199 lines
8.4 KiB
YAML
199 lines
8.4 KiB
YAML
# Self-hosted Authentik IdP stack pinned at 2026.2.3 (see UPSTREAM.md).
|
|
#
|
|
# Four services on an internal `authentik-net` network, with the `server`
|
|
# service additionally attached to the Coolify-managed `coolify` external
|
|
# network so Traefik can route inbound HTTPS to it (see traefik.labels.yml
|
|
# for the Traefik label-set — those labels are applied at the operator's
|
|
# Coolify-service level rather than inline here, so this file stays portable
|
|
# between staging and any future dedicated-host deployment).
|
|
#
|
|
# Postgres + Redis are strictly Authentik-internal — never share with the
|
|
# boilerplate app's databases. No `ports:` mappings anywhere; ingress is
|
|
# Traefik-only.
|
|
#
|
|
# Volume convention: named volumes are managed by Docker; on staging Coolify
|
|
# binds them under /var/lib/docker/volumes/authentik_*. The backup container
|
|
# (see infra/authentik/backup/) reads from the same network.
|
|
|
|
version: "3.8"
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# Networks
|
|
# ----------------------------------------------------------------------------
|
|
networks:
|
|
authentik-net:
|
|
name: authentik-net
|
|
driver: bridge
|
|
coolify:
|
|
external: true
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# Volumes
|
|
# ----------------------------------------------------------------------------
|
|
volumes:
|
|
authentik-pg-data:
|
|
name: authentik-pg-data
|
|
authentik-redis-data:
|
|
name: authentik-redis-data
|
|
authentik-media:
|
|
name: authentik-media
|
|
authentik-certs:
|
|
name: authentik-certs
|
|
authentik-templates:
|
|
name: authentik-templates
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# Services
|
|
# ----------------------------------------------------------------------------
|
|
services:
|
|
# --- Postgres 16 ---------------------------------------------------------
|
|
postgresql:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
networks:
|
|
- authentik-net
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${AUTHENTIK_POSTGRESQL__USER:-authentik} -d ${AUTHENTIK_POSTGRESQL__NAME:-authentik}"]
|
|
start_period: 20s
|
|
interval: 30s
|
|
retries: 5
|
|
timeout: 5s
|
|
volumes:
|
|
- authentik-pg-data:/var/lib/postgresql/data
|
|
environment:
|
|
POSTGRES_USER: ${AUTHENTIK_POSTGRESQL__USER:-authentik}
|
|
POSTGRES_PASSWORD: ${AUTHENTIK_POSTGRESQL__PASSWORD:?must be set in .env}
|
|
POSTGRES_DB: ${AUTHENTIK_POSTGRESQL__NAME:-authentik}
|
|
|
|
# --- Redis 7 -------------------------------------------------------------
|
|
redis:
|
|
image: redis:7-alpine
|
|
command: --save 60 1 --loglevel warning
|
|
restart: unless-stopped
|
|
networks:
|
|
- authentik-net
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
|
|
start_period: 10s
|
|
interval: 30s
|
|
retries: 5
|
|
timeout: 3s
|
|
volumes:
|
|
- authentik-redis-data:/data
|
|
|
|
# --- Authentik server (web/api/HTTP) ------------------------------------
|
|
server:
|
|
image: ghcr.io/goauthentik/server:2026.2.3
|
|
restart: unless-stopped
|
|
command: server
|
|
networks:
|
|
- authentik-net
|
|
- coolify
|
|
healthcheck:
|
|
# Authentik exposes /-/health/live/ + /-/health/ready/ on port 9000.
|
|
# We use `wget` (image ships busybox-wget); fallback to curl if wget is
|
|
# missing in a future image.
|
|
test:
|
|
- "CMD-SHELL"
|
|
- "wget -qO- http://localhost:9000/-/health/live/ >/dev/null 2>&1 || curl -fsS http://localhost:9000/-/health/live/ >/dev/null 2>&1 || exit 1"
|
|
start_period: 60s
|
|
interval: 30s
|
|
retries: 5
|
|
timeout: 10s
|
|
environment:
|
|
AUTHENTIK_REDIS__HOST: redis
|
|
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
|
AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_POSTGRESQL__USER:-authentik}
|
|
AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_POSTGRESQL__NAME:-authentik}
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_POSTGRESQL__PASSWORD:?must be set in .env}
