117 lines
3.6 KiB
YAML
117 lines
3.6 KiB
YAML
---
|
|
version: '3.0'
|
|
|
|
networks:
|
|
traefik:
|
|
external: true
|
|
authentik:
|
|
name: authentik
|
|
|
|
volumes:
|
|
redis_data:
|
|
driver: local
|
|
driver_opts:
|
|
o: bind
|
|
type: none
|
|
device: ${REDIS_DATA:-/mnt/stingray/authentik/redis/data}
|
|
|
|
services:
|
|
redis:
|
|
image: docker.io/library/redis:7.4.2-alpine
|
|
command: --save 60 1 --loglevel warning
|
|
networks:
|
|
- authentik
|
|
volumes:
|
|
- redis_data:/data
|
|
deploy:
|
|
mode: replicated
|
|
replicas: 1
|
|
placement:
|
|
constraints: [node.role != manager]
|
|
resources:
|
|
limits:
|
|
cpus: '0.25'
|
|
memory: 128M
|
|
reservations:
|
|
cpus: '0.1'
|
|
memory: 32M
|
|
|
|
server:
|
|
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.12.3}
|
|
restart: unless-stopped
|
|
command: server
|
|
environment:
|
|
AUTHENTIK_REDIS__HOST: redis
|
|
AUTHENTIK_POSTGRESQL__HOST: ${PG_HOST:-db.home.mnke.org}
|
|
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
|
|
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:-password}
|
|
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:-supersecretkey}
|
|
volumes:
|
|
- ${AUTHENTIK_MEDIA_DIRECTORY:-/mnt/stingray/authentik/media}:/media
|
|
- ${AUTHENTIK_MEDIA_DIRECTORY:-/mnt/stingray/authentik/media}:/templates
|
|
networks:
|
|
- authentik
|
|
- traefik
|
|
depends_on:
|
|
- redis
|
|
deploy:
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.authentik.rule=Host(`${AUTHENTIK_HOST:-authentik.mnke.org}`) || Host(`${AUTHENTIK_SECONDARY_HOST:-authentik.stingray.mnke.org}`)"
|
|
- "traefik.http.routers.authentik.entrypoints=websecure"
|
|
- "traefik.http.routers.authentik.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.authentik.loadbalancer.server.port=9000"
|
|
- "traefik.swarm.network=traefik"
|
|
mode: replicated
|
|
replicas: 1
|
|
placement:
|
|
constraints: [node.role != manager]
|
|
resources:
|
|
limits:
|
|
cpus: '0.25'
|
|
memory: 1G
|
|
reservations:
|
|
cpus: '0.1'
|
|
memory: 64M
|
|
|
|
worker:
|
|
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.12.3}
|
|
restart: unless-stopped
|
|
command: worker
|
|
environment:
|
|
AUTHENTIK_REDIS__HOST: redis
|
|
AUTHENTIK_POSTGRESQL__HOST: ${PG_HOST:-db.home.mnke.org}
|
|
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
|
|
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:-password}
|
|
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:-supersecretkey}
|
|
# `user: root` and the docker socket volume are optional.
|
|
# See more for the docker socket integration here:
|
|
# https://goauthentik.io/docs/outposts/integrations/docker
|
|
# Removing `user: root` also prevents the worker from fixing the permissions
|
|
# on the mounted folders, so when removing this make sure the folders have the correct UID/GID
|
|
# (1000:1000 by default)
|
|
user: root
|
|
networks:
|
|
- authentik
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- ${AUTHENTIK_MEDIA_DIRECTORY:-/mnt/stingray/authentik/media}:/media
|
|
- ${AUTHENTIK_MEDIA_DIRECTORY:-/mnt/stingray/authentik/media}:/certs
|
|
- ${AUTHENTIK_MEDIA_DIRECTORY:-/mnt/stingray/authentik/media}:/templates
|
|
depends_on:
|
|
- redis
|
|
deploy:
|
|
mode: replicated
|
|
replicas: 1
|
|
placement:
|
|
constraints: [node.role != manager]
|
|
resources:
|
|
limits:
|
|
cpus: '0.25'
|
|
memory: 512M
|
|
reservations:
|
|
cpus: '0.1'
|
|
memory: 64M
|