Add authentik stuff
This commit is contained in:
78
authentik.yaml
Normal file
78
authentik.yaml
Normal file
@@ -0,0 +1,78 @@
|
|||||||
|
services:
|
||||||
|
auth-postgresql:
|
||||||
|
# env_file:
|
||||||
|
# - .env
|
||||||
|
environment:
|
||||||
|
POSTGRES_DB: authentik
|
||||||
|
POSTGRES_USER: authentik
|
||||||
|
POSTGRES_PASSWORD: password
|
||||||
|
healthcheck:
|
||||||
|
interval: 30s
|
||||||
|
retries: 5
|
||||||
|
start_period: 20s
|
||||||
|
test:
|
||||||
|
- CMD-SHELL
|
||||||
|
- pg_isready -d authentik -U authentik
|
||||||
|
timeout: 5s
|
||||||
|
image: docker.io/library/postgres:16-alpine
|
||||||
|
restart: unless-stopped
|
||||||
|
volumes:
|
||||||
|
- database:/var/lib/postgresql/data
|
||||||
|
networks:
|
||||||
|
- auth
|
||||||
|
- mail
|
||||||
|
authentik:
|
||||||
|
command: server
|
||||||
|
depends_on:
|
||||||
|
auth-postgresql:
|
||||||
|
condition: service_healthy
|
||||||
|
env_file:
|
||||||
|
- /data/authentik/env
|
||||||
|
- ./authentik.env
|
||||||
|
environment:
|
||||||
|
AUTHENTIK_POSTGRESQL__HOST: auth-postgresql
|
||||||
|
AUTHENTIK_POSTGRESQL__NAME: authentik
|
||||||
|
AUTHENTIK_POSTGRESQL__USER: authentik
|
||||||
|
AUTHENTIK_POSTGRESQL__PASSWORD: password
|
||||||
|
# AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
|
||||||
|
image: ghcr.io/goauthentik/server:2026.2.2
|
||||||
|
ports:
|
||||||
|
- 9000:9000
|
||||||
|
- 9443:9443
|
||||||
|
restart: unless-stopped
|
||||||
|
shm_size: 512mb
|
||||||
|
volumes:
|
||||||
|
- /data/authentik/data:/data
|
||||||
|
- /data/authentik/custom-templates:/templates
|
||||||
|
networks:
|
||||||
|
- auth
|
||||||
|
- mail
|
||||||
|
auth-worker:
|
||||||
|
command: worker
|
||||||
|
depends_on:
|
||||||
|
auth-postgresql:
|
||||||
|
condition: service_healthy
|
||||||
|
env_file:
|
||||||
|
- /data/authentik/env
|
||||||
|
- ./authentik.env
|
||||||
|
environment:
|
||||||
|
AUTHENTIK_POSTGRESQL__HOST: auth-postgresql
|
||||||
|
AUTHENTIK_POSTGRESQL__NAME: authentik
|
||||||
|
AUTHENTIK_POSTGRESQL__USER: authentik
|
||||||
|
AUTHENTIK_POSTGRESQL__PASSWORD: password
|
||||||
|
# AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
|
||||||
|
image: ghcr.io/goauthentik/server:2026.2.2
|
||||||
|
restart: unless-stopped
|
||||||
|
shm_size: 512mb
|
||||||
|
user: root
|
||||||
|
volumes:
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
|
- /data/authentik/data:/data
|
||||||
|
- /data/authentik/certs:/certs
|
||||||
|
- /data/authentik/custom-templates:/templates
|
||||||
|
networks:
|
||||||
|
- auth
|
||||||
|
- mail
|
||||||
|
volumes:
|
||||||
|
database:
|
||||||
|
driver: local
|
||||||
49
nginx/sites-enabled/authentik
Normal file
49
nginx/sites-enabled/authentik
Normal file
@@ -0,0 +1,49 @@
|
|||||||
|
# Upgrade WebSocket if requested, otherwise use keepalive
|
||||||
|
map $http_upgrade $connection_upgrade_keepalive {
|
||||||
|
default upgrade;
|
||||||
|
'' '';
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
# Nginx versions 1.25+
|
||||||
|
listen 443 ssl;
|
||||||
|
listen [::]:443 ssl;
|
||||||
|
http2 on;
|
||||||
|
|
||||||
|
server_name authentik.loadingm.xyz;
|
||||||
|
acme_certificate letsencrypt;
|
||||||
|
ssl_certificate $acme_certificate;
|
||||||
|
ssl_certificate_key $acme_certificate_key;
|
||||||
|
ssl_certificate_cache max=2;
|
||||||
|
|
||||||
|
## The default `client_max_body_size` is 1M, this might not be enough for some posters, etc.
|
||||||
|
client_max_body_size 20M;
|
||||||
|
|
||||||
|
# Security / XSS Mitigation Headers
|
||||||
|
add_header X-Content-Type-Options "nosniff";
|
||||||
|
|
||||||
|
# Permissions policy. May cause issues with some clients
|
||||||
|
add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;
|
||||||
|
|
||||||
|
# Content Security Policy
|
||||||
|
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
|
||||||
|
# Enforces https content and restricts JS/CSS to origin
|
||||||
|
# External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
|
||||||
|
add_header Content-Security-Policy "default-src https: data: blob: ; img-src 'self' https://* ; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'; font-src 'self'";
|
||||||
|
|
||||||
|
location / {
|
||||||
|
# Proxy main karakeep traffic
|
||||||
|
proxy_pass http://authentik:9000;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_set_header X-Forwarded-Protocol $scheme;
|
||||||
|
proxy_set_header X-Forwarded-Host $http_host;
|
||||||
|
proxy_set_header Host $http_host;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection $connection_upgrade_keepalive;
|
||||||
|
|
||||||
|
# Disable buffering when the nginx proxy gets very resource heavy upon streaming
|
||||||
|
proxy_buffering off;
|
||||||
|
}
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user