Initial commit

2025-10-22 19:59:09 +00:00
commit 67996ade86
34 changed files with 905 additions and 0 deletions
--- a/mgmt/authentik/.env.example
+++ b/mgmt/authentik/.env.example
@@ -0,0 +1,31 @@
+DOMAIN_NAME=
+SUBDOMAIN=
+
+# Authentik Configuration
+AUTHENTIK_SECRET_KEY=file:///run/secrets/SECRET_KEY
+AUTHENTIK_TAG=
+
+# PostgreSQL Configuration
+PG_HOST=postgres
+PG_PORT=5432
+PG_USER=
+PG_PASS=file:///run/secrets/DB_PASS
+PG_DB=
+
+# Redis Configuration
+REDIS_HOST=redis
+REDIS_PORT=6379
+
+# Optional: Custom ports
+COMPOSE_PORT_HTTP=9000
+COMPOSE_PORT_HTTPS=9443
+
+# Environment Variables for Docker Compose
+AUTHENTIK_REDIS__HOST=$REDIS_HOST
+AUTHENTIK_REDIS__PORT=$REDIS_PORT
+AUTHENTIK_POSTGRESQL__HOST=$PG_HOST
+AUTHENTIK_POSTGRESQL__PORT=$PG_PORT
+AUTHENTIK_POSTGRESQL__USER=$PG_USER
+AUTHENTIK_POSTGRESQL__NAME=$PG_DB
+AUTHENTIK_POSTGRESQL__PASSWORD=$PG_PASS
+AUTHENTIK_HOST_BROWSER="https://$SUBDOMAIN.$DOMAIN_NAME"
--- a/mgmt/authentik/compose.yml
+++ b/mgmt/authentik/compose.yml
@@ -0,0 +1,83 @@
+services:
+  server:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG}
+    restart: unless-stopped
+    command: server
+    env_file:
+      - .env
+    secrets:
+      - SECRET_KEY
+      - DB_PASS
+    volumes:
+      - ./media:/media
+      - ./custom-templates:/templates
+    networks:
+      - webapp
+      - db
+    # ports:
+    #   - "${COMPOSE_PORT_HTTP:-9000}:9000"
+    #   - "${COMPOSE_PORT_HTTPS:-9443}:9443"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.$SUBDOMAIN.rule=Host(`${SUBDOMAIN}.${DOMAIN_NAME}`)
+      - traefik.http.routers.$SUBDOMAIN.tls=true
+      - traefik.http.routers.$SUBDOMAIN.entrypoints=web,websecure
+      - traefik.http.routers.$SUBDOMAIN.tls.certresolver=cloudflare
+      - traefik.http.middlewares.$SUBDOMAIN.headers.SSLRedirect=true
+      - traefik.http.middlewares.$SUBDOMAIN.headers.STSSeconds=315360000
+      - traefik.http.middlewares.$SUBDOMAIN.headers.browserXSSFilter=true
+      - traefik.http.middlewares.$SUBDOMAIN.headers.contentTypeNosniff=true
+      - traefik.http.middlewares.$SUBDOMAIN.headers.forceSTSHeader=true
+      - traefik.http.middlewares.$SUBDOMAIN.headers.SSLHost=${DOMAIN_NAME}
+      - traefik.http.middlewares.$SUBDOMAIN.headers.STSIncludeSubdomains=true
+      - traefik.http.middlewares.$SUBDOMAIN.headers.STSPreload=true
+      - traefik.http.middlewares.$SUBDOMAIN.headers.frameDeny=true
+      # - traefik.http.routers.$SUBDOMAIN.middlewares=$SUBDOMAIN@docker
+      - traefik.http.routers.$SUBDOMAIN.service=$SUBDOMAIN
+      - traefik.http.services.$SUBDOMAIN.loadbalancer.server.port=9000
+      - traefik.docker.network=webapp
+      - "traefik.http.routers.authentik-output-rtr.rule=HostRegexp(`{subdomain:[a-z0-9-]+}.${DOMAIN_NAME}`) && PathPrefix(`/outpost.goauthentik.io/`)"
+
+      # ForwardAuth middleware definition
+      - "traefik.http.middlewares.authentik-forwardauth.forwardauth.address=http://authentik-server-1:9000/outpost.goauthentik.io/auth/traefik"
+      - "traefik.http.middlewares.authentik-forwardauth.forwardauth.trustForwardHeader=true"
+      - "traefik.http.middlewares.authentik-forwardauth.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version"
+      # Outpost router for /outpost.goauthentik.io paths
+      - "traefik.http.routers.$SUBDOMAIN-outpost.rule=Host(`authentik.jojops.com`) && PathPrefix(`/outpost.goauthentik.io/`)"
+      # - "traefik.http.routers.authentik-outpost.entrypoints=websecure"
+      # - "traefik.http.routers.authentik-outpost.tls=true"
+      - traefik.http.routers.$SUBDOMAIN.priority=15
+      # - "traefik.http.routers.authentik-outpost.service=authentik-svc"
+      - "traefik.http.routers.authentik-outpost.rule=HostRegexp(`{$SUBDOMAIN:[a-z0-9-]+}.$DOMAIN_NAME`) && PathPrefix(`/outpost.goauthentik.io/`)"
+      - "traefik.http.routers.authentik-outpost.entrypoints=websecure"
+      - "traefik.http.routers.authentik-outpost.tls=true"
+      - "traefik.http.routers.authentik-outpost.priority=15"
+      - "traefik.http.routers.authentik-outpost.service=authentik"
+
+  worker:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG}
+    restart: unless-stopped
+    command: worker
+    env_file:
+      - .env
+    secrets:
+      - SECRET_KEY
+      - DB_PASS
+    user: root
+    networks:
+      - db
+    volumes:
+      # - /var/run/docker.sock:/var/run/docker.sock
+      - ./media:/media
+      - ./certs:/certs
+      - ./custom-templates:/templates
+networks:
+  webapp:
+    external: true
+  db:
+    external: true
+secrets:
+  SECRET_KEY:
+    file: .secrets/SECRET_KEY
+  DB_PASS:
+    file: .secrets/DB_PASS