - variable: radius
+                label: Radius
                 schema:
-                  type: string
-                  private: true
-                  default: ""
+                  additional_attrs: true
+                  type: dict
+                  attrs:
+                    - variable: enabled
+                      label: Enabled
+                      description: |
+                        Enables and configures the Radius container.</br>
+                        This will deploy the Radius container.
+                      schema:
+                        type: boolean
+                        default: false
+                        show_subquestions_if: true
+                        subquestions:
+                          - variable: token
+                            label: Token
+                            description: |
+                              The token used to authenticate with the authentik server.
+                            schema:
+                              type: string
+                              private: true
+                              required: true
+                              default: ""
+              - variable: ldap
+                label: LDAP
+                schema:
+                  additional_attrs: true
+                  type: dict
+                  attrs:
+                    - variable: enabled
+                      label: Enabled
+                      description: |
+                        Enables and configures the LDAP container.</br>
+                        This will deploy the LDAP container.
+                      schema:
+                        type: boolean
+                        default: false
+                        show_subquestions_if: true
+                        subquestions:
+                          - variable: token
+                            label: Token
+                            description: |
+                              The token used to authenticate with the authentik server.
+                            schema:
+                              type: string
+                              private: true
+                              required: true
+                              default: ""
 # Include{containerConfig}
 # Include{podOptions}
 # Include{serviceRoot}
@@ -457,17 +449,17 @@ questions:
                               type: int
                               default: 10229
                               required: true
-        - variable: ldapldaps
-          label: LDAPS Service
-          description: The LDAPS service.
+        - variable: proxy
+          label: Proxy Service
+          description: The Proxy service.
           schema:
             additional_attrs: true
             type: dict
             attrs:
 # Include{serviceSelectorLoadBalancer}
 # Include{serviceSelectorExtras}
-                    - variable: ldapldaps
-                      label: LDAPS Service Port Configuration
+                    - variable: http
+                      label: HTTP Service Port Configuration
                       schema:
                         additional_attrs: true
                         type: dict
@@ -477,18 +469,53 @@ questions:
                             description: This port exposes the container port on the service
                             schema:
                               type: int
-                              default: 636
+                              default: 10227
                               required: true
-        - variable: ldapldap
-          label: LDAP Service
-          description: The LDAPS service.
+                    - variable: https
+                      label: HTTPS Service Port Configuration
+                      schema:
+                        additional_attrs: true
+                        type: dict
+                        attrs:
+                          - variable: port
+                            label: Port
+                            description: This port exposes the container port on the service
+                            schema:
+                              type: int
+                              default: 10228
+                              required: true
+        - variable: radius
+          label: RADIUS Service
+          description: The RADIUS service.
           schema:
             additional_attrs: true
             type: dict
             attrs:
 # Include{serviceSelectorLoadBalancer}
 # Include{serviceSelectorExtras}
-                    - variable: ldapldap
+                    - variable: radius
+                      label: RADIUS Service Port Configuration
+                      schema:
+                        additional_attrs: true
+                        type: dict
+                        attrs:
+                          - variable: port
+                            label: Port
+                            description: This port exposes the container port on the service
+                            schema:
+                              type: int
+                              default: 1812
+                              required: true
+        - variable: ldap
+          label: LDAP Service
+          description: The LDAP service.
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{serviceSelectorLoadBalancer}
+# Include{serviceSelectorExtras}
+                    - variable: ldap
                       label: LDAP Service Port Configuration
                       schema:
                         additional_attrs: true
@@ -501,17 +528,17 @@ questions:
                               type: int
                               default: 389
                               required: true
-        - variable: proxyhttps
-          label: Proxy HTTPS Service
-          description: The Proxy HTTPS service.
+        - variable: ldaps
+          label: LDAPS Service
+          description: The LDAPS service.
           schema:
             additional_attrs: true
             type: dict
             attrs:
 # Include{serviceSelectorLoadBalancer}
 # Include{serviceSelectorExtras}
-                    - variable: proxyhttps
-                      label: Proxy HTTPS Service Port Configuration
+                    - variable: ldaps
+                      label: LDAPS Service Port Configuration
                       schema:
                         additional_attrs: true
                         type: dict
@@ -521,7 +548,7 @@ questions:
                             description: This port exposes the container port on the service
                             schema:
                               type: int
-                              default: 10233
+                              default: 636
                               required: true
 # Include{serviceExpertRoot}
 # Include{serviceExpert}
@@ -542,6 +569,14 @@ questions:
             additional_attrs: true
             type: dict
             attrs:
+# Include{persistenceBasic}
+        - variable: blueprints
+          label: App Blueprints Storage
+          description: Stores the Application Blueprints.
