2022-04-13 10:04:03 +00:00
|
|
|
---
|
|
|
|
|
|
|
|
x-env: &env
|
2022-11-17 18:34:20 +00:00
|
|
|
- AUTHENTIK_POSTGRESQL__PASSWORD=file:///run/secrets/db_password
|
2023-03-08 22:46:17 +00:00
|
|
|
- AUTHENTIK_POSTGRESQL__USER=authentik
|
|
|
|
- AUTHENTIK_POSTGRESQL__NAME=authentik
|
|
|
|
- AUTHENTIK_POSTGRESQL__HOST=db
|
|
|
|
- AUTHENTIK_REDIS__HOST=redis
|
2022-04-13 10:04:03 +00:00
|
|
|
- AUTHENTIK_ERROR_REPORTING__ENABLED
|
2022-11-17 18:34:20 +00:00
|
|
|
- AUTHENTIK_SECRET_KEY=file:///run/secrets/secret_key
|
2022-04-13 10:04:03 +00:00
|
|
|
- AUTHENTIK_EMAIL__HOST
|
|
|
|
- AUTHENTIK_EMAIL__PORT
|
|
|
|
- AUTHENTIK_EMAIL__USERNAME
|
2022-11-17 18:34:20 +00:00
|
|
|
- AUTHENTIK_EMAIL__PASSWORD=file:///run/secrets/email_pass
|
2022-04-13 10:04:03 +00:00
|
|
|
- AUTHENTIK_EMAIL__USE_TLS
|
|
|
|
- AUTHENTIK_EMAIL__USE_SSL
|
|
|
|
- AUTHENTIK_EMAIL__TIMEOUT
|
|
|
|
- AUTHENTIK_EMAIL__FROM
|
|
|
|
- AUTHENTIK_LOG_LEVEL
|
2022-10-11 11:05:29 +00:00
|
|
|
- AUTHENTIK_SETTINGS__THEME__BACKGROUND
|
2022-10-19 11:32:27 +00:00
|
|
|
- AUTHENTIK_COLOR_BACKGROUND_LIGHT
|
2022-10-25 16:30:44 +00:00
|
|
|
- AUTHENTIK_FOOTER_LINKS
|
2022-12-20 11:54:39 +00:00
|
|
|
- AUTHENTIK_IMPERSONATION
|
2022-10-20 11:17:23 +00:00
|
|
|
- WELCOME_MESSAGE
|
|
|
|
- DEFAULT_LANGUAGE
|
2022-12-20 19:39:04 +00:00
|
|
|
- EMAIL_SUBJECT
|
|
|
|
- EMAIL_TOKEN_EXPIRY_MINUTES
|
2022-10-20 11:17:23 +00:00
|
|
|
- DOMAIN
|
2023-01-05 22:36:22 +00:00
|
|
|
- LOGOUT_REDIRECT
|
2023-04-26 16:12:49 +00:00
|
|
|
- APPLICATIONS
|
2022-04-13 10:04:03 +00:00
|
|
|
|
|
|
|
version: '3.8'
|
|
|
|
services:
|
|
|
|
app:
|
2023-04-05 14:05:57 +00:00
|
|
|
image: ghcr.io/goauthentik/server:2023.3.1
|
2022-04-13 10:04:03 +00:00
|
|
|
command: server
|
2022-11-17 18:34:20 +00:00
|
|
|
secrets:
|
|
|
|
- db_password
|
|
|
|
- admin_pass
|
|
|
|
- admin_token
|
|
|
|
- secret_key
|
|
|
|
- email_pass
|
2022-04-13 10:04:03 +00:00
|
|
|
volumes:
|
|
|
|
- media:/media
|
2023-03-29 16:01:29 +00:00
|
|
|
- assets:/web/dist/assets
|
2022-10-11 11:05:29 +00:00
|
|
|
configs:
|
|
|
|
- source: custom_css
|
|
|
|
target: /web/dist/custom.css
|
2022-04-13 10:04:03 +00:00
|
|
|
networks:
|
|
|
|
- internal
|
|
|
|
- proxy
|
|
|
|
healthcheck:
|
|
|
|
test: ["CMD", "curl", "-f", "localhost:9000/-/health/live/"]
|
|
|
|
interval: 30s
|
|
|
|
timeout: 10s
|
|
|
|
retries: 10
|
2023-04-20 18:37:28 +00:00
|
|
|
start_period: 5m
|
2022-04-13 10:04:03 +00:00
|
|
|
environment: *env
|
|
|
|
deploy:
|
|
|
|
update_config:
|
|
|
|
failure_action: rollback
|
|
|
|
order: start-first
|
|
|
|
labels:
|
|
|
|
- "traefik.enable=true"
|
|
|
|
- "traefik.docker.network=proxy"
|
|
|
|
- "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=9000"
|
|
|
|
- "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
