first commit

authentik/README.md

@@ -0,0 +1,7 @@
+# Compose file for Authentik
+## Environment Variables
+- POSTGRES_PASSWORD - database password
+- AUTHENTIK_SECRET_KEY - Key used for cookie signing
+- AUTHENTIK_EMAIL__PASSWORD - SMTP password
+- AUTHENTIK_LDAP_TOKEN - token for LDAP outpost
+- AUTHENTIK_PROXY_TOKEN - token for proxy outpost

authentik/compose.yaml

@@ -0,0 +1,143 @@
+services:
+  authentik_db:
+    image: docker.io/library/postgres:16-alpine
+    container_name: authentik_db
+    networks:
+      - default
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
+      start_period: 20s
+      interval: 30s
+      retries: 5
+      timeout: 5s
+    volumes:
+      - authentik_db:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_USER=authentik
+      - POSTGRES_DB=authentik
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+
+  authentik_redis:
+    image: docker.io/library/redis:alpine
+    container_name: authentik_redis
+    networks:
+      - default
+    command: --save 60 1 --loglevel warning
+    restart: always
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
+      start_period: 20s
+      interval: 30s
+      retries: 5
+      timeout: 3s
+    volumes:
+      - authentik_redis:/data
+
+  authentik:
+    image: ghcr.io/goauthentik/server:${AUTHENTIK_VERSION}
+    container_name: authentik
+    networks:
+      - default
+      - proxy
+    restart: unless-stopped
+    command: server
+    environment:
+      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
+      - AUTHENTIK_REDIS__HOST=authentik_redis
+      - AUTHENTIK_POSTGRESQL__HOST=authentik_db
+      - AUTHENTIK_POSTGRESQL__USER=authentik
+      - AUTHENTIK_POSTGRESQL__NAME=authentik
+      - AUTHENTIK_POSTGRESQL__PASSWORD=${POSTGRES_PASSWORD}
+      - AUTHENTIK_OUTPOSTS__DISABLE_EMBEDDED_OUTPOST=true
+    volumes:
+      - authentik_media:/media
+      - authentik_templates:/templates
+    depends_on:
+      authentik_db:
+        condition: service_healthy
+      authentik_redis:
+        condition: service_healthy
+    labels:
+      caddy: auth.fern.garden
+      caddy.reverse_proxy: "{{upstreams 9000}}"
+
+  authentik_worker:
+    image: ghcr.io/goauthentik/server:${AUTHENTIK_VERSION}
+    container_name: authentik_worker
+    networks:
+      - default
+    restart: unless-stopped
+    command: worker
+    environment:
+      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
+      - AUTHENTIK_REDIS__HOST=authentik_redis
+      - AUTHENTIK_POSTGRESQL__HOST=authentik_db
+      - AUTHENTIK_POSTGRESQL__USER=authentik
+      - AUTHENTIK_POSTGRESQL__NAME=authentik
+      - AUTHENTIK_POSTGRESQL__PASSWORD=${POSTGRES_PASSWORD}
+      - AUTHENTIK_OUTPOSTS__DISABLE_EMBEDDED_OUTPOST=true
+    user: root
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - authentik_media:/media
+      - authentik_templates:/templates
+      - authentik_certs:/certs
+    depends_on:
+      authentik_db:
+        condition: service_healthy
+      authentik_redis:
+        condition: service_healthy
+
+  authentik_proxy:
+    image: ghcr.io/goauthentik/proxy:${AUTHENTIK_VERSION}
+    container_name: authentik_proxy
+    networks:
+      - default
+      - proxy
+    environment:
+      - AUTHENTIK_HOST=http://authentik:9000
+      - AUTHENTIK_HOST_BROWSER=https://auth.fern.garden
+      - AUTHENTIK_INSECURE=true
+      - AUTHENTIK_TOKEN=${AUTHENTIK_PROXY_TOKEN}
+    depends_on:
+      authentik:
+        condition: service_healthy
+      authentik_worker:
+        condition: service_healthy
+
+  authentik_ldap:
+    image: ghcr.io/goauthentik/ldap:${AUTHENTIK_VERSION}
+    container_name: authentik_ldap
+    networks:
+      - default
+    ports:
+      - 389:3389
+      - 636:6636
+    environment:
+      - AUTHENTIK_HOST=http://authentik:9000
+      - AUTHENTIK_HOST_BROWSER=https://auth.fern.garden
+      - AUTHENTIK_INSECURE=true
+      - AUTHENTIK_TOKEN=${AUTHENTIK_LDAP_TOKEN}
+    depends_on:
+      authentik:
+        condition: service_healthy
+      authentik_worker:
+        condition: service_healthy
+
+volumes:
+  authentik_db:
+    name: authentik_db
+  authentik_redis:
+    name: authentik_redis
+  authentik_media:
+    name: authentik_media
+  authentik_certs:
+    name: authentik_certs
+  authentik_templates:
+    name: authentik_templates
+
+networks:
+  default:
+  proxy:
+    external: true