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
 # Include{persistenceBasic}
         - variable: certs
           label: App Certs Storage
@@ -571,8 +606,8 @@ questions:
 # Include{ingressTLS}
 # Include{ingressTraefik}
 # Include{ingressAdvanced}
-        - variable: proxyhttps
-          label: Proxy HTTPS Ingress
+        - variable: proxy
+          label: Proxy (HTTPS) Ingress
           schema:
             additional_attrs: true
             type: dict
@@ -583,16 +618,15 @@ questions:
 # Include{ingressAdvanced}
 # Include{ingressList}
 # Include{securityContextRoot}
-
               - variable: runAsUser
-                label: "runAsUser"
-                description: "The UserID of the user running the application"
+                label: runAsUser
+                description: The UserID of the user running the application
                 schema:
                   type: int
                   default: 1000
               - variable: runAsGroup
-                label: "runAsGroup"
-                description: "The groupID of the user running the application"
+                label: runAsGroup
+                description: The groupID of the user running the application
                 schema:
                   type: int
                   default: 1000
@@ -600,12 +634,11 @@ questions:
 # Include{securityContextAdvanced}
 # Include{securityContextPod}
               - variable: fsGroup
-                label: "fsGroup"
-                description: "The group that should own ALL storage."
+                label: fsGroup
+                description: The group that should own ALL storage.
                 schema:
                   type: int
                   default: 568
-
 # Include{resources}
 # Include{metrics}
 # Include{prometheusRule}

charts/incubator/authentik/templates/_config.tpl

@@ -1,118 +1,125 @@
 {{/* Define the configmaps */}}
 {{- define "authentik.configmaps" -}}
 
-{{- $authServerWorkerConfigName := printf "%s-authentik-config" (include "tc.v1.common.lib.chart.names.fullname" .) }}
-{{- $authServerConfigName := printf "%s-authentik-server-config" (include "tc.v1.common.lib.chart.names.fullname" .) }}
-{{- $geoipConfigName := printf "%s-geoip-config" (include "tc.v1.common.lib.chart.names.fullname" .) }}
-{{- $ldapConfigName := printf "%s-ldap-config" (include "tc.v1.common.lib.chart.names.fullname" .) }}
-{{- $proxyConfigName := printf "%s-proxy-config" (include "tc.v1.common.lib.chart.names.fullname" .) }}
+  {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}}
+  {{- $serverHost := printf "https://%v:%v" $fullname .Values.service.main.ports.main.port -}}
+  {{- $host := .Values.chartContext.APPURL }}
+server:
+  enabled: true
+  data:
+    AUTHENTIK_LISTEN__HTTPS: {{ printf "0.0.0.0:%v" .Values.service.main.ports.main.port | quote }}
+    AUTHENTIK_LISTEN__HTTP: {{ printf "0.0.0.0:%v" .Values.service.http.ports.http.port | quote }}
+    AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.servermetrics.ports.servermetrics.port | quote }}
 
-{{ $host := printf "https://localhost:%v" .Values.service.main.ports.main.targetPort }}
-{{- if .Values.ingress.main.enabled }}
-  {{ $first := (first .Values.ingress.main.hosts) }}
-  {{- if $first }}
-    {{ $host = printf "https://%s" $first.host }}
-  {{- end }}
-{{- end }}
-
-{{/* This configmap is loaded in both the main authentik container and worker */}}
-{{ $authServerWorkerConfigName }}:
+server-worker:
   enabled: true
   data:
