migrate
This commit is contained in:
Mike McFetridge
@@ -0,0 +1,10 @@
|
||||
AUTHENTIK_SECRET_KEY='<< authentik_secret_key >>'
|
||||
DATABASE_USER='<< database_user >>'
|
||||
DATABASE_PASSWORD='<< database_password >>'
|
||||
<%- if email_enabled %>
|
||||
EMAIL_USERNAME='<< email_username >>'
|
||||
EMAIL_PASSWORD='<< email_password >>'
|
||||
<%- endif %>
|
||||
<%- if authentik_admin_password %>
|
||||
AUTHENTIK_BOOTSTRAP_PASSWORD='<< authentik_admin_password >>'
|
||||
<%- endif %>
|
||||
@@ -0,0 +1,210 @@
|
||||
---
|
||||
services:
|
||||
<< service_name >>:
|
||||
image: ghcr.io/goauthentik/server:2026.2.2
|
||||
restart: << restart_policy >>
|
||||
command: server
|
||||
environment:
|
||||
- AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
|
||||
- AUTHENTIK_ERROR_REPORTING__ENABLED=<< authentik_error_reporting | lower >>
|
||||
<%- if database_external %>
|
||||
- AUTHENTIK_POSTGRESQL__HOST=<< database_host >>
|
||||
- AUTHENTIK_POSTGRESQL__PORT=<< database_port >>
|
||||
<%- else %>
|
||||
- AUTHENTIK_POSTGRESQL__HOST=<< service_name >>_postgres
|
||||
- AUTHENTIK_POSTGRESQL__PORT=5432
|
||||
<%- endif %>
|
||||
- AUTHENTIK_POSTGRESQL__USER=${DATABASE_USER}
|
||||
- AUTHENTIK_POSTGRESQL__NAME=<< database_name >>
|
||||
- AUTHENTIK_POSTGRESQL__PASSWORD=${DATABASE_PASSWORD}
|
||||
<%- if email_enabled %>
|
||||
- AUTHENTIK_EMAIL__HOST=<< email_host >>
|
||||
- AUTHENTIK_EMAIL__PORT=<< email_port >>
|
||||
- AUTHENTIK_EMAIL__FROM=<< email_from >>
|
||||
- AUTHENTIK_EMAIL__USERNAME=${EMAIL_USERNAME}
|
||||
- AUTHENTIK_EMAIL__PASSWORD=${EMAIL_PASSWORD}
|
||||
<%- if email_encryption == "ssl" %>
|
||||
- AUTHENTIK_EMAIL__USE_SSL=True
|
||||
<%- elif email_encryption == "starttls" %>
|
||||
- AUTHENTIK_EMAIL__USE_TLS=True
|
||||
<%- endif %>
|
||||
<%- endif %>
|
||||
networks:
|
||||
<%- if traefik_enabled %>
|
||||
- << traefik_network >>
|
||||
<%- endif %>
|
||||
- << service_name >>_backend
|
||||
<%- if not traefik_enabled %>
|
||||
ports:
|
||||
- "<< ports_http >>:9000"
|
||||
- "<< ports_https >>:9443"
|
||||
<%- endif %>
|
||||
volumes:
|
||||
<%- if volume_mode == 'mount' %>
|
||||
- << volume_mount_path >>/data:/data
|
||||
- << volume_mount_path >>/templates:/templates
|
||||
<%- elif volume_mode == 'local' or volume_mode == 'nfs' %>
|
||||
- << service_name >>_data:/data
|
||||
- << service_name >>_templates:/templates
|
||||
<%- endif %>
|
||||
<%- if traefik_enabled %>
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=<< traefik_network >>
|
||||
- traefik.http.services.<< service_name >>_web.loadBalancer.server.port=9000
|
||||
- traefik.http.routers.<< service_name >>_http.service=<< service_name >>_web
|
||||
- traefik.http.routers.<< service_name >>_http.rule=Host(`<< traefik_host >>.<< traefik_domain >>`)
|
||||
- traefik.http.routers.<< service_name >>_http.entrypoints=<< traefik_entrypoint >>
|
||||
- "traefik.http.middlewares.authentik.forwardauth.address=\
|
||||
http://<< service_name >>:9000/outpost.goauthentik.io/auth/traefik"
|
||||
- "traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true"
|
||||
- "traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=\
|
||||
X-authentik-username,\
|
||||
X-authentik-groups,\
|
||||
X-authentik-entitlements,\
|
||||
X-authentik-email,\
|
||||
X-authentik-name,\
|
||||
X-authentik-uid,\
|
||||
X-authentik-jwt,\
|
||||
X-authentik-meta-jwks,\
|
||||
X-authentik-meta-outpost,\
|
||||
X-authentik-meta-provider,\
|
||||
