121 lines
3.8 KiB
YAML
121 lines
3.8 KiB
YAML
services:
|
|
##########
|
|
# Database
|
|
##########
|
|
authentik-db:
|
|
image: docker.io/library/postgres:16-alpine
|
|
restart: unless-stopped
|
|
container_name: authentik-db
|
|
environment:
|
|
POSTGRES_DB: ${PG_DB}
|
|
POSTGRES_PASSWORD: ${PG_PASS}
|
|
POSTGRES_USER: ${PG_USER}
|
|
healthcheck:
|
|
interval: 30s
|
|
retries: 5
|
|
start_period: 20s
|
|
test:
|
|
- CMD-SHELL
|
|
- pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
|
|
timeout: 5s
|
|
labels:
|
|
rackpeek.name: authentik-db
|
|
rackpeek.tags: database
|
|
volumes:
|
|
- /srv/docker/network/authentik/database:/var/lib/postgresql/data
|
|
|
|
##########
|
|
# Server
|
|
##########
|
|
authentik-server:
|
|
command: server
|
|
depends_on:
|
|
authentik-db:
|
|
condition: service_healthy
|
|
image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG}
|
|
container_name: authentik-server
|
|
ports:
|
|
- 9000:9000
|
|
- 9443:9443
|
|
restart: unless-stopped
|
|
shm_size: 512mb
|
|
environment:
|
|
AUTHENTIK_POSTGRESQL__HOST: authentik-db
|
|
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB}
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
|
|
AUTHENTIK_POSTGRESQL__USER: ${PG_USER}
|
|
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
|
|
#AUTHENTIK_ERROR_REPORTING__ENABLED: true
|
|
# SMTP server
|
|
#AUTHENTIK_EMAIL__HOST: ${EMAIL_HOST}
|
|
#AUTHENTIK_EMAIL__PORT: 587
|
|
## Optionally authenticate (don't add quotation marks to your password)
|
|
#AUTHENTIK_EMAIL__USERNAME: ${EMAIL_USER}
|
|
#AUTHENTIK_EMAIL__PASSWORD: ${EMAIL_PWD}
|
|
#AUTHENTIK_EMAIL__TIMEOUT: 10
|
|
## Sender email address; verify that the domain is valid.
|
|
#AUTHENTIK_EMAIL__FROM: ${EMAIL_FROM}
|
|
|
|
#STARTTLS, also called explicit TLS, often uses port 587. Set AUTHENTIK_EMAIL__USE_TLS=true and leave AUTHENTIK_EMAIL__USE_SSL=false.
|
|
#SSL or implicit TLS often uses port 465. Set AUTHENTIK_EMAIL__USE_SSL=true and leave AUTHENTIK_EMAIL__USE_TLS=false.
|
|
#Plain SMTP without TLS should leave both settings disabled.
|
|
## STARTTLS / explicit TLS, usually on port 587
|
|
#AUTHENTIK_EMAIL__USE_TLS: false
|
|
## Implicit TLS/SSL on the SMTP connection (`USE_SSL` is the variable name), usually on port 465
|
|
#AUTHENTIK_EMAIL__USE_SSL: false
|
|
volumes:
|
|
- /srv/docker/network/authentik/data:/data
|
|
- /srv/docker/network/authentik/custom-templates:/templates
|
|
networks:
|
|
- proxy-net
|
|
labels:
|
|
- homepage.group=Network
|
|
- homepage.name=Authentik
|
|
- homepage.icon=authentik.png
|
|
- homepage.href=${AUTHENTIK_URL}
|
|
- homepage.description= Identity Provider and SSO platform
|
|
- homepage.widget.type=authentik
|
|
- homepage.widget.url=${AUTHENTIK_URL}
|
|
- homepage.widget.key=${AUTHENTIK_API_KEY}
|
|
- homepage.widget.version=2
|
|
- homepage.widget.fields=["users", "loginsLast24H", "failedLoginsLast24H"]
|
|
- dockhand.url=${AUTHENTIK_URL}
|
|
- rackpeek.tags=network
|
|
|
|
##########
|
|
# Worker
|
|
##########
|
|
authentik-worker:
|
|
command: worker
|
|
image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG}
|
|
container_name: authentik-worker
|
|
restart: unless-stopped
|
|
shm_size: 512mb
|
|
user: root
|
|
depends_on:
|
|
authentik-db:
|
|
condition: service_healthy
|
|
environment:
|
|
AUTHENTIK_POSTGRESQL__HOST: authentik-db
|
|
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB}
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
|
|
AUTHENTIK_POSTGRESQL__USER: ${PG_USER}
|
|
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
|
|
volumes:
|
|
#- /var/run/docker.sock:/var/run/docker.sock
|
|
- /srv/docker/network/authentik/data:/data
|
|
- /srv/docker/network/authentik/certs:/certs
|
|
- /srv/docker/network/authentik/custom-templates:/templates
|
|
labels:
|
|
rackpeek.name: authentik-worker
|
|
rackpeek.tags: services
|
|
networks:
|
|
- socket-net
|
|
|
|
networks:
|
|
socket-net:
|
|
external: true
|
|
proxy-net:
|
|
external: true
|
|
|