     {{/* Dependencies */}}
-    AUTHENTIK_REDIS__HOST: {{ .Values.redis.creds.plain }}
-    {{- with $redis := .Values.redisProvider }}
-    AUTHENTIK_REDIS__PORT: {{ default 6379 $redis.port | quote }}
-    {{- end }}
     AUTHENTIK_POSTGRESQL__NAME: {{ .Values.cnpg.main.database }}
     AUTHENTIK_POSTGRESQL__USER: {{ .Values.cnpg.main.user }}
     AUTHENTIK_POSTGRESQL__HOST: {{ .Values.cnpg.main.creds.host }}
-    {{- with $cnpg := .Values.cnpgProvider }}
-    AUTHENTIK_POSTGRESQL__PORT: {{ default 5432 $cnpg.port | quote }}
+    AUTHENTIK_POSTGRESQL__PORT: "5432"
+    AUTHENTIK_REDIS__HOST: {{ .Values.redis.creds.plain }}
+    AUTHENTIK_REDIS__PORT: "6379"
+
+    {{/* Outposts */}}
+    AUTHENTIK_OUTPOSTS__DISCOVER: "false"
+    AUTHENTIK_OUTPOSTS__DISABLE_EMBEDDED_OUTPOST: {{ .Values.authentik.outposts.disableEmbeddedOutpost | quote }}
+
+    {{/* GeoIP */}}
+    {{- $geoipPath := (printf "/geoip/%v.mmdb" .Values.authentik.geoip.editionID) -}}
+    {{- if not .Values.authentik.geoip.enabled -}}
+      {{- $geoipPath = "/tmp/non-existent-file" -}}
     {{- end }}
+    AUTHENTIK_GEOIP: {{ $geoipPath }}
+
     {{/* Mail */}}
-    {{- with .Values.authentik.mail.port }}
+    AUTHENTIK_EMAIL__USE_TLS: {{ .Values.authentik.email.useTLS | quote }}
+    AUTHENTIK_EMAIL__USE_SSL: {{ .Values.authentik.email.useSSL | quote }}
+    {{- with .Values.authentik.email.port }}
     AUTHENTIK_EMAIL__PORT: {{ . | quote }}
-    {{- end }}
-    AUTHENTIK_EMAIL__USE_TLS: {{ .Values.authentik.mail.tls | quote }}
-    AUTHENTIK_EMAIL__USE_SSL: {{ .Values.authentik.mail.ssl | quote }}
-    {{- with .Values.authentik.mail.timeout }}
+    {{- end -}}
+    {{- with .Values.authentik.email.timeout }}
     AUTHENTIK_EMAIL__TIMEOUT: {{ . | quote }}
     {{- end }}
-    {{/* Logging */}}
-    {{- with .Values.authentik.logging.log_level }}
-    AUTHENTIK_LOG_LEVEL: {{ . }}
-    {{- end }}
-    {{/* General */}}
-    AUTHENTIK_DISABLE_STARTUP_ANALYTICS: {{ .Values.authentik.general.disable_startup_analytics | quote }}
-    AUTHENTIK_DISABLE_UPDATE_CHECK: {{ .Values.authentik.general.disable_update_check | quote }}
-    {{- with .Values.authentik.general.avatars }}
-    AUTHENTIK_AVATARS: {{ . }}
-    {{- end }}
-    AUTHENTIK_DEFAULT_USER_CHANGE_NAME: {{ .Values.authentik.general.allow_user_name_change | quote }}
-    AUTHENTIK_DEFAULT_USER_CHANGE_EMAIL: {{ .Values.authentik.general.allow_user_mail_change | quote }}
-    AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME: {{ .Values.authentik.general.allow_user_username_change | quote }}
-    AUTHENTIK_GDPR_COMPLIANCE: {{ .Values.authentik.general.gdpr_compliance | quote }}
-    AUTHENTIK_IMPERSONATION: {{ .Values.authentik.general.impersonation | quote }}
-    AUTHENTIK_DEFAULT_TOKEN_LENGTH: {{ .Values.authentik.general.token_length | quote }}
-    {{- with .Values.authentik.general.footer_links }}
-    AUTHENTIK_FOOTER_LINKS: {{ . | squote }}
-    {{- end }}
-    {{/* Error Reporting */}}
-    AUTHENTIK_ERROR_REPORTING__ENABLED: {{ .Values.authentik.error_reporting.enabled | quote }}
-    AUTHENTIK_ERROR_REPORTING__SEND_PII: {{ .Values.authentik.error_reporting.send_pii | quote }}
-    {{- with .Values.authentik.error_reporting.environment }}
-    AUTHENTIK_ERROR_REPORTING__ENVIRONMENT: {{ . }}
-    {{- end }}
-    {{/* LDAP */}}
-    {{- with .Values.authentik.ldap.tls_ciphers }}
-    AUTHENTIK_LDAP__TLS__CIPHERS: {{ . | quote }}
-    {{- end }}
-    {{/* Outposts */}}
-    AUTHENTIK_OUTPOSTS__DISCOVER: {{ "false" | quote }}
 
