# Authentik Identity & SSO Stack
services:
  postgresql:
    image: docker.io/library/postgres:16-alpine
    container_name: authentik-db
    restart: unless-stopped
    environment:
      - POSTGRES_DB=${PG_DB:-authentik}
      - POSTGRES_USER=${PG_USER:-authentik}
      - POSTGRES_PASSWORD=${PG_PASS}
      - TZ=${TZ}
    volumes:
      - ${DATA_PATH}/database:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s
    networks:
      - authentik

  server:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.6}
    container_name: authentik-server
    restart: unless-stopped
    command: server
    environment:
      - AUTHENTIK_POSTGRESQL__HOST=postgresql
      - AUTHENTIK_POSTGRESQL__NAME=${PG_DB:-authentik}
      - AUTHENTIK_POSTGRESQL__USER=${PG_USER:-authentik}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${PG_PASS}
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
      - TZ=${TZ}
    volumes:
      - ${DATA_PATH}/data:/data
      - ${DATA_PATH}/custom-templates:/templates
    ports:
      - "${COMPOSE_PORT_HTTP}:9000"
      - "${COMPOSE_PORT_HTTPS}:9443"
    shm_size: 512mb
    depends_on:
      postgresql:
        condition: service_healthy
    networks:
      - authentik
      - main

  worker:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.6}
    container_name: authentik-worker
    restart: unless-stopped
    command: worker
    user: root
    environment:
      - AUTHENTIK_POSTGRESQL__HOST=postgresql
      - AUTHENTIK_POSTGRESQL__NAME=${PG_DB:-authentik}
      - AUTHENTIK_POSTGRESQL__USER=${PG_USER:-authentik}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${PG_PASS}
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
      - TZ=${TZ}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${DATA_PATH}/data:/data
      - ${DATA_PATH}/certs:/certs
      - ${DATA_PATH}/custom-templates:/templates
    shm_size: 512mb
    depends_on:
      postgresql:
        condition: service_healthy
    networks:
      - authentik
      - main

networks:
  main:
    external: true
  authentik:
    external: true