2022-04-13 10:04:03 +00:00
|
|
|
---
|
|
|
|
|
|
|
|
x-env: &env
|
2022-11-17 18:34:20 +00:00
|
|
|
- AUTHENTIK_POSTGRESQL__PASSWORD=file:///run/secrets/db_password
|
2022-04-13 10:04:03 +00:00
|
|
|
- AUTHENTIK_POSTGRESQL__USER
|
|
|
|
- AUTHENTIK_POSTGRESQL__NAME
|
|
|
|
- AUTHENTIK_POSTGRESQL__HOST
|
|
|
|
- AUTHENTIK_REDIS__HOST
|
|
|
|
- AUTHENTIK_ERROR_REPORTING__ENABLED
|
2022-11-17 18:34:20 +00:00
|
|
|
- AUTHENTIK_SECRET_KEY=file:///run/secrets/secret_key
|
2022-04-13 10:04:03 +00:00
|
|
|
- AUTHENTIK_EMAIL__HOST
|
|
|
|
- AUTHENTIK_EMAIL__PORT
|
|
|
|
- AUTHENTIK_EMAIL__USERNAME
|
2022-11-17 18:34:20 +00:00
|
|
|
- AUTHENTIK_EMAIL__PASSWORD=file:///run/secrets/email_pass
|
2022-04-13 10:04:03 +00:00
|
|
|
- AUTHENTIK_EMAIL__USE_TLS
|
|
|
|
- AUTHENTIK_EMAIL__USE_SSL
|
|
|
|
- AUTHENTIK_EMAIL__TIMEOUT
|
|
|
|
- AUTHENTIK_EMAIL__FROM
|
|
|
|
- AUTHENTIK_LOG_LEVEL
|
2022-10-11 11:05:29 +00:00
|
|
|
- AUTHENTIK_SETTINGS__THEME__BACKGROUND
|
2022-10-19 11:32:27 +00:00
|
|
|
- AUTHENTIK_COLOR_BACKGROUND_LIGHT
|
2022-10-25 16:30:44 +00:00
|
|
|
- AUTHENTIK_FOOTER_LINKS
|
2022-12-20 11:54:39 +00:00
|
|
|
- AUTHENTIK_IMPERSONATION
|
2022-10-20 11:17:23 +00:00
|
|
|
- WELCOME_MESSAGE
|
|
|
|
- DEFAULT_LANGUAGE
|
2022-12-20 19:39:04 +00:00
|
|
|
- EMAIL_SUBJECT
|
|
|
|
- EMAIL_TOKEN_EXPIRY_MINUTES
|
2022-10-20 11:17:23 +00:00
|
|
|
- DOMAIN
|
2023-01-05 22:36:22 +00:00
|
|
|
- LOGOUT_REDIRECT
|
2022-04-13 10:04:03 +00:00
|
|
|
|
|
|
|
version: '3.8'
|
|
|
|
services:
|
|
|
|
app:
|
2023-03-06 15:54:48 +00:00
|
|
|
image: ghcr.io/goauthentik/server:2023.2.3
|
2022-04-13 10:04:03 +00:00
|
|
|
command: server
|
2022-11-17 18:34:20 +00:00
|
|
|
secrets:
|
|
|
|
- db_password
|
|
|
|
- admin_pass
|
|
|
|
- admin_token
|
|
|
|
- secret_key
|
|
|
|
- email_pass
|
2022-04-13 10:04:03 +00:00
|
|
|
volumes:
|
|
|
|
- media:/media
|
|
|
|
- custom-templates:/templates
|
2022-10-11 11:05:29 +00:00
|
|
|
configs:
|
|
|
|
- source: custom_css
|
|
|
|
target: /web/dist/custom.css
|
2022-04-13 10:04:03 +00:00
|
|
|
networks:
|
|
|
|
- internal
|
|
|
|
- proxy
|
|
|
|
healthcheck:
|
|
|
|
test: ["CMD", "curl", "-f", "localhost:9000/-/health/live/"]
|
|
|
|
interval: 30s
|
|
|
|
timeout: 10s
|
|
|
|
retries: 10
|
|
|
|
start_period: 1m
|
|
|
|
environment: *env
|
|
|
|
deploy:
|
|
|
|
update_config:
|
|
|
|
failure_action: rollback
|
|
|
|
order: start-first
|
|
|
|
labels:
|
|
|
|
- "traefik.enable=true"
|
|
|
|
- "traefik.docker.network=proxy"
|
|
|
|
- "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=9000"
|
|
|
|
- "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
|
|
|
|
- "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
|
|
|
|
- "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
|
2022-09-12 08:56:11 +00:00
|
|
|
- "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect,${STACK_NAME}-frameOptions"
|
|
|
|
- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLForceHost=true"
|
|
|
|
- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
|
|
|
|
- "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.customFrameOptionsValue=SAMEORIGIN"
|
|
|
|
- "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.contentSecurityPolicy=frame-ancestors ${X_FRAME_OPTIONS_ALLOW_FROM}"
|
2023-03-07 15:48:41 +00:00
|
|
|
- "coop-cloud.${STACK_NAME}.version=2.0.0+2023.2.3"
|
2022-04-13 10:04:03 +00:00
|
|
|
|
|
|
|
worker:
|
2023-03-06 15:54:48 +00:00
|
|
|