-{{/* This configmap is loaded in both the main authentik container and worker */}}
-{{ $authServerConfigName }}:
+    {{/* LDAP */}}
+    AUTHENTIK_LDAP__TASK_TIMEOUT_HOURS: {{ .Values.authentik.ldap.taskTimeoutHours | quote }}
+    AUTHENTIK_LDAP__TLS__CIPHERS: {{ .Values.authentik.ldap.tlsCiphers | quote }}
+
+    {{/* Logging */}}
+    AUTHENTIK_LOG_LEVEL: {{ .Values.authentik.logging.logLevel }}
+
+    {{/* Error Reporting */}}
+    AUTHENTIK_ERROR_REPORTING__ENABLED: {{ .Values.authentik.errorReporting.enabled | quote }}
+    AUTHENTIK_ERROR_REPORTING__SEND_PII: {{ .Values.authentik.errorReporting.sendPII | quote }}
+    {{- with .Values.authentik.errorReporting.environment }}
+    AUTHENTIK_ERROR_REPORTING__ENVIRONMENT: {{ . | quote }}
+    {{- end -}}
+    {{- with .Values.authentik.errorReporting.sentryDSN }}
+    AUTHENTIK_ERROR_REPORTING__SENTRY_DSN: {{ . | quote }}
+    {{- end -}}
+    {{- with .Values.authentik.general.avatars }}
+    AUTHENTIK_AVATARS: {{ join "," . }}
+    {{- end -}}
+    {{- with .Values.authentik.general.footerLinks }}
+    AUTHENTIK_FOOTER_LINKS: {{ toJson . | squote }}
+    {{- end }}
+
+    {{/* General */}}
+    AUTHENTIK_DISABLE_UPDATE_CHECK: {{ .Values.authentik.general.disableUpdateCheck | quote }}
+    AUTHENTIK_DISABLE_STARTUP_ANALYTICS: {{ .Values.authentik.general.disableStartupAnalytics | quote }}
+    AUTHENTIK_DEFAULT_USER_CHANGE_NAME: {{ .Values.authentik.general.allowUserChangeName | quote }}
+    AUTHENTIK_DEFAULT_USER_CHANGE_EMAIL: {{ .Values.authentik.general.allowUserChangeEmail | quote }}
+    AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME: {{ .Values.authentik.general.allowUserChangeUsername | quote }}
+    AUTHENTIK_GDPR_COMPLIANCE: {{ .Values.authentik.general.gdprCompliance | quote }}
+    AUTHENTIK_DEFAULT_TOKEN_LENGTH: {{ .Values.authentik.general.tokenLength | quote }}
+    AUTHENTIK_IMPERSONATION: {{ .Values.authentik.general.impersonation | quote }}
+
+{{- if .Values.authentik.outposts.proxy.enabled }}
+proxy:
   enabled: true
   data:
-    {{/* Listen */}}
-    AUTHENTIK_LISTEN__HTTPS: 0.0.0.0:{{ .Values.service.main.ports.main.targetPort | default 9443 }}
-    AUTHENTIK_LISTEN__HTTP: 0.0.0.0:{{ .Values.service.http.ports.http.targetPort | default 9000 }}
-    AUTHENTIK_LISTEN__METRICS: 0.0.0.0:{{ .Values.service.metrics.ports.metrics.targetPort | default 9301 }}
-
-{{/* This configmap is loaded in the geoip container */}}
-{{ $geoipConfigName }}:
-  enabled: {{ .Values.geoip.enabled }}
-  data:
-    {{- with .Values.geoip.edition_ids }}
-    GEOIPUPDATE_EDITION_IDS: {{ . }}
-    {{- end }}
-    GEOIPUPDATE_FREQUENCY: {{ .Values.geoip.frequency | quote }}
-    {{- with .Values.geoip.host_server }}
-    GEOIPUPDATE_HOST: {{ . }}
-    {{- end }}
-    GEOIPUPDATE_PRESERVE_FILE_TIMES: {{ ternary "1" "0" .Values.geoip.preserve_file_times | quote }}
-    GEOIPUPDATE_VERBOSE: {{ ternary "1" "0" .Values.geoip.verbose | quote }}
-
-{{/* This configmap is loaded in the ldap container */}}
-{{ $ldapConfigName }}:
-  enabled: {{ .Values.outposts.ldap.enabled }}
-  data:
-    AUTHENTIK_INSECURE: {{ .Values.outposts.ldap.insecure | default "true" | quote }}
-    AUTHENTIK_HOST: {{ .Values.outposts.ldap.host | default (printf "https://localhost:%v" .Values.service.main.ports.main.targetPort) }}
-    AUTHENTIK_HOST_BROWSER: {{ .Values.outposts.ldap.host_browser | default $host }}
-    AUTHENTIK_LISTEN__LDAPS: 0.0.0.0:{{ .Values.service.ldapldaps.ports.ldapldaps.targetPort | default 6636 }}