X-authentik-meta-app,\
|
||||
X-authentik-meta-version"
|
||||
<%- if traefik_tls_enabled %>
|
||||
- traefik.http.routers.<< service_name >>_https.service=<< service_name >>_web
|
||||
- traefik.http.routers.<< service_name >>_https.rule=Host(`<< traefik_host >>.<< traefik_domain >>`)
|
||||
- traefik.http.routers.<< service_name >>_https.entrypoints=<< traefik_tls_entrypoint >>
|
||||
- traefik.http.routers.<< service_name >>_https.tls=true
|
||||
- traefik.http.routers.<< service_name >>_https.tls.certresolver=<< traefik_tls_certresolver >>
|
||||
<%- endif %>
|
||||
<%- endif %>
|
||||
<%- if not database_external %>
|
||||
depends_on:
|
||||
- << service_name >>_postgres
|
||||
<%- endif %>
|
||||
|
||||
<< service_name >>_worker:
|
||||
image: ghcr.io/goauthentik/server:2026.2.2
|
||||
restart: << restart_policy >>
|
||||
command: worker
|
||||
environment:
|
||||
- AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
|
||||
- AUTHENTIK_ERROR_REPORTING__ENABLED=<< authentik_error_reporting | lower >>
|
||||
<%- if database_external %>
|
||||
- AUTHENTIK_POSTGRESQL__HOST=<< database_host >>
|
||||
- AUTHENTIK_POSTGRESQL__PORT=<< database_port >>
|
||||
<%- else %>
|
||||
- AUTHENTIK_POSTGRESQL__HOST=<< service_name >>_postgres
|
||||
- AUTHENTIK_POSTGRESQL__PORT=5432
|
||||
<%- endif %>
|
||||
- AUTHENTIK_POSTGRESQL__USER=${DATABASE_USER}
|
||||
- AUTHENTIK_POSTGRESQL__NAME=<< database_name >>
|
||||
- AUTHENTIK_POSTGRESQL__PASSWORD=${DATABASE_PASSWORD}
|
||||
<%- if email_enabled %>
|
||||
- AUTHENTIK_EMAIL__HOST=<< email_host >>
|
||||
- AUTHENTIK_EMAIL__PORT=<< email_port >>
|
||||
- AUTHENTIK_EMAIL__FROM=<< email_from >>
|
||||
- AUTHENTIK_EMAIL__USERNAME=${EMAIL_USERNAME}
|
||||
- AUTHENTIK_EMAIL__PASSWORD=${EMAIL_PASSWORD}
|
||||
<%- if email_encryption == "ssl" %>
|
||||
- AUTHENTIK_EMAIL__USE_SSL=True
|
||||
<%- elif email_encryption == "starttls" %>
|
||||
- AUTHENTIK_EMAIL__USE_TLS=True
|
||||
<%- endif %>
|
||||
<%- endif %>
|
||||
<%- if authentik_admin_password %>
|
||||
- AUTHENTIK_BOOTSTRAP_PASSWORD=${AUTHENTIK_BOOTSTRAP_PASSWORD}
|
||||
<%- endif %>
|
||||
user: root
|
||||
networks:
|
||||
- << service_name >>_backend
|
||||
volumes:
|
||||
- /run/docker.sock:/run/docker.sock
|
||||
<%- if volume_mode == 'mount' %>
|
||||
- << volume_mount_path >>/data:/data
|
||||
- << volume_mount_path >>/certs:/certs
|
||||
- << volume_mount_path >>/templates:/templates
|
||||
<%- elif volume_mode == 'local' or volume_mode == 'nfs' %>
|
||||
- << service_name >>_data:/data
|
||||
- << service_name >>_certs:/certs
|
||||
- << service_name >>_templates:/templates
|
||||
<%- endif %>
|
||||
<%- if not database_external %>
|
||||
depends_on:
|
||||
- << service_name >>_postgres
|
||||
<%- endif %>
|
||||
|
||||
<%- if not database_external %>
|
||||
<< service_name >>_postgres:
|
||||
image: docker.io/library/postgres:17.9
|
||||
restart: << restart_policy >>
|
||||
environment:
|
||||
- POSTGRES_USER=${DATABASE_USER}
|
||||
- POSTGRES_PASSWORD=${DATABASE_PASSWORD}
|
||||
- POSTGRES_DB=<< database_name >>
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U << database_user >>"]
|
||||
start_period: 30s
|
||||
interval: 10s
|
||||
timeout: 10s
|
||||
retries: 5
|
||||
networks:
|
||||
- << service_name >>_backend
|
||||
volumes:
|
||||
<%- if volume_mode == 'mount' %>
|
||||
- << volume_mount_path >>/postgres:/var/lib/postgresql/data
|
||||
<%- elif volume_mode == 'local' or volume_mode == 'nfs' %>