image: ghcr.io/goauthentik/server:2023.2.3
|
2022-04-13 10:04:03 +00:00
|
|
|
command: worker
|
2022-11-17 18:34:20 +00:00
|
|
|
secrets:
|
|
|
|
- db_password
|
|
|
|
- admin_pass
|
|
|
|
- admin_token
|
|
|
|
- secret_key
|
|
|
|
- email_pass
|
2022-04-13 10:04:03 +00:00
|
|
|
networks:
|
|
|
|
- internal
|
|
|
|
- proxy
|
|
|
|
user: root
|
|
|
|
volumes:
|
|
|
|
- backups:/backups
|
|
|
|
- media:/media
|
|
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
|
|
- custom-templates:/templates
|
2022-11-02 11:25:08 +00:00
|
|
|
- /dev/null:/blueprints/default/10-flow-default-authentication-flow.yaml
|
2023-01-05 22:36:22 +00:00
|
|
|
- /dev/null:/blueprints/default/10-flow-default-invalidation-flow.yaml
|
2022-10-20 11:17:23 +00:00
|
|
|
configs:
|
|
|
|
- source: custom_flows
|
|
|
|
target: /blueprints/custom_flows.yaml
|
2022-04-13 10:04:03 +00:00
|
|
|
environment: *env
|
|
|
|
|
|
|
|
db:
|
2023-03-06 15:54:48 +00:00
|
|
|
image: postgres:12.14-alpine
|
2022-11-17 18:34:20 +00:00
|
|
|
secrets:
|
|
|
|
- db_password
|
2022-04-13 10:04:03 +00:00
|
|
|
volumes:
|
|
|
|
- database:/var/lib/postgresql/data
|
|
|
|
networks:
|
|
|
|
- internal
|
|
|
|
healthcheck:
|
|
|
|
test: ["CMD", "pg_isready"]
|
|
|
|
interval: 30s
|
|
|
|
timeout: 10s
|
|
|
|
retries: 10
|
|
|
|
start_period: 1m
|
|
|
|
environment:
|
2022-11-17 18:34:20 +00:00
|
|
|
- POSTGRES_PASSWORD_FILE=/run/secrets/db_password
|
|
|
|
- POSTGRES_USER=${AUTHENTIK_POSTGRESQL__USER}
|
|
|
|
- POSTGRES_DB=${AUTHENTIK_POSTGRESQL__NAME}
|
2022-04-13 10:04:03 +00:00
|
|
|
deploy:
|
|
|
|
labels:
|
|
|
|
backupbot.backup: "true"
|
2023-03-01 12:29:58 +00:00
|
|
|
backupbot.backup.pre-hook: "mkdir -p /tmp/backup/ && PGPASSWORD=$$(cat /run/secrets/db_password) pg_dump -U $${POSTGRES_USER} $${POSTGRES_DB} > /tmp/backup/backup.sql"
|
2022-04-13 10:04:03 +00:00
|
|
|
backupbot.backup.post-hook: "rm -rf /tmp/backup"
|
|
|
|
backupbot.backup.path: "/tmp/backup/"
|
|
|
|
|
|
|
|
redis:
|
2023-03-06 15:54:48 +00:00
|
|
|
image: redis:7.0.9-alpine
|
2022-04-13 10:04:03 +00:00
|
|
|
networks:
|
|
|
|
- internal
|
|
|
|
healthcheck:
|
|
|
|
test: ["CMD", "redis-cli","ping"]
|
|
|
|
interval: 30s
|
|
|
|
timeout: 10s
|
|
|
|
retries: 10
|
|
|
|
start_period: 1m
|
|
|
|
|
2022-11-17 18:34:20 +00:00
|
|
|
secrets:
|
|
|
|
db_password:
|
|
|
|
external: true
|
|
|
|
name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
|
|
|
|
secret_key:
|
|
|
|
external: true
|
|
|
|
name: ${STACK_NAME}_secret_key_${SECRET_SECRET_KEY_VERSION}
|
|
|
|
admin_token:
|
|
|
|
external: true
|
|
|
|
name: ${STACK_NAME}_admin_token_${SECRET_ADMIN_TOKEN_VERSION}
|
|
|
|
admin_pass:
|
|
|
|
external: true
|
|
|
|
name: ${STACK_NAME}_admin_pass_${SECRET_ADMIN_PASS_VERSION}
|
|
|
|
email_pass:
|
|
|
|
external: true
|
|
|
|
name: ${STACK_NAME}_email_pass_${SECRET_EMAIL_PASS_VERSION}
|
2022-04-13 10:04:03 +00:00
|
|
|
|
|
|
|
networks:
|
|
|
|
proxy:
|
|
|
|
external: true
|
|
|
|
internal:
|
|
|
|
|
|
|
|
volumes:
|
|
|
|
backups:
|
|
|
|
media:
|
|
|
|
custom-templates:
|
|
|
|
database:
|
2022-10-11 11:05:29 +00:00
|
|
|
|
|
|
|
configs:
|
|
|
|
custom_css:
|
|
|
|
name: ${STACK_NAME}_custom_css_${CUSTOM_CSS_VERSION}
|
|
|
|
file: custom.css.tmpl
|
|
|
|
template_driver: golang
|
2022-10-20 11:17:23 +00:00
|
|
|
custom_flows:
|
|
|
|
name: ${STACK_NAME}_custom_flows_${CUSTOM_FLOWS_VERSION}
|
|
|
|
file: custom_flows.yaml.tmpl
|
|
|
|
template_driver: golang
|