refactor(k8s): Reorganize into 5-layer structure with production kustomizations

k8s/security/iam/.env.example

@@ -0,0 +1,27 @@
+# talos-iam/.env.example
+# Copy to talos-iam/.env and fill in. The real .env is gitignored — never commit it.
+# These are ADMIN credentials for the homelab identity provider; use strong values.
+
+# Authentik's signing/encryption key. SET ONCE — rotating it invalidates all
+# existing sessions, tokens, and encrypted fields. Generate:
+#   openssl rand -base64 60 | tr -d '\n'
+AUTHENTIK_SECRET_KEY=
+
+# Initial password for the built-in admin user 'akadmin'. Change after first login.
+#   openssl rand -base64 24
+AUTHENTIK_BOOTSTRAP_PASSWORD=
+
+# Initial API token for 'akadmin' (used for automation / blueprints).
+#   openssl rand -hex 32
+AUTHENTIK_BOOTSTRAP_TOKEN=
+
+# Password for the bundled PostgreSQL 'authentik' user (system of record).
+#   openssl rand -base64 24
+PG_PASSWORD=
+
+# OAuth2 client secrets for downstream OIDC integrations.
+# These are registered with Authentik and injected as K8s secrets
+# into the logging and storage namespaces by this bootstrap script.
+#   openssl rand -hex 32
+GRAFANA_OIDC_CLIENT_SECRET=
+MINIO_OIDC_CLIENT_SECRET=