name: authentik

x-logging: &default-logging
  options:
    max-size: 32m
    max-file: 4

services:
  authentik-postgresql:
    container_name: authentik-postgresql
    image: docker.io/library/postgres:16.8-alpine3.21
    restart: unless-stopped
    env_file:
      - .env
      - .env.authentik
    logging: *default-logging
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    environment:
      POSTGRES_PASSWORD: ${AUTHENTIK_PG_PASS:?database password required}
      POSTGRES_USER: authentik
      POSTGRES_DB: authentik
    volumes:
      - ./authentik/postgres:/var/lib/postgresql/data
  authentik-redis:
    container_name: authentik-redis
    image: docker.io/library/redis:8.2.1-alpine3.22
    restart: unless-stopped
    env_file:
      - .env
      - .env.authentik
    logging: *default-logging
    command: --save 60 1 --loglevel warning
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    volumes:
      - ./authentik/redis:/data
  authentik-server:
    container_name: authentik-server
    image: ghcr.io/goauthentik/server:2025.8.1
    restart: unless-stopped
    env_file:
      - .env
      - .env.authentik
    logging: *default-logging
    depends_on:
      authentik-postgresql:
        condition: service_healthy
      authentik-redis:
        condition: service_healthy
    command: server
    environment:
      AUTHENTIK_REDIS__HOST: authentik-redis
      AUTHENTIK_POSTGRESQL__HOST: authentik-postgresql
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_PG_PASS}
    volumes:
      - ./authentik/custom-templates:/templates
    labels:
      - traefik.enable=true
      - traefik.http.routers.authentik.entryPoints=https
      - traefik.http.routers.authentik.rule=Host(`authentik.home.joemonk.co.uk`) || (HostRegexp(`{subdomain:[A-Za-z0-9](?:[A-Za-z0-9\-]{0,61}[A-Za-z0-9])?}.home.joemonk.co.uk`) && PathPrefix(`/outpost.goauthentik.io/`))
      - traefik.http.routers.authentik.tls=true
      - traefik.http.routers.authentik.tls.certresolver=letsencrypt
      - traefik.http.routers.authentik.tls.domains[0].main=authentik.home.joemonk.co.uk
      - traefik.http.routers.authentik.service=authentik
      - traefik.http.services.authentik.loadbalancer.server.port=9000

      - traefik.http.middlewares.authentik-traefik.forwardAuth.address=http:/authentik-server:9000/outpost.goauthentik.io/auth/traefik
      - traefik.http.middlewares.authentik-traefik.forwardAuth.trustForwardHeader=true
      - traefik.http.middlewares.authentik-traefik.forwardAuth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version

  authentik-worker:
    container_name: authentik-worker
    image: ghcr.io/goauthentik/server:2025.8.1
    restart: unless-stopped
    env_file:
      - .env
      - .env.authentik
    logging: *default-logging
    depends_on:
      authentik-postgresql:
        condition: service_healthy
      authentik-redis:
        condition: service_healthy
    command: worker
    user: root
    environment:
      AUTHENTIK_REDIS__HOST: authentik-redis
      AUTHENTIK_POSTGRESQL__HOST: authentik-postgresql
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_PG_PASS}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./authentik/certs:/certs
      - ./authentik/custom-templates:/templates