|
||||
- << service_name >>_postgres:/var/lib/postgresql/data
|
||||
<%- endif %>
|
||||
<%- endif %>
|
||||
|
||||
networks:
|
||||
<< service_name >>_backend:
|
||||
driver: bridge
|
||||
<%- if traefik_enabled %>
|
||||
<< traefik_network >>:
|
||||
external: true
|
||||
<%- endif %>
|
||||
|
||||
<%- if volume_mode == 'local' %>
|
||||
volumes:
|
||||
<%- if not database_external %>
|
||||
<< service_name >>_postgres:
|
||||
driver: local
|
||||
<%- endif %>
|
||||
<< service_name >>_data:
|
||||
driver: local
|
||||
<< service_name >>_certs:
|
||||
driver: local
|
||||
<< service_name >>_templates:
|
||||
driver: local
|
||||
<%- elif volume_mode == 'nfs' %>
|
||||
volumes:
|
||||
<%- if not database_external %>
|
||||
<< service_name >>_postgres:
|
||||
driver: local
|
||||
driver_opts:
|
||||
type: nfs
|
||||
o: addr=<< volume_nfs_server >>,nfsvers=4,<< volume_nfs_options >>
|
||||
device: ":<< volume_nfs_path >>/postgres"
|
||||
<%- endif %>
|
||||
<< service_name >>_data:
|
||||
driver: local
|
||||
driver_opts:
|
||||
type: nfs
|
||||
o: addr=<< volume_nfs_server >>,nfsvers=4,<< volume_nfs_options >>
|
||||
device: ":<< volume_nfs_path >>/data"
|
||||
<< service_name >>_certs:
|
||||
driver: local
|
||||
driver_opts:
|
||||
type: nfs
|
||||
o: addr=<< volume_nfs_server >>,nfsvers=4,<< volume_nfs_options >>
|
||||
device: ":<< volume_nfs_path >>/certs"
|
||||
<< service_name >>_templates:
|
||||
driver: local
|
||||
driver_opts:
|
||||
type: nfs
|
||||
o: addr=<< volume_nfs_server >>,nfsvers=4,<< volume_nfs_options >>
|
||||
device: ":<< volume_nfs_path >>/templates"
|
||||
<%- endif %>
|
||||
@@ -0,0 +1,402 @@
|
||||
{
|
||||
"slug": "authentik-compose",
|
||||
"kind": "compose",
|
||||
"metadata": {
|
||||
"name": "Authentik",
|
||||
"description": "Open-source Identity Provider (IdP) that supports OAuth2, SAML, LDAP, and SCIM for single sign-on and user authentication across your applications.",
|
||||
"tags": [
|
||||
"traefik",
|
||||
"volume"
|
||||
],
|
||||
"icon": {
|
||||
"provider": "selfhst",
|
||||
"id": "authentik",
|
||||
"color": "default"
|
||||
},
|
||||
"draft": false,
|
||||
"version": {
|
||||
"name": "2026.2.2"
|
||||
}
|
||||
},
|
||||
"variables": [
|
||||
{
|
||||
"name": "general",
|
||||
"title": "General",
|
||||
"items": [
|
||||
{
|
||||
"name": "service_name",
|
||||
"type": "str",
|
||||
"title": "Service Name",
|
||||
"required": false,
|
||||
"default": "authentik",
|
||||
"config": {
|
||||
"placeholder": "authentik"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "restart_policy",
|
||||
"type": "enum",
|
||||
"title": "Restart Policy",
|
||||
"required": true,
|
||||
"default": "unless-stopped",
|
||||
"config": {
|
||||
"options": [
|
||||
"unless-stopped",
|
||||
"always",
|
||||
"on-failure",
|
||||
"no"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "database",
|
||||
"title": "Database",
|
||||
"items": [
|
||||
{
|
||||
"name": "database_password",
|
||||
"type": "secret",
|
||||
"title": "Database password",
|
||||
"required": true,
|
||||
"config": {
|
||||
"autogenerated": {}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "database_user",
|
||||
"type": "str",
|
||||
"title": "The database user",
|
||||
"required": false,
|
||||
"default": "authentik",
|
||||
"config": {
|
||||
"placeholder": "authentik"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "database_name",
|
||||
"type": "str",
|
||||
"title": "The database name",
