feat: rebuild xiteng.site homelab platform

authentik/compose.yml

@@ -1,6 +1,6 @@
 services:
   authentik:
-    image: ghcr.io/goauthentik/server:2026.5.0
+    image: ghcr.io/goauthentik/server:2026.5.6
     container_name: authentik
     restart: unless-stopped
     command: server
@@ -18,6 +18,13 @@ services:
     volumes:
       - ./media:/media
       - ./custom-templates:/templates
+      - ./assets:/web/dist/assets/xiteng:ro
+      - ./blueprints/xiteng-brand.yaml:/blueprints/xiteng-brand.yaml:ro
+      - ./blueprints/xiteng-chat.yaml:/blueprints/xiteng-chat.yaml:ro
+      - ./blueprints/xiteng-recovery.yaml:/blueprints/xiteng-recovery.yaml:ro
+      - ./blueprints/xiteng-passwordless.yaml:/blueprints/xiteng-passwordless.yaml:ro
+      - ./bootstrap.py:/bootstrap/portal_identity.py:ro
+      - ./secrets:/run/secrets
     labels:
       # --- Traefik 路由 ---
       - "traefik.enable=true"
@@ -34,37 +41,113 @@ services:
       - "traefik.http.routers.authentik-http.rule=Host(`auth.xiteng.site`)"
       - "traefik.http.routers.authentik-http.service=authentik"
       - "traefik.http.routers.authentik-http.entrypoints=web"
-      # --- Homepage ---
-      - "homepage.group=我的服务"
-      - "homepage.name=Authentik"
-      - "homepage.icon=authentik"
-      - "homepage.href=https://auth.xiteng.site"
-      - "homepage.description=统一认证"
-      # --- AutoKuma ---
-      - "kuma.authentik.http.name=Authentik"
-      - "kuma.authentik.http.url=http://authentik:9000/-/health/ready/"
-      - "kuma.authentik.http.interval=60"
-      - "kuma.authentik.http.max_retries=3"
+      # Label-managed static paths. The shared edge-cache controller creates
+      # higher-priority Traefik routes and the matching Cloudflare Cache Rule.
+      - "xiteng.site.cache.frontend.enabled=true"
+      - "xiteng.site.cache.frontend.routers=authentik,authentik-http"
+      - "xiteng.site.cache.frontend.paths=/static/dist/"
+      - "xiteng.site.cache.frontend.edge-ttl=604800"
+      - "xiteng.site.cache.frontend.stale-while-revalidate=86400"
+      # --- Xiteng Site dynamic catalog ---
+      - "xiteng.site.component.authentik.enabled=true"
+      - "xiteng.site.component.authentik.name=Authentik"
+      - "xiteng.site.component.authentik.description=隐藏的 OAuth2/OIDC、ForwardAuth 与身份数据引擎；通过 Portal 管理。"
+      - "xiteng.site.component.authentik.section=infrastructure"
+      - "xiteng.site.component.authentik.category=身份与访问"
+      - "xiteng.site.component.authentik.access=internal"
+      - "xiteng.site.component.authentik.access-label=后台身份引擎 · 通过 Portal 管理"
+      - "xiteng.site.component.authentik.icon=AK"
+      - "xiteng.site.component.authentik.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/authentik.svg"
+      - "xiteng.site.component.authentik.accent=red"
+      - "xiteng.site.component.authentik.order=200"
+      - "xiteng.site.component.authentik.monitor.enabled=true"
+      - "xiteng.site.component.authentik.monitor.url=http://authentik:9000/-/health/ready/"
+    networks:
+      - homelab_net
+
+  worker:
+    image: ghcr.io/goauthentik/server:2026.5.6
+    container_name: authentik-worker
+    restart: unless-stopped
+    command: worker
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_POSTGRESQL__HOST: postgres
+      AUTHENTIK_POSTGRESQL__NAME: authentik
+      AUTHENTIK_POSTGRESQL__USER: authentik
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
+      AUTHENTIK_AVATARS: none
+      AUTHENTIK_LOG_LEVEL: info
+    user: root
+    volumes:
+      - ./media:/media
+      - ./custom-templates:/templates
+      - ./blueprints/xiteng-recovery.yaml:/blueprints/xiteng-recovery.yaml:ro
+      - ./blueprints/xiteng-brand.yaml:/blueprints/xiteng-brand.yaml:ro
+      - ./blueprints/xiteng-chat.yaml:/blueprints/xiteng-chat.yaml:ro
+      - ./blueprints/xiteng-passwordless.yaml:/blueprints/xiteng-passwordless.yaml:ro
+    labels:
+      - "traefik.enable=false"
+      - "xiteng.site.component.authentik-worker.enabled=true"
+      - "xiteng.site.component.authentik-worker.name=Authentik Worker"
+      - "xiteng.site.component.authentik-worker.description=执行身份系统后台任务并自动应用 Blueprint。"
+      - "xiteng.site.component.authentik-worker.section=infrastructure"
+      - "xiteng.site.component.authentik-worker.category=身份与访问"
+      - "xiteng.site.component.authentik-worker.access=internal"
+      - "xiteng.site.component.authentik-worker.access-label=后台任务组件"
+      - "xiteng.site.component.authentik-worker.icon=WK"
+      - "xiteng.site.component.authentik-worker.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/authentik.svg"
+      - "xiteng.site.component.authentik-worker.accent=yellow"
+      - "xiteng.site.component.authentik-worker.order=205"
+    depends_on:
+      - postgres
+      - redis
     networks:
       - homelab_net
 