-    AUTHENTIK_LISTEN__LDAP: 0.0.0.0:{{ .Values.service.ldapldap.ports.ldapldap.targetPort | default 3389 }}
-    AUTHENTIK_LISTEN__METRICS: 0.0.0.0:{{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort | default 9302 }}
-
-{{/* This configmap is loaded in the proxy container */}}
-{{ $proxyConfigName }}:
-  enabled: {{ .Values.outposts.proxy.enabled }}
-  data:
-    AUTHENTIK_INSECURE: {{ .Values.outposts.proxy.insecure | default "true" | quote }}
-    AUTHENTIK_HOST: {{ .Values.outposts.proxy.host | default (printf "https://localhost:%v" .Values.service.main.ports.main.targetPort) }}
-    AUTHENTIK_HOST_BROWSER: {{ .Values.outposts.proxy.host_browser | default $host }}
-    AUTHENTIK_LISTEN__HTTPS: 0.0.0.0:{{ .Values.service.proxyhttps.ports.proxyhttps.targetPort | default 9444 }}
-    AUTHENTIK_LISTEN__HTTP: 0.0.0.0:{{ .Values.service.proxyhttp.ports.proxyhttp.targetPort | default 9001 }}
-    AUTHENTIK_LISTEN__METRICS: 0.0.0.0:{{ .Values.service.proxymetrics.ports.proxymetrics.targetPort | default 9303 }}
+    AUTHENTIK_LISTEN__HTTP: {{ printf "0.0.0.0:%v" .Values.service.proxy.ports.http.port | quote }}
+    AUTHENTIK_LISTEN__HTTPS: {{ printf "0.0.0.0:%v" .Values.service.proxy.ports.https.port | quote }}
+    AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.proxymetrics.ports.proxymetrics.port | quote }}
+    AUTHENTIK_HOST: {{ $serverHost }}
+    AUTHENTIK_INSECURE: "true"
+    # TODO: node ip or ingress host
+    AUTHENTIK_HOST_BROWSER: {{ $host }}
+{{- end -}}
+
+{{- if .Values.authentik.outposts.radius.enabled }}
+radius:
+  enabled: true
+  data:
+    AUTHENTIK_LISTEN__RADIUS: {{ printf "0.0.0.0:%v" .Values.service.radius.ports.radius.port | quote }}
+    AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.radiusmetrics.ports.radiusmetrics.port | quote }}
+    AUTHENTIK_HOST: {{ $serverHost }}
+    AUTHENTIK_INSECURE: "true"
+    # TODO: node ip or ingress host
+    AUTHENTIK_HOST_BROWSER: {{ $host }}
+{{- end -}}
+
+{{- if .Values.authentik.outposts.ldap.enabled }}
+ldap:
+  enabled: true
+  data:
+    AUTHENTIK_LISTEN__LDAP: {{ printf "0.0.0.0:%v" .Values.service.ldap.ports.ldap.port | quote }}
+    AUTHENTIK_LISTEN__LDAPS: {{ printf "0.0.0.0:%v" .Values.service.ldaps.ports.ldaps.port | quote }}
+    AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.ldapmetrics.ports.ldapmetrics.port | quote }}
+    AUTHENTIK_HOST: {{ $serverHost }}
+    AUTHENTIK_INSECURE: "true"
+    # TODO: node ip or ingress host
+    AUTHENTIK_HOST_BROWSER: {{ $host }}
+{{- end -}}
+
+{{- if .Values.authentik.geoip.enabled }}
+geoip:
+  enabled: true
+  data:
+    GEOIPUPDATE_EDITION_IDS: {{ .Values.authentik.geoip.editionID }}
+    GEOIPUPDATE_FREQUENCY: {{ .Values.authentik.geoip.frequency | quote }}
+{{- end -}}
+
 {{- end -}}

charts/incubator/authentik/templates/_geoip.tpl

@@ -1,23 +0,0 @@
-{{/* Define the geoip container */}}
-{{- define "authentik.geoip.container" -}}
-enabled: true
-primary: false
-imageSelector: geoipImage
-securityContext:
-  runAsUser: 0
-  runAsGroup: 0
-envFrom:
-  - secretRef:
-      name: '{{ include "tc.v1.common.lib.chart.names.fullname" . }}-geoip-secret'
-  - configMapRef:
-      name: '{{ include "tc.v1.common.lib.chart.names.fullname" . }}-geoip-config'
-{{/* TODO: Add healthchecks */}}
-{{/* TODO: https://github.com/maxmind/geoipupdate/issues/105 */}}
-probes:
-  readiness:
-    enabled: false
-  liveness:
-    enabled: false
-  startup:
-    enabled: false
-{{- end -}}