106 lines
3.8 KiB
YAML
106 lines
3.8 KiB
YAML
name: authentik
|
|
|
|
x-logging: &default-logging
|
|
options:
|
|
max-size: 32m
|
|
max-file: 4
|
|
|
|
services:
|
|
authentik-postgresql:
|
|
container_name: authentik-postgresql
|
|
image: docker.io/library/postgres:16.8-alpine3.21
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
- .env.authentik
|
|
logging: *default-logging
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
|
|
start_period: 20s
|
|
interval: 30s
|
|
retries: 5
|
|
timeout: 5s
|
|
environment:
|
|
POSTGRES_PASSWORD: ${AUTHENTIK_PG_PASS:?database password required}
|
|
POSTGRES_USER: authentik
|
|
POSTGRES_DB: authentik
|
|
volumes:
|
|
- ./authentik/postgres:/var/lib/postgresql/data
|
|
authentik-redis:
|
|
container_name: authentik-redis
|
|
image: docker.io/library/redis:8.2.1-alpine3.22
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
- .env.authentik
|
|
logging: *default-logging
|
|
command: --save 60 1 --loglevel warning
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
|
|
start_period: 20s
|
|
interval: 30s
|
|
retries: 5
|
|
timeout: 3s
|
|
volumes:
|
|
- ./authentik/redis:/data
|
|
authentik-server:
|
|
container_name: authentik-server
|
|
image: ghcr.io/goauthentik/server:2025.8.1
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
- .env.authentik
|
|
logging: *default-logging
|
|
depends_on:
|
|
authentik-postgresql:
|
|
condition: service_healthy
|
|
authentik-redis:
|
|
condition: service_healthy
|
|
command: server
|
|
environment:
|
|
AUTHENTIK_REDIS__HOST: authentik-redis
|
|
AUTHENTIK_POSTGRESQL__HOST: authentik-postgresql
|
|
AUTHENTIK_POSTGRESQL__USER: authentik
|
|
AUTHENTIK_POSTGRESQL__NAME: authentik
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_PG_PASS}
|
|
volumes:
|
|
- ./authentik/custom-templates:/templates
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.authentik.entryPoints=https
|
|
- traefik.http.routers.authentik.rule=Host(`authentik.home.joemonk.co.uk`) || (HostRegexp(`{subdomain:[A-Za-z0-9](?:[A-Za-z0-9\-]{0,61}[A-Za-z0-9])?}.home.joemonk.co.uk`) && PathPrefix(`/outpost.goauthentik.io/`))
|
|
- traefik.http.routers.authentik.tls=true
|
|
- traefik.http.routers.authentik.tls.certresolver=letsencrypt
|
|
- traefik.http.routers.authentik.tls.domains[0].main=authentik.home.joemonk.co.uk
|
|
- traefik.http.routers.authentik.service=authentik
|
|
- traefik.http.services.authentik.loadbalancer.server.port=9000
|
|
|
|
- traefik.http.middlewares.authentik-traefik.forwardAuth.address=http:/authentik-server:9000/outpost.goauthentik.io/auth/traefik
|
|
- traefik.http.middlewares.authentik-traefik.forwardAuth.trustForwardHeader=true
|
|
- traefik.http.middlewares.authentik-traefik.forwardAuth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version
|
|
|
|
authentik-worker:
|
|
container_name: authentik-worker
|
|
image: ghcr.io/goauthentik/server:2025.8.1
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
- .env.authentik
|
|
logging: *default-logging
|
|
depends_on:
|
|
authentik-postgresql:
|
|
condition: service_healthy
|
|
authentik-redis:
|
|
condition: service_healthy
|
|
command: worker
|
|
user: root
|
|
environment:
|
|
AUTHENTIK_REDIS__HOST: authentik-redis
|
|
AUTHENTIK_POSTGRESQL__HOST: authentik-postgresql
|
|
AUTHENTIK_POSTGRESQL__USER: authentik
|
|
AUTHENTIK_POSTGRESQL__NAME: authentik
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_PG_PASS}
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- ./authentik/certs:/certs
|
|
- ./authentik/custom-templates:/templates |