|
||||
"required": false,
|
||||
"default": "authentik",
|
||||
"config": {
|
||||
"placeholder": "authentik"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "database_external",
|
||||
"type": "bool",
|
||||
"title": "External Database",
|
||||
"required": false,
|
||||
"default": false
|
||||
},
|
||||
{
|
||||
"name": "database_host",
|
||||
"type": "str",
|
||||
"title": "External database host",
|
||||
"required": false,
|
||||
"default": "",
|
||||
"needs": [
|
||||
"database_external=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "postgres.home.arpa"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "database_port",
|
||||
"type": "int",
|
||||
"title": "External database port",
|
||||
"required": false,
|
||||
"default": 5432,
|
||||
"config": {
|
||||
"placeholder": "5432"
|
||||
},
|
||||
"needs": [
|
||||
"database_external=true"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "ports",
|
||||
"title": "Ports",
|
||||
"items": [
|
||||
{
|
||||
"name": "ports_http",
|
||||
"type": "str",
|
||||
"title": "HTTP Port",
|
||||
"required": false,
|
||||
"default": 8000,
|
||||
"config": {
|
||||
"placeholder": "8000"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "ports_https",
|
||||
"type": "str",
|
||||
"title": "HTTPS Port",
|
||||
"required": false,
|
||||
"default": 8443,
|
||||
"config": {
|
||||
"placeholder": "8443"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "traefik",
|
||||
"title": "Traefik",
|
||||
"toggle": "traefik_enabled",
|
||||
"items": [
|
||||
{
|
||||
"name": "traefik_enabled",
|
||||
"type": "bool",
|
||||
"title": "Traefik",
|
||||
"required": false,
|
||||
"default": false
|
||||
},
|
||||
{
|
||||
"name": "traefik_host",
|
||||
"type": "str",
|
||||
"title": "Host",
|
||||
"required": true,
|
||||
"config": {
|
||||
"placeholder": "authentik"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "traefik_domain",
|
||||
"type": "str",
|
||||
"title": "Domain",
|
||||
"required": true,
|
||||
"config": {
|
||||
"placeholder": "home.arpa"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "traefik_entrypoint",
|
||||
"type": "str",
|
||||
"title": "Entrypoint",
|
||||
"required": true,
|
||||
"default": "web",
|
||||
"config": {
|
||||
"placeholder": "web"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "traefik_network",
|
||||
"type": "str",
|
||||
"title": "Network",
|
||||
"required": true,
|
||||
"default": "traefik",
|
||||
"config": {
|
||||
"placeholder": "traefik"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "traefik_tls_enabled",
|
||||
"type": "bool",
|
||||
"title": "TLS",
|
||||
"required": false,
|
||||
"default": false
|
||||
},
|
||||
{
|
||||
"name": "traefik_tls_entrypoint",
|
||||
"type": "str",
|
||||
"title": "TLS Entrypoint",
|
||||
"required": true,
|
||||
"default": "websecure",
|
||||
"config": {
|
||||
"placeholder": "websecure"
|
||||
},
|
||||
"needs": [
|
||||
"traefik_tls_enabled=true"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "traefik_tls_certresolver",
|
||||
"type": "str",
|
||||
"title": "Cert Resolver",
|
||||
"required": true,
|
||||
"default": "cloudflare",
|
||||
"config": {
|
||||
"placeholder": "cloudflare"
|
||||
},
|
||||
"needs": [
|
||||
"traefik_tls_enabled=true"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "authentik",
|
||||
"title": "Authentik",
|
||||
"items": [
|
||||
{
|
||||
"name": "authentik_secret_key",
|
||||
"type": "secret",
|
||||
"title": "Secret Key",
|
||||
