116 lines
5.9 KiB
Bash
116 lines
5.9 KiB
Bash
# infra/authentik/.env.example
|
|
#
|
|
# Copy to `.env` and fill before deploying via Coolify. Never commit the real
|
|
# .env — it is git-ignored (see .gitignore). Use Coolify's secret vault to
|
|
# manage production values; this file is only the template.
|
|
#
|
|
# Generate the secrets ONCE with the commands listed inline. Losing
|
|
# AUTHENTIK_SECRET_KEY destroys the encrypted-fields + active sessions of
|
|
# the entire instance — back it up to an offline password vault.
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Authentik image pin (mirrors UPSTREAM.md)
|
|
# -----------------------------------------------------------------------------
|
|
AUTHENTIK_TAG=2026.2.3
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Public URL — must match the Traefik-routed hostname (see traefik.labels.yml)
|
|
# -----------------------------------------------------------------------------
|
|
AUTHENTIK_BASE_URL=https://auth.boiler.saas-ctrl.com
|
|
# Optional: cookie domain for cross-subdomain SSO (only set if you have
|
|
# multiple boiler.saas-ctrl.com subdomains that should share the IdP cookie).
|
|
AUTHENTIK_COOKIE_DOMAIN=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Authentik secret key — THE MOST IMPORTANT SECRET
|
|
# -----------------------------------------------------------------------------
|
|
# Generate ONCE with: openssl rand -base64 60
|
|
# Losing this key invalidates all session cookies AND makes encrypted fields
|
|
# (OIDC provider client_secrets, password-stage encrypted user data, etc.)
|
|
# unreadable. Store it in Coolify-Vault AND in an offline password vault
|
|
# (1Password / Bitwarden / Yubikey). Cannot be rotated without full reinstall.
|
|
AUTHENTIK_SECRET_KEY=replace-me-with-60-bytes-of-base64-entropy
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Postgres (Authentik-internal, NOT shared with the boilerplate app)
|
|
# -----------------------------------------------------------------------------
|
|
AUTHENTIK_POSTGRESQL__USER=authentik
|
|
AUTHENTIK_POSTGRESQL__NAME=authentik
|
|
# Generate with: openssl rand -base64 32
|
|
AUTHENTIK_POSTGRESQL__PASSWORD=replace-me-strong-postgres-password
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Initial admin bootstrap — forced password change on first login
|
|
# -----------------------------------------------------------------------------
|
|
AUTHENTIK_BOOTSTRAP_EMAIL=ops@example.com
|
|
# Generate with: openssl rand -base64 24
|
|
# Operator MUST change this on first login via the Authentik UI.
|
|
AUTHENTIK_BOOTSTRAP_PASSWORD=replace-me-strong-bootstrap-password
|
|
# API-token for bootstrap-time blueprint loading. Generate with:
|
|
# openssl rand -hex 32
|
|
# After bootstrap.sh succeeds, rotate or delete this token via the Authentik
|
|
# admin UI (Directory → Tokens). It grants full admin-API access.
|
|
AUTHENTIK_BOOTSTRAP_TOKEN=replace-me-64-hex-chars
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Telemetry / privacy
|
|
# -----------------------------------------------------------------------------
|
|
# Disable error-reporting to goauthentik.io — we already have our own Sentry
|
|
# (see AUTHENTIK_SENTRY__DSN below) and don't want to leak prod-stack info to
|
|
# upstream.
|
|
AUTHENTIK_ERROR_REPORTING__ENABLED=false
|
|
AUTHENTIK_DISABLE_UPDATE_CHECK=true
|
|
AUTHENTIK_DISABLE_STARTUP_ANALYTICS=true
|
|
AUTHENTIK_LOG_LEVEL=info
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Sentry self-hosted DSN (Phase 02 #29). Optional — leave blank to disable.
|
|
# DSN format: https://<key>@sentry.boiler.saas-ctrl.com/<project-id>
|
|
# Create a "boilerplate-authentik" project in the Sentry UI and paste its DSN.
|
|
# -----------------------------------------------------------------------------
|
|
AUTHENTIK_SENTRY__DSN=
|
|
AUTHENTIK_SENTRY__ENVIRONMENT=staging
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Email — required for password recovery / email-stage flows
|
|
# Leave HOST blank to disable email features; the bootstrap admin can still
|
|
# log in via the bootstrap password.
|
|
# -----------------------------------------------------------------------------
|
|
AUTHENTIK_EMAIL__HOST=
|
|
AUTHENTIK_EMAIL__PORT=587
|
|
AUTHENTIK_EMAIL__USERNAME=
|
|
AUTHENTIK_EMAIL__PASSWORD=
|
|
AUTHENTIK_EMAIL__USE_TLS=true
|
|
AUTHENTIK_EMAIL__USE_SSL=false
|
|
AUTHENTIK_EMAIL__TIMEOUT=10
|
|
AUTHENTIK_EMAIL__FROM=authentik@boiler.saas-ctrl.com
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# OIDC client secret for the Toolctrl admin-panel provider
|
|
# (loaded by bootstrap/blueprints/03-application-toolctrl-admin.yaml)
|
|
# Generate with: openssl rand -hex 32
|
|
# After bootstrap, copy this secret into the admin-panel app's .env as
|
|
# AUTHENTIK_OIDC_CLIENT_SECRET (consumed in Phase 09 #82).
|
|
# -----------------------------------------------------------------------------
|
|
TOOLCTRL_ADMIN_OIDC_CLIENT_ID=toolctrl-admin-panel
|
|
TOOLCTRL_ADMIN_OIDC_CLIENT_SECRET=replace-me-64-hex-chars
|
|
TOOLCTRL_ADMIN_OIDC_REDIRECT_URI=https://admin.boiler.saas-ctrl.com/auth/callback
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# S3 backup target (consumed by infra/authentik/backup/)
|
|
# Endpoint format examples:
|
|
# Hetzner: https://nbg1.your-objectstorage.com
|
|
# AWS: https://s3.eu-central-1.amazonaws.com
|
|
# MinIO local: https://minio.boiler.saas-ctrl.com
|
|
# -----------------------------------------------------------------------------
|
|
AUTHENTIK_S3_BACKUP_ENDPOINT=https://nbg1.your-objectstorage.com
|
|
AUTHENTIK_S3_BACKUP_BUCKET=boilerplate-authentik-backups
|
|
AUTHENTIK_S3_BACKUP_ACCESS_KEY=replace-me
|
|
AUTHENTIK_S3_BACKUP_SECRET_KEY=replace-me
|
|
|
|
# Optional: GPG recipient fingerprint to encrypt the backups with before
|
|
# upload. If left empty, backup.sh falls back to AES256-symmetric with
|
|
# AUTHENTIK_SECRET_KEY as passphrase (better than plaintext, but rotate
|
|
# carefully — losing the key destroys the backup readability).
|
|
AUTHENTIK_BACKUP_GPG_RECIPIENT=
|