|
|
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?must be set in .env}
|
|
AUTHENTIK_ERROR_REPORTING__ENABLED: ${AUTHENTIK_ERROR_REPORTING__ENABLED:-false}
|
|
AUTHENTIK_LOG_LEVEL: ${AUTHENTIK_LOG_LEVEL:-info}
|
|
AUTHENTIK_DISABLE_UPDATE_CHECK: ${AUTHENTIK_DISABLE_UPDATE_CHECK:-true}
|
|
AUTHENTIK_DISABLE_STARTUP_ANALYTICS: ${AUTHENTIK_DISABLE_STARTUP_ANALYTICS:-true}
|
|
AUTHENTIK_BOOTSTRAP_PASSWORD: ${AUTHENTIK_BOOTSTRAP_PASSWORD:-}
|
|
AUTHENTIK_BOOTSTRAP_EMAIL: ${AUTHENTIK_BOOTSTRAP_EMAIL:-}
|
|
AUTHENTIK_BOOTSTRAP_TOKEN: ${AUTHENTIK_BOOTSTRAP_TOKEN:-}
|
|
AUTHENTIK_COOKIE_DOMAIN: ${AUTHENTIK_COOKIE_DOMAIN:-}
|
|
# Internal SSL OFF — TLS is terminated by Traefik in front.
|
|
AUTHENTIK_LISTEN__HTTP: 0.0.0.0:9000
|
|
AUTHENTIK_LISTEN__HTTPS: 0.0.0.0:9443
|
|
# Optional Sentry integration (Phase 02 #29 DSN goes here).
|
|
AUTHENTIK_SENTRY__DSN: ${AUTHENTIK_SENTRY__DSN:-}
|
|
AUTHENTIK_SENTRY__ENVIRONMENT: ${AUTHENTIK_SENTRY__ENVIRONMENT:-staging}
|
|
# Optional SMTP for recovery mails.
|
|
AUTHENTIK_EMAIL__HOST: ${AUTHENTIK_EMAIL__HOST:-}
|
|
AUTHENTIK_EMAIL__PORT: ${AUTHENTIK_EMAIL__PORT:-587}
|
|
AUTHENTIK_EMAIL__USERNAME: ${AUTHENTIK_EMAIL__USERNAME:-}
|
|
AUTHENTIK_EMAIL__PASSWORD: ${AUTHENTIK_EMAIL__PASSWORD:-}
|
|
AUTHENTIK_EMAIL__USE_TLS: ${AUTHENTIK_EMAIL__USE_TLS:-true}
|
|
AUTHENTIK_EMAIL__USE_SSL: ${AUTHENTIK_EMAIL__USE_SSL:-false}
|
|
AUTHENTIK_EMAIL__TIMEOUT: ${AUTHENTIK_EMAIL__TIMEOUT:-10}
|
|
AUTHENTIK_EMAIL__FROM: ${AUTHENTIK_EMAIL__FROM:-authentik@boiler.saas-ctrl.com}
|
|
volumes:
|
|
- authentik-media:/media
|
|
- authentik-certs:/certs
|
|
- authentik-templates:/templates
|
|
# Blueprints baked into the image are loaded automatically. Operator
|
|
# mounts the project blueprints over the default path during bootstrap
|
|
# (see infra/authentik/bootstrap/bootstrap.sh).
|
|
- ./bootstrap/blueprints:/blueprints/toolctrl:ro
|
|
depends_on:
|
|
postgresql:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
# NO `ports:` — Traefik routes inbound on the `coolify` network.
|
|
|
|
# --- Authentik worker (background jobs, blueprint apply, email) ---------
|
|
worker:
|
|
image: ghcr.io/goauthentik/server:2026.2.3
|
|
restart: unless-stopped
|
|
command: worker
|
|
networks:
|
|
- authentik-net
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "ak healthcheck"]
|
|
start_period: 60s
|
|
interval: 30s
|
|
retries: 5
|
|
timeout: 30s
|
|
# Worker needs the docker socket only if you intend to manage Outposts
|
|
# via Docker. We don't ship Outposts in this phase, so the socket is
|
|
# intentionally NOT mounted. If a future phase enables Outposts, mount
|
|
# /var/run/docker.sock:/var/run/docker.sock:ro then.
|
|
environment:
|
|
AUTHENTIK_REDIS__HOST: redis
|
|
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
|
AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_POSTGRESQL__USER:-authentik}
|
|
AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_POSTGRESQL__NAME:-authentik}
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_POSTGRESQL__PASSWORD:?must be set in .env}
|
|
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?must be set in .env}
|
|
AUTHENTIK_ERROR_REPORTING__ENABLED: ${AUTHENTIK_ERROR_REPORTING__ENABLED:-false}
|
|
AUTHENTIK_LOG_LEVEL: ${AUTHENTIK_LOG_LEVEL:-info}
|
|
AUTHENTIK_DISABLE_UPDATE_CHECK: ${AUTHENTIK_DISABLE_UPDATE_CHECK:-true}
|
|
AUTHENTIK_DISABLE_STARTUP_ANALYTICS: ${AUTHENTIK_DISABLE_STARTUP_ANALYTICS:-true}
|
|
AUTHENTIK_BOOTSTRAP_PASSWORD: ${AUTHENTIK_BOOTSTRAP_PASSWORD:-}
|
|
AUTHENTIK_BOOTSTRAP_EMAIL: ${AUTHENTIK_BOOTSTRAP_EMAIL:-}
|
|
AUTHENTIK_BOOTSTRAP_TOKEN: ${AUTHENTIK_BOOTSTRAP_TOKEN:-}
|
|
AUTHENTIK_SENTRY__DSN: ${AUTHENTIK_SENTRY__DSN:-}
|
|
AUTHENTIK_SENTRY__ENVIRONMENT: ${AUTHENTIK_SENTRY__ENVIRONMENT:-staging}
|
|
AUTHENTIK_EMAIL__HOST: ${AUTHENTIK_EMAIL__HOST:-}
|
|
AUTHENTIK_EMAIL__PORT: ${AUTHENTIK_EMAIL__PORT:-587}
|
|
AUTHENTIK_EMAIL__USERNAME: ${AUTHENTIK_EMAIL__USERNAME:-}
|
|
AUTHENTIK_EMAIL__PASSWORD: ${AUTHENTIK_EMAIL__PASSWORD:-}
|
|
AUTHENTIK_EMAIL__USE_TLS: ${AUTHENTIK_EMAIL__USE_TLS:-true}
|
|
AUTHENTIK_EMAIL__USE_SSL: ${AUTHENTIK_EMAIL__USE_SSL:-false}
|
|
AUTHENTIK_EMAIL__TIMEOUT: ${AUTHENTIK_EMAIL__TIMEOUT:-10}
|
|
AUTHENTIK_EMAIL__FROM: ${AUTHENTIK_EMAIL__FROM:-authentik@boiler.saas-ctrl.com}
|
|
volumes:
|
|
- authentik-media:/media
|
|
- authentik-certs:/certs
|
|
- authentik-templates:/templates
|
|
- ./bootstrap/blueprints:/blueprints/toolctrl:ro
|
|
depends_on:
|
|
postgresql:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|