Implement S3 media storage for Authentik by adding configuration options for dedicated S3 bucket and credentials. Update README and default values to clarify usage and requirements for S3 integration, ensuring compatibility with Velero settings. Enhance Ansible tasks to load S3 configurations from the environment.

ansible/roles/noble_authentik/tasks/main.yml

@@ -26,6 +26,19 @@
         fail_msg: >-
           Authentik requires secrets in .env (see ansible/roles/noble_authentik/README.md) or matching -e extra-vars.
 
+    - name: Require Authentik S3 media settings (same endpoint/keys as Velero; dedicated bucket)
+      ansible.builtin.assert:
+        that:
+          - noble_authentik_media_s3_bucket | default('') | length > 0
+          - noble_authentik_s3_endpoint | default('') | length > 0
+          - noble_authentik_s3_access_key | default('') | length > 0
+          - noble_authentik_s3_secret_key | default('') | length > 0
+        fail_msg: >-
+          Set NOBLE_AUTHENTIK_MEDIA_S3_BUCKET (dedicated bucket for media, not the Velero backup bucket).
+          For S3 URL and keys, set NOBLE_AUTHENTIK_S3_URL / NOBLE_AUTHENTIK_S3_ACCESS_KEY / NOBLE_AUTHENTIK_S3_SECRET_KEY,
+          or reuse Velero's NOBLE_VELERO_S3_URL and NOBLE_VELERO_AWS_ACCESS_KEY_ID / NOBLE_VELERO_AWS_SECRET_ACCESS_KEY
+          in .env (see .env.sample and clusters/noble/bootstrap/velero/README.md).
+
     - name: Ensure Ansible temp dir for rendered Helm values
       ansible.builtin.file:
         path: "{{ noble_repo_root }}/ansible/.ansible-tmp"