"required": true,
|
||||
"config": {
|
||||
"autogenerated": {}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "authentik_admin_password",
|
||||
"type": "secret",
|
||||
"title": "Admin Password",
|
||||
"required": false,
|
||||
"config": {
|
||||
"autogenerated": {}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "authentik_error_reporting",
|
||||
"type": "bool",
|
||||
"title": "Error Reporting",
|
||||
"required": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "volume",
|
||||
"title": "Volume",
|
||||
"items": [
|
||||
{
|
||||
"name": "volume_mode",
|
||||
"type": "enum",
|
||||
"title": "Volume Mode",
|
||||
"required": true,
|
||||
"default": "local",
|
||||
"config": {
|
||||
"options": [
|
||||
"local",
|
||||
"mount",
|
||||
"nfs"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "volume_mount_path",
|
||||
"type": "str",
|
||||
"title": "Volume Mount Path",
|
||||
"required": true,
|
||||
"default": "/data",
|
||||
"config": {
|
||||
"placeholder": "/data"
|
||||
},
|
||||
"needs": [
|
||||
"volume_mode=mount"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "volume_nfs_server",
|
||||
"type": "str",
|
||||
"title": "Volume Nfs Server",
|
||||
"required": true,
|
||||
"default": "NFS_SERVER",
|
||||
"config": {
|
||||
"placeholder": "NFS_SERVER"
|
||||
},
|
||||
"needs": [
|
||||
"volume_mode=nfs"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "volume_nfs_path",
|
||||
"type": "str",
|
||||
"title": "Volume Nfs Path",
|
||||
"required": true,
|
||||
"default": "/export",
|
||||
"config": {
|
||||
"placeholder": "/export"
|
||||
},
|
||||
"needs": [
|
||||
"volume_mode=nfs"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "volume_nfs_options",
|
||||
"type": "str",
|
||||
"title": "Volume Nfs Options",
|
||||
"required": true,
|
||||
"default": "rw,nolock,soft",
|
||||
"config": {
|
||||
"placeholder": "rw,nolock,soft"
|
||||
},
|
||||
"needs": [
|
||||
"volume_mode=nfs"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "email",
|
||||
"title": "Email",
|
||||
"toggle": "email_enabled",
|
||||
"items": [
|
||||
{
|
||||
"name": "email_host",
|
||||
"type": "str",
|
||||
"title": "SMTP server hostname",
|
||||
"required": true,
|
||||
"config": {
|
||||
"placeholder": "smtp.home.arpa"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "email_port",
|
||||
"type": "int",
|
||||
"title": "SMTP server port",
|
||||
"required": true,
|
||||
"default": 25,
|
||||
"config": {
|
||||
"placeholder": "25"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "email_username",
|
||||
"type": "str",
|
||||
"title": "SMTP username",
|
||||
"required": true,
|
||||
"config": {
|
||||
"placeholder": "user@example.com"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "email_password",
|
||||
"type": "secret",
|
||||
"title": "SMTP password",
|
||||
"required": true
|
||||
},
|
||||
{
|
||||
"name": "email_from",
|
||||
"type": "str",
|
||||
"title": "From email address",
|
||||
"required": true,
|
||||
"config": {
|
||||
"placeholder": "noreply@example.com"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "email_enabled",
|
||||
"type": "bool",
|
||||
"title": "Email",
|
||||
"required": false,
|
||||
"default": false
|
||||
},
|
||||
{
|
||||
"name": "email_encryption",
|
||||
"type": "str",
|
||||
"title": "Encryption",
|
||||
"required": false,
|
||||
"default": "tls",
|
||||
"config": {
|
||||
"placeholder": "tls"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user