123 lines
3.4 KiB
Nix
123 lines
3.4 KiB
Nix
{ config, ... }:
|
|
|
|
let
|
|
inherit (config.virtualisation.quadlet) containers networks;
|
|
authentikEnv = config.sops.secrets."containers/authentik.env".path;
|
|
outpostEnv = config.sops.secrets."containers/authentik-outpost.env".path;
|
|
in
|
|
{
|
|
sops.secrets = {
|
|
"containers/authentik.env" = {
|
|
sopsFile = ../../secrets/authentik.env;
|
|
format = "dotenv";
|
|
key = "";
|
|
mode = "0400";
|
|
restartUnits = [
|
|
"authentik-db.service"
|
|
"authentik-server.service"
|
|
"authentik-worker.service"
|
|
];
|
|
};
|
|
|
|
"containers/authentik-outpost.env" = {
|
|
sopsFile = ../../secrets/authentik-outpost.env;
|
|
format = "dotenv";
|
|
key = "";
|
|
mode = "0400";
|
|
restartUnits = [ "authentik-outpost-ldap.service" ];
|
|
};
|
|
};
|
|
|
|
virtualisation.quadlet = {
|
|
networks.authentik = { };
|
|
|
|
containers = {
|
|
authentik-db = {
|
|
containerConfig = {
|
|
image = "docker.io/library/postgres:16-alpine";
|
|
networks = [ networks.authentik.ref ];
|
|
networkAliases = [ "postgresql" ];
|
|
volumes = [
|
|
"/home/imnyang/Docker/authentik/postgres_data:/var/lib/postgresql/data:Z"
|
|
];
|
|
environmentFiles = [ authentikEnv ];
|
|
healthCmd = "pg_isready -d authentik -U authentik";
|
|
healthInterval = "30s";
|
|
healthRetries = 5;
|
|
healthStartPeriod = "20s";
|
|
healthTimeout = "5s";
|
|
};
|
|
|
|
serviceConfig.Restart = "always";
|
|
};
|
|
|
|
authentik-server = {
|
|
containerConfig = {
|
|
image = "ghcr.io/goauthentik/server:2026.5.0";
|
|
exec = "server";
|
|
networks = [ networks.authentik.ref ];
|
|
publishPorts = [
|
|
"9080:9000"
|
|
"9443:9443"
|
|
];
|
|
volumes = [
|
|
"/home/imnyang/Docker/authentik/media:/media:Z"
|
|
"/home/imnyang/Docker/authentik/custom-templates:/templates:Z"
|
|
];
|
|
environmentFiles = [ authentikEnv ];
|
|
};
|
|
|
|
unitConfig = {
|
|
Requires = [ containers."authentik-db".ref ];
|
|
After = [ containers."authentik-db".ref ];
|
|
};
|
|
|
|
serviceConfig.Restart = "always";
|
|
};
|
|
|
|
authentik-worker = {
|
|
containerConfig = {
|
|
image = "ghcr.io/goauthentik/server:2026.5.0";
|
|
exec = "worker";
|
|
user = "root";
|
|
networks = [ networks.authentik.ref ];
|
|
volumes = [
|
|
"/home/imnyang/Docker/authentik/certs:/certs:Z"
|
|
"/home/imnyang/Docker/authentik/media:/media:Z"
|
|
"/home/imnyang/Docker/authentik/custom-templates:/templates:Z"
|
|
"/var/run/docker.sock:/var/run/docker.sock"
|
|
];
|
|
environmentFiles = [ authentikEnv ];
|
|
};
|
|
|
|
unitConfig = {
|
|
Requires = [ containers."authentik-db".ref ];
|
|
After = [ containers."authentik-db".ref ];
|
|
};
|
|
|
|
serviceConfig.Restart = "always";
|
|
};
|
|
|
|
authentik-outpost-ldap = {
|
|
containerConfig = {
|
|
image = "ghcr.io/goauthentik/ldap:2026.5.0";
|
|
entrypoint = [ "/ldap" ];
|
|
user = "1000";
|
|
networks = [ networks.authentik.ref ];
|
|
publishPorts = [
|
|
"389:3389"
|
|
"636:6636"
|
|
];
|
|
environmentFiles = [ outpostEnv ];
|
|
};
|
|
|
|
unitConfig = {
|
|
Requires = [ containers."authentik-server".ref ];
|
|
After = [ containers."authentik-server".ref ];
|
|
};
|
|
|
|
serviceConfig.Restart = "always";
|
|
};
|
|
};
|
|
};
|
|
}
|