|
|
|
|
- "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
|
|
|
|
- "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
|
2022-09-12 08:56:11 +00:00
|
|
|
- "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect,${STACK_NAME}-frameOptions"
|
|
|
|
- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLForceHost=true"
|
|
|
|
- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
|
|
|
|
- "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.customFrameOptionsValue=SAMEORIGIN"
|
|
|
|
- "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.contentSecurityPolicy=frame-ancestors ${X_FRAME_OPTIONS_ALLOW_FROM}"
|
2023-04-18 16:47:54 +00:00
|
|
|
- "coop-cloud.${STACK_NAME}.version=3.1.1+2023.3.1"
|
2023-04-13 18:47:14 +00:00
|
|
|
- "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
|
2022-04-13 10:04:03 +00:00
|
|
|
|
|
|
|
worker:
|
2023-04-05 14:05:57 +00:00
|
|
|
image: ghcr.io/goauthentik/server:2023.3.1
|
2022-04-13 10:04:03 +00:00
|
|
|
command: worker
|
2022-11-17 18:34:20 +00:00
|
|
|
secrets:
|
|
|
|
- db_password
|
|
|
|
- admin_pass
|
|
|
|
- admin_token
|
|
|
|
- secret_key
|
|
|
|
- email_pass
|
2022-04-13 10:04:03 +00:00
|
|
|
networks:
|
|
|
|
- internal
|
|
|
|
- proxy
|
|
|
|
user: root
|
|
|
|
volumes:
|
|
|
|
- backups:/backups
|
|
|
|
- media:/media
|
|
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
2023-03-22 16:26:25 +00:00
|
|
|
- /dev/null:/blueprints/default/flow-oobe.yaml
|
2022-10-20 11:17:23 +00:00
|
|
|
configs:
|
2023-03-22 16:26:25 +00:00
|
|
|
- source: flow_recovery
|
|
|
|
target: /blueprints/1_flow_recovery.yaml
|
|
|
|
- source: flow_authentication
|
|
|
|
target: /blueprints/2_flow_authentication.yaml
|
|
|
|
- source: flow_translation
|
|
|
|
target: /blueprints/3_flow_translation.yaml
|
|
|
|
- source: flow_invitation
|
|
|
|
target: /blueprints/4_flow_invitation.yaml
|
|
|
|
- source: system_tenant
|
|
|
|
target: /blueprints/5_system_tenant.yaml
|
|
|
|
- source: flow_invalidation
|
|
|
|
target: /blueprints/6_flow_invalidation.yaml
|
2022-04-13 10:04:03 +00:00
|
|
|
environment: *env
|
|
|
|
|
|
|
|
db:
|
2023-03-06 15:54:48 +00:00
|
|
|
image: postgres:12.14-alpine
|
2022-11-17 18:34:20 +00:00
|
|
|
secrets:
|
|
|
|
- db_password
|
2022-04-13 10:04:03 +00:00
|
|
|
volumes:
|
|
|
|
- database:/var/lib/postgresql/data
|
|
|
|
networks:
|
|
|
|
- internal
|
|
|
|
healthcheck:
|
|
|
|
test: ["CMD", "pg_isready"]
|
|
|
|
interval: 30s
|
|
|
|
timeout: 10s
|
|
|
|
retries: 10
|
|
|
|
start_period: 1m
|
|
|
|
environment:
|
2022-11-17 18:34:20 +00:00
|
|
|
- POSTGRES_PASSWORD_FILE=/run/secrets/db_password
|
2023-03-22 14:02:40 +00:00
|
|
|
- POSTGRES_USER=authentik
|
|
|
|
- POSTGRES_DB=authentik
|
2022-04-13 10:04:03 +00:00
|
|
|
deploy:
|
|
|
|
labels:
|
|
|
|
