# authentik stack — Authentik server + worker + dedicated Postgres and Redis.
#
# Volume -> bind-mount conversions (both low density -> SSD):
#   db    data -> /config/authentik/postgres
#   redis data -> /config/authentik/redis
# Only the server joins edge (auth.ginnoir.com); worker/db/redis stay private.

services:
  authentik-server:
    container_name: authentik_server
    image: ghcr.io/goauthentik/server:2024.12.3
    restart: unless-stopped
    command: server
    networks: [authentik, edge]
    env_file:
      - stack.env
    environment:
      AUTHENTIK_HOST: https://auth.ginnoir.com
      AUTHENTIK_REDIS__HOST: authentik-redis
      AUTHENTIK_POSTGRESQL__HOST: authentik-db
      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
    volumes:
      - ./blueprints:/blueprints/custom:ro
    ports:
      - "9200:9000"
    depends_on:
      authentik-db:
        condition: service_healthy
      authentik-redis:
        condition: service_healthy

  authentik-worker:
    container_name: authentik_worker
    image: ghcr.io/goauthentik/server:2024.12.3
    restart: unless-stopped
    command: worker
    networks: [authentik]
    env_file:
      - stack.env
    environment:
      AUTHENTIK_REDIS__HOST: authentik-redis
      AUTHENTIK_POSTGRESQL__HOST: authentik-db
      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
    depends_on:
      authentik-db:
        condition: service_healthy
      authentik-redis:
        condition: service_healthy

  authentik-db:
    container_name: postgres_authentik
    image: postgres:16-alpine
    restart: unless-stopped
    labels:
      - "com.centurylabs.watchtower.enable=false"
    networks: [authentik]
    env_file:
      - stack.env
    volumes:
      - /config/authentik/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U authentik -d authentik"]
      interval: 10s
      timeout: 5s
      retries: 5

  authentik-redis:
    container_name: redis_authentik
    image: redis:7-alpine
    restart: unless-stopped
    labels:
      - "com.centurylabs.watchtower.enable=false"
    networks: [authentik]
    command: --save 60 1 --loglevel warning
    volumes:
      - /config/authentik/redis:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

networks:
  authentik:
    name: authentik
    driver: bridge
  edge:
    name: edge
    external: true