   postgres:
-    image: postgres:16-alpine
+    image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
     container_name: authentik-db
     restart: unless-stopped
     environment:
       POSTGRES_USER: authentik
       POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD}
       POSTGRES_DB: authentik
+    labels:
+      - "xiteng.site.component.authentik-db.enabled=true"
+      - "xiteng.site.component.authentik-db.name=Authentik PostgreSQL"
+      - "xiteng.site.component.authentik-db.description=保存身份、Provider、应用与策略配置。"
+      - "xiteng.site.component.authentik-db.section=infrastructure"
+      - "xiteng.site.component.authentik-db.category=数据层"
+      - "xiteng.site.component.authentik-db.access=internal"
+      - "xiteng.site.component.authentik-db.access-label=仅容器网络"
+      - "xiteng.site.component.authentik-db.icon=PG"
+      - "xiteng.site.component.authentik-db.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/postgresql.svg"
+      - "xiteng.site.component.authentik-db.accent=blue"
+      - "xiteng.site.component.authentik-db.order=510"
     volumes:
       - ./pgdata:/var/lib/postgresql/data
     networks:
       - homelab_net
 
   redis:
-    image: redis:alpine
+    image: redis:alpine@sha256:978f0e01593e65eed801f2402944efcd936d43b5027e4908a7897baf88ed6241
     container_name: authentik-redis
     restart: unless-stopped
+    labels:
+      - "xiteng.site.component.authentik-redis.enabled=true"
+      - "xiteng.site.component.authentik-redis.name=Authentik Redis"
+      - "xiteng.site.component.authentik-redis.description=为身份服务提供缓存与任务状态。"
+      - "xiteng.site.component.authentik-redis.section=infrastructure"
+      - "xiteng.site.component.authentik-redis.category=数据层"
+      - "xiteng.site.component.authentik-redis.access=internal"
+      - "xiteng.site.component.authentik-redis.access-label=仅容器网络"
+      - "xiteng.site.component.authentik-redis.icon=RD"
+      - "xiteng.site.component.authentik-redis.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/redis.svg"
+      - "xiteng.site.component.authentik-redis.accent=red"
+      - "xiteng.site.component.authentik-redis.order=520"
     volumes:
       - ./redis:/data
     networks: