140 lines
4.2 KiB
Nix
140 lines
4.2 KiB
Nix
{ config, ... }:
|
|
|
|
let
|
|
inherit (config.virtualisation.quadlet) containers networks;
|
|
authentikVersion = "2026.5.6";
|
|
authentikEnv = config.sops.secrets."containers/authentik.env".path;
|
|
outpostEnv = config.sops.secrets."containers/authentik-outpost.env".path;
|
|
in
|
|
{
|
|
sops.secrets = {
|
|
"containers/authentik.env" = {
|
|
sopsFile = ../../secrets/authentik.env;
|
|
format = "dotenv";
|
|
key = "";
|
|
mode = "0400";
|
|
restartUnits = [
|
|
"authentik-db.service"
|
|
"authentik-server.service"
|
|
"authentik-worker.service"
|
|
];
|
|
};
|
|
|
|
"containers/authentik-outpost.env" = {
|
|
sopsFile = ../../secrets/authentik-outpost.env;
|
|
format = "dotenv";
|
|
key = "";
|
|
mode = "0400";
|
|
restartUnits = [ "authentik-outpost-ldap.service" ];
|
|
};
|
|
};
|
|
|
|
virtualisation.quadlet = {
|
|
networks.authentik = { };
|
|
|
|
containers = {
|
|
authentik-db = {
|
|
containerConfig = {
|
|
image = "docker.io/library/postgres:16-alpine";
|
|
networks = [ networks.authentik.ref ];
|
|
networkAliases = [ "postgresql" ];
|
|
volumes = [
|
|
"/home/imnyang/Docker/authentik/postgres_data:/var/lib/postgresql/data:Z"
|
|
];
|
|
environmentFiles = [ authentikEnv ];
|
|
healthCmd = "pg_isready -d authentik -U authentik";
|
|
healthInterval = "30s";
|
|
healthRetries = 5;
|
|
healthStartPeriod = "20s";
|
|
healthTimeout = "5s";
|
|
};
|
|
|
|
serviceConfig.Restart = "always";
|
|
};
|
|
|
|
authentik-server = {
|
|
containerConfig = {
|
|
image = "ghcr.io/goauthentik/server:${authentikVersion}";
|
|
exec = "server";
|
|
networks = [ networks.authentik.ref ];
|
|
publishPorts = [
|
|
"9080:9000"
|
|
"9443:9443"
|
|
];
|
|
volumes = [
|
|
"/home/imnyang/Docker/authentik/media:/media:Z"
|
|
"/home/imnyang/Docker/authentik/custom-templates:/templates:Z"
|
|
];
|
|
environmentFiles = [ authentikEnv ];
|
|
environments = {
|
|
# Authentik 2026.5 defaults to [::], but hako is reached over IPv4.
|
|
AUTHENTIK_LISTEN__HTTP = "0.0.0.0:9000";
|
|
AUTHENTIK_LISTEN__HTTPS = "0.0.0.0:9443";
|
|
};
|
|
};
|
|
|
|
unitConfig = {
|
|
Requires = [ containers."authentik-db".ref ];
|
|
After = [ containers."authentik-db".ref ];
|
|
};
|
|
|
|
serviceConfig.Restart = "always";
|
|
};
|
|
|
|
authentik-worker = {
|
|
containerConfig = {
|
|
image = "ghcr.io/goauthentik/server:${authentikVersion}";
|
|
exec = "worker";
|
|
user = "root";
|
|
networks = [ networks.authentik.ref ];
|
|
volumes = [
|
|
"/home/imnyang/Docker/authentik/certs:/certs:Z"
|
|
"/home/imnyang/Docker/authentik/media:/media:Z"
|
|
"/home/imnyang/Docker/authentik/custom-templates:/templates:Z"
|
|
];
|
|
environmentFiles = [ authentikEnv ];
|
|
environments = {
|
|
AUTHENTIK_LISTEN__HTTP = "0.0.0.0:9000";
|
|
};
|
|
};
|
|
|
|
unitConfig = {
|
|
Requires = [ containers."authentik-db".ref ];
|
|
After = [ containers."authentik-db".ref ];
|
|
};
|
|
|
|
serviceConfig.Restart = "always";
|
|
};
|
|
|
|
authentik-outpost-ldap = {
|
|
containerConfig = {
|
|
image = "ghcr.io/goauthentik/ldap:${authentikVersion}";
|
|
entrypoint = [ "/ldap" ];
|
|
user = "1000";
|
|
networks = [ networks.authentik.ref ];
|
|
publishPorts = [
|
|
"389:3389"
|
|
"636:6636"
|
|
];
|
|
environmentFiles = [ outpostEnv ];
|
|
environments = {
|
|
# Keep the outpost-to-core API traffic on the private Podman network.
|
|
# The public hostname resolves through Cloudflare and hairpins back
|
|
# through the reverse proxy, which currently returns 502 from hako.
|
|
AUTHENTIK_HOST = "http://authentik-server:9000";
|
|
AUTHENTIK_INSECURE = "true";
|
|
AUTHENTIK_LISTEN__LDAP = "0.0.0.0:3389";
|
|
AUTHENTIK_LISTEN__LDAPS = "0.0.0.0:6636";
|
|
};
|
|
};
|
|
|
|
unitConfig = {
|
|
Requires = [ containers."authentik-server".ref ];
|
|
After = [ containers."authentik-server".ref ];
|
|
};
|
|
|
|
serviceConfig.Restart = "always";
|
|
};
|
|
};
|
|
};
|
|
}
|