ginnoir
1e2970d220
Portainer git-stack deployments require an explicit env_file reference in the compose file to load variables from the repo's stack.env. Adds env_file: [stack.env] before every service-level environment: block across all 10 stacks.
99 lines
2.9 KiB
YAML
99 lines
2.9 KiB
YAML
# authentik stack — Authentik server + worker + dedicated Postgres and Redis.
|
|
#
|
|
# Volume -> bind-mount conversions (both low density -> SSD):
|
|
# db data -> /config/authentik/postgres
|
|
# redis data -> /config/authentik/redis
|
|
# Only the server joins edge (auth.ginnoir.com); worker/db/redis stay private.
|
|
|
|
services:
|
|
authentik-server:
|
|
container_name: authentik_server
|
|
image: ghcr.io/goauthentik/server:${AUTHENTIK_IMAGE_TAG:-2024.12.3}
|
|
restart: unless-stopped
|
|
command: server
|
|
networks: [authentik, edge]
|
|
env_file:
|
|
- stack.env
|
|
environment:
|
|
AUTHENTIK_REDIS__HOST: authentik-redis
|
|
AUTHENTIK_POSTGRESQL__HOST: authentik-db
|
|
AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_DB_USER:-authentik}
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
|
|
AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_DB_NAME:-authentik}
|
|
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
|
|
AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
|
|
ports:
|
|
- "9200:9000"
|
|
depends_on:
|
|
authentik-db:
|
|
condition: service_healthy
|
|
authentik-redis:
|
|
condition: service_healthy
|
|
|
|
authentik-worker:
|
|
container_name: authentik_worker
|
|
image: ghcr.io/goauthentik/server:${AUTHENTIK_IMAGE_TAG:-2024.12.3}
|
|
restart: unless-stopped
|
|
command: worker
|
|
networks: [authentik]
|
|
env_file:
|
|
- stack.env
|
|
environment:
|
|
AUTHENTIK_REDIS__HOST: authentik-redis
|
|
AUTHENTIK_POSTGRESQL__HOST: authentik-db
|
|
AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_DB_USER:-authentik}
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
|
|
AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_DB_NAME:-authentik}
|
|
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
|
|
AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
|
|
depends_on:
|
|
authentik-db:
|
|
condition: service_healthy
|
|
authentik-redis:
|
|
condition: service_healthy
|
|
|
|
authentik-db:
|
|
container_name: postgres_authentik
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
networks: [authentik]
|
|
env_file:
|
|
- stack.env
|
|
environment:
|
|
POSTGRES_USER: ${AUTHENTIK_DB_USER:-authentik}
|
|
POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD}
|
|
POSTGRES_DB: ${AUTHENTIK_DB_NAME:-authentik}
|
|
volumes:
|
|
- /config/authentik/postgres:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"pg_isready -U ${AUTHENTIK_DB_USER:-authentik} -d ${AUTHENTIK_DB_NAME:-authentik}",
|
|
]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
authentik-redis:
|
|
container_name: redis_authentik
|
|
image: redis:7-alpine
|
|
restart: unless-stopped
|
|
networks: [authentik]
|
|
command: --save 60 1 --loglevel warning
|
|
volumes:
|
|
- /config/authentik/redis:/data
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
networks:
|
|
authentik:
|
|
name: authentik
|
|
driver: bridge
|
|
edge:
|
|
name: edge
|
|
external: true
|