imnyang/nix-flakes
Watch
1
0
Fork
You've already forked nix-flakes
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wow

Browse source
This commit is contained in:
암냥 2026-08-17 11:28:53 +09:00
commit f6dbcc2b4f
No known key found for this signature in database
20 changed files with 540 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

123
hosts/server/hikari/hako/services/quadlet/authentik.nix Normal file
View file

@ -0,0 +1,123 @@
{ config, ... }:
let
inherit (config.virtualisation.quadlet) containers networks;
authentikEnv = config.sops.secrets."containers/authentik.env".path;
outpostEnv = config.sops.secrets."containers/authentik-outpost.env".path;
in
{
sops.secrets = {
"containers/authentik.env" = {
sopsFile = ../../secrets/authentik.env;
format = "dotenv";
key = "";
mode = "0400";
restartUnits = [
"authentik-db.service"
"authentik-server.service"
"authentik-worker.service"
];
};
"containers/authentik-outpost.env" = {
sopsFile = ../../secrets/authentik-outpost.env;
format = "dotenv";
key = "";
mode = "0400";
restartUnits = [ "authentik-outpost-ldap.service" ];
};
};
virtualisation.quadlet = {
networks.authentik = { };
containers = {
authentik-db = {
containerConfig = {
image = "docker.io/library/postgres:16-alpine";
networks = [ networks.authentik.ref ];
networkAliases = [ "postgresql" ];
volumes = [
"/home/imnyang/Docker/authentik/postgres_data:/var/lib/postgresql/data:Z"
];
environmentFiles = [ authentikEnv ];
healthCmd = "pg_isready -d authentik -U authentik";
healthInterval = "30s";
healthRetries = 5;
healthStartPeriod = "20s";
healthTimeout = "5s";
};
serviceConfig.Restart = "always";
};
authentik-server = {
containerConfig = {
image = "ghcr.io/goauthentik/server:2026.5.0";
exec = "server";
networks = [ networks.authentik.ref ];
publishPorts = [
"9080:9000"
"9443:9443"
];
volumes = [
"/home/imnyang/Docker/authentik/media:/media:Z"
"/home/imnyang/Docker/authentik/custom-templates:/templates:Z"
];
environmentFiles = [ authentikEnv ];
};
unitConfig = {
Requires = [ containers."authentik-db".ref ];
After = [ containers."authentik-db".ref ];
};
serviceConfig.Restart = "always";
};
authentik-worker = {
containerConfig = {
image = "ghcr.io/goauthentik/server:2026.5.0";
exec = "worker";
user = "root";
networks = [ networks.authentik.ref ];
volumes = [
"/home/imnyang/Docker/authentik/certs:/certs:Z"
"/home/imnyang/Docker/authentik/media:/media:Z"
"/home/imnyang/Docker/authentik/custom-templates:/templates:Z"
"/var/run/docker.sock:/var/run/docker.sock"
];
environmentFiles = [ authentikEnv ];
};
unitConfig = {
Requires = [ containers."authentik-db".ref ];
After = [ containers."authentik-db".ref ];
};
serviceConfig.Restart = "always";
};
authentik-outpost-ldap = {
containerConfig = {
image = "ghcr.io/goauthentik/ldap:2026.5.0";
entrypoint = [ "/ldap" ];
user = "1000";
networks = [ networks.authentik.ref ];
publishPorts = [
"389:3389"
"636:6636"
];
environmentFiles = [ outpostEnv ];
};
unitConfig = {
Requires = [ containers."authentik-server".ref ];
After = [ containers."authentik-server".ref ];
};
serviceConfig.Restart = "always";
};
};
};
}