services:
  auth-postgresql:
    # env_file:
    # - .env
    environment:
      POSTGRES_DB: authentik
      POSTGRES_USER: authentik
      POSTGRES_PASSWORD: password
    healthcheck:
      interval: 30s
      retries: 5
      start_period: 20s
      test:
      - CMD-SHELL
      - pg_isready -d authentik -U authentik
      timeout: 5s
    image: docker.io/library/postgres:16-alpine
    restart: unless-stopped
    volumes:
    - database:/var/lib/postgresql/data
    networks:
      - auth
      - mail
  authentik:
    command: server
    depends_on:
      auth-postgresql:
        condition: service_healthy
    env_file:
    - /data/authentik/env
    - ./authentik.env
    environment:
      AUTHENTIK_POSTGRESQL__HOST: auth-postgresql
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: password
      # AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
    image: ghcr.io/goauthentik/server:2026.2.2
    ports:
    - 9000:9000
    - 9443:9443
    restart: unless-stopped
    shm_size: 512mb
    volumes:
    - /data/authentik/data:/data
    - /data/authentik/custom-templates:/templates
    networks:
      - auth
      - mail
  auth-worker:
    command: worker
    depends_on:
      auth-postgresql:
        condition: service_healthy
    env_file:
    - /data/authentik/env
    - ./authentik.env
    environment:
      AUTHENTIK_POSTGRESQL__HOST: auth-postgresql
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: password
      # AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
    image: ghcr.io/goauthentik/server:2026.2.2
    restart: unless-stopped
    shm_size: 512mb
    user: root
    volumes:
    - /var/run/docker.sock:/var/run/docker.sock
    - /data/authentik/data:/data
    - /data/authentik/certs:/certs
    - /data/authentik/custom-templates:/templates
    networks:
      - auth
      - mail
volumes:
  database:
    driver: local