backupbot.backup: "true"
|
2023-03-01 12:29:58 +00:00
|
|
|
backupbot.backup.pre-hook: "mkdir -p /tmp/backup/ && PGPASSWORD=$$(cat /run/secrets/db_password) pg_dump -U $${POSTGRES_USER} $${POSTGRES_DB} > /tmp/backup/backup.sql"
|
2022-04-13 10:04:03 +00:00
|
|
|
backupbot.backup.post-hook: "rm -rf /tmp/backup"
|
|
|
|
backupbot.backup.path: "/tmp/backup/"
|
|
|
|
|
|
|
|
redis:
|
2023-04-05 14:05:57 +00:00
|
|
|
image: redis:7.0.10-alpine
|
2022-04-13 10:04:03 +00:00
|
|
|
networks:
|
|
|
|
- internal
|
|
|
|
healthcheck:
|
|
|
|
test: ["CMD", "redis-cli","ping"]
|
|
|
|
interval: 30s
|
|
|
|
timeout: 10s
|
|
|
|
retries: 10
|
|
|
|
start_period: 1m
|
|
|
|
|
2022-11-17 18:34:20 +00:00
|
|
|
secrets:
|
|
|
|
db_password:
|
|
|
|
external: true
|
|
|
|
name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
|
|
|
|
secret_key:
|
|
|
|
external: true
|
|
|
|
name: ${STACK_NAME}_secret_key_${SECRET_SECRET_KEY_VERSION}
|
|
|
|
admin_token:
|
|
|
|
external: true
|
|
|
|
name: ${STACK_NAME}_admin_token_${SECRET_ADMIN_TOKEN_VERSION}
|
|
|
|
admin_pass:
|
|
|
|
external: true
|
|
|
|
name: ${STACK_NAME}_admin_pass_${SECRET_ADMIN_PASS_VERSION}
|
|
|
|
email_pass:
|
|
|
|
external: true
|
|
|
|
name: ${STACK_NAME}_email_pass_${SECRET_EMAIL_PASS_VERSION}
|
2022-04-13 10:04:03 +00:00
|
|
|
|
|
|
|
networks:
|
|
|
|
proxy:
|
|
|
|
external: true
|
|
|
|
internal:
|
|
|
|
|
|
|
|
volumes:
|
|
|
|
backups:
|
|
|
|
media:
|
2023-03-29 16:01:29 +00:00
|
|
|
assets:
|
2022-04-13 10:04:03 +00:00
|
|
|
database:
|
2022-10-11 11:05:29 +00:00
|
|
|
|
|
|
|
configs:
|
|
|
|
custom_css:
|
|
|
|
name: ${STACK_NAME}_custom_css_${CUSTOM_CSS_VERSION}
|
|
|
|
file: custom.css.tmpl
|
|
|
|
template_driver: golang
|
2023-03-22 16:26:25 +00:00
|
|
|
flow_authentication:
|
|
|
|
name: ${STACK_NAME}_flow_authentication_${FLOW_AUTHENTICATION_VERSION}
|
|
|
|
file: flow_authentication.yaml.tmpl
|
|
|
|
template_driver: golang
|
|
|
|
flow_invitation:
|
|
|
|
name: ${STACK_NAME}_flow_invitation_${FLOW_INVITATION_VERSION}
|
|
|
|
file: flow_invitation.yaml.tmpl
|
|
|
|
template_driver: golang
|
|
|
|
flow_invalidation:
|
|
|
|
name: ${STACK_NAME}_flow_invalidation_${FLOW_INVALIDATION_VERSION}
|
|
|
|
file: flow_invalidation.yaml.tmpl
|
|
|
|
template_driver: golang
|
|
|
|
flow_recovery:
|
|
|
|
name: ${STACK_NAME}_flow_recovery_${FLOW_RECOVERY_VERSION}
|
|
|
|
file: flow_recovery.yaml.tmpl
|
|
|
|
template_driver: golang
|
|
|
|
flow_translation:
|
|
|
|
name: ${STACK_NAME}_flow_translation_${FLOW_TRANSLATION_VERSION}
|
|
|
|
file: flow_translation.yaml.tmpl
|
|
|
|
template_driver: golang
|
|
|
|
system_tenant:
|
|
|
|
name: ${STACK_NAME}_system_tenant_${SYSTEM_TENANT_VERSION}
|
|
|
|
file: system_tenant.yaml.tmpl
|
2022-10-20 11:17:23 +00:00
|
|
|
template_driver: golang
|