portainer-core/stacks/authentik-shared.yml

version: '3.8'

# Authentik - Identity Provider for SSO (Using Shared Infrastructure)
# Phase 1: Foundation - Google OAuth Integration
# Ports: 9000 (HTTP), 9443 (HTTPS)
# GPU: No
# Dependencies: postgres-shared, redis-shared

services:
  authentik-server:
    image: ghcr.io/goauthentik/server:latest
    container_name: authentik-server
    restart: unless-stopped
    command: server
    ports:
      - "9000:9000"
      # Port 9443 removed - use NPM for HTTPS termination
    environment:
      # Database configuration (shared PostgreSQL)
      AUTHENTIK_POSTGRESQL__HOST: postgres-shared
      AUTHENTIK_POSTGRESQL__PORT: 5432
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentik_user
      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD:?database password required}

      # Cache configuration (shared Redis, database 1)
      AUTHENTIK_REDIS__HOST: redis-shared
      AUTHENTIK_REDIS__PORT: 6379
      AUTHENTIK_REDIS__DB: 1

      # Authentik secret key
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}

      # Error reporting (disabled)
      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"

      # Performance tuning for home use
      WORKERS: 2

      # Email configuration (optional - configure later if needed)
      # AUTHENTIK_EMAIL__HOST: smtp.gmail.com
      # AUTHENTIK_EMAIL__PORT: 587
      # AUTHENTIK_EMAIL__USERNAME: your-email@gmail.com
      # AUTHENTIK_EMAIL__PASSWORD: your-app-password
      # AUTHENTIK_EMAIL__USE_TLS: "true"
      # AUTHENTIK_EMAIL__FROM: authentik@schweitz.net

      # Timezone
      TZ: Europe/Amsterdam
    volumes:
      - /home/jpmschweitzer/docker-data/authentik/media:/media
      - /home/jpmschweitzer/docker-data/authentik/custom-templates:/templates
    networks:
      - docker-dataplane
    depends_on:
      - postgres-shared
      - redis-shared
    deploy:
      resources:
        limits:
          memory: 256M

  authentik-worker:
    image: ghcr.io/goauthentik/server:latest
    container_name: authentik-worker
    restart: unless-stopped
    command: worker
    environment:
      # Database configuration (shared PostgreSQL)
      AUTHENTIK_POSTGRESQL__HOST: postgres-shared
      AUTHENTIK_POSTGRESQL__PORT: 5432
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentik_user
      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}

      # Cache configuration (shared Redis, database 1)
      AUTHENTIK_REDIS__HOST: redis-shared
      AUTHENTIK_REDIS__PORT: 6379
      AUTHENTIK_REDIS__DB: 1

      # Authentik secret key
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}

      # Error reporting (disabled)
      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"

      # Timezone
      TZ: Europe/Amsterdam
    user: root
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /home/jpmschweitzer/docker-data/authentik/media:/media
      - /home/jpmschweitzer/docker-data/authentik/certs:/certs
      - /home/jpmschweitzer/docker-data/authentik/custom-templates:/templates
    networks:
      - docker-dataplane
    depends_on:
      - postgres-shared
      - redis-shared
    deploy:
      resources:
        limits:
          memory: 192M

  authentik-proxy-outpost:
    image: ghcr.io/goauthentik/proxy:latest
    container_name: authentik-proxy-outpost
    restart: unless-stopped
    network_mode: host
    environment:
      # Authentik connection
      AUTHENTIK_HOST: http://192.168.86.149:9000
      AUTHENTIK_INSECURE: "false"
      AUTHENTIK_TOKEN: ${AUTHENTIK_OUTPOST_TOKEN:?outpost token required}

      # Logging
      AUTHENTIK_LOG_LEVEL: info

      # Port configuration
      AUTHENTIK_LISTEN__HTTP: 0.0.0.0:9001
      AUTHENTIK_LISTEN__METRICS: 0.0.0.0:9300
    depends_on:
      - authentik-server
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:9001/outpost.goauthentik.io/ping"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

networks:
  docker-dataplane:
    external: true
    name: docker-dataplane

# Prerequisites:
#
# 1. Deploy shared-infrastructure stack first!
#    docker-compose -f shared-infrastructure.yml up -d
#
# 2. Verify shared services are running:
#    docker ps | grep -E 'postgres-shared|redis-shared'
#
# 3. Create Authentik data directories (if not exists):
#    mkdir -p ~/docker-data/authentik/{media,certs,custom-templates}
#
# 4. Create .env file with:
#    AUTHENTIK_DB_PASSWORD=<from shared-infrastructure .env>
#    AUTHENTIK_SECRET_KEY=<generate with: openssl rand -base64 60>
#
# 5. Deploy this stack:
#    docker-compose -f authentik-shared.yml --env-file .env.authentik-shared up -d
#
# After Deployment:
#
# 1. Wait for containers to start (may take 30-60 seconds for DB migrations)
#
# 2. Check logs:
#    docker logs authentik-server
#    docker logs authentik-worker
#
# 3. Access initial setup: http://localhost:9000/if/flow/initial-setup/
#    - Create admin account (akadmin recommended)
#    - Set strong password
#
# 4. Configure NPM reverse proxy:
#    - Domain: auth.schweitz.net
#    - Forward to: authentik-server:9000
#    - SSL: Let's Encrypt
#    - Websockets: Enabled
#
# 5. Access admin interface: https://auth.schweitz.net/if/admin/
#
# Connection Details:
#
# Database:
#   - Host: postgres-shared (from containers) / localhost (from host)
#   - Port: 5432
#   - Database: authentik
#   - User: authentik_user
#
# Cache:
#   - Host: redis-shared (from containers) / localhost (from host)
#   - Port: 6379
#   - Database: 1
#
# Resource Usage (optimized for home use):
#   - Server: 256MB RAM limit (WORKERS=2 reduces Gunicorn processes)
#   - Worker: 192MB RAM limit
#   - Proxy Outpost: ~32MB RAM
#   - Total Authentik: ~480MB max (vs ~700MB with dedicated PostgreSQL/Redis)
#   - Savings: ~400MB by using shared infrastructure!