docs: 同步 README 至当前 homelab 状态

- 添加 Authentik SSO 统一认证架构说明 - MinIO → SeaweedFS v4.28，域名 s3 → file.xiteng.site - 补充 Authentik ForwardAuth + 独立 Outpost 的认证架构图 - 更新目录结构（authentik/、outpost/、outpost-seaweedfs/、seaweedfs/） - 更新服务一览表（增加认证方式列） - 更新快速启动命令（包含新增服务）
fix: pin cloudflared to 2025.5.0; add Authentik unified auth service
2026-05-27 19:42:10 +08:00 · 2026-05-25 23:31:17 +08:00
3 changed files with 132 additions and 22 deletions
@@ -7,43 +7,73 @@
 ```
 公网用户
  │
-  ├─ Web (443) ──→ Cloudflare Tunnel ──→ cloudflared (Docker) ──→ Traefik (反向代理)
-  │                                                                 │
-  └─ SSH (22)  ──→ 阿里云 VPS (frps) ──→ frpc (Docker) ──→ Gitea  │
-                                                                    │
-                                                    ┌───────────────┤
-                                                    ▼               ▼
-                                                 各 Web 服务      Gitea SSH
+  ├─ Web (443) ──→ Cloudflare Tunnel ──→ cloudflared (Docker, HTTP/2)
+  │                                       │
+  └─ SSH (22)  ──→ 阿里云 VPS (frps) ──→ frpc (Docker) ──→ Gitea
+                                           │
+                              Traefik v3.7.1 (反向代理)
+                                    │
+                    ┌───────────────┼───────────────────┐
+                    ▼               ▼                   ▼
+              (有 Authentik SSO)  (ForwardAuth)      (免认证)
+              Gitea / HedgeDoc    SeaweedFS /        Gitea SSH
+              Homepage            Uptime Kuma
 ```

 | 入口 | 域名 | 传输 | 延迟 |
 |------|------|------|:--:|
-| Web | `*.xiteng.site` | Cloudflare Tunnel → Traefik | ~50ms |
+| Web | `*.xiteng.site` | Cloudflare Tunnel (HTTP/2) → Traefik | ~50ms |
 | Git SSH | `git.xiteng.site` | 阿里云 VPS → frp → Gitea | ~5ms |

 ## 服务一览

-| 服务 | 地址 | 说明 |
-|------|------|------|
-| Homepage | [xiteng.site](https://xiteng.site) | 导航面板 |
-| Gitea | [gitea.xiteng.site](https://gitea.xiteng.site) | 代码托管, `git clone git@git.xiteng.site:…` |
-| HedgeDoc | [notes.xiteng.site](https://notes.xiteng.site) | Markdown 协作 |
-| Uptime Kuma | [uptime.xiteng.site](https://uptime.xiteng.site) | 服务监控 |
-| MinIO | 内网 | 对象存储（不暴露公网） |
-| Traefik | 内网 | 反向代理 |
+| 服务 | 地址 | 认证 | 说明 |
+|------|------|------|------|
+| Homepage | [home.xiteng.site](https://home.xiteng.site) | Authentik OIDC | 导航面板 |
+| Authentik | [auth.xiteng.site](https://auth.xiteng.site) | 自身 | 统一 SSO (v2026.5.0) |
+| Gitea | [gitea.xiteng.site](https://gitea.xiteng.site) | Authentik OAuth2 | 代码托管 |
+| HedgeDoc | [notes.xiteng.site](https://notes.xiteng.site) | Authentik OIDC | Markdown 协作 |
+| SeaweedFS | [file.xiteng.site](https://file.xiteng.site) | Authentik ForwardAuth | 对象存储 (v4.28) |
+| SeaweedFS S3 | [minio-api.xiteng.site](https://minio-api.xiteng.site) | Access Key | S3 API |
+| Uptime Kuma | [uptime.xiteng.site](https://uptime.xiteng.site) | Authentik ForwardAuth | 服务监控 |
+| Traefik | 内网 | — | 反向代理 |
+
+> **注意**: SeaweedFS 已替代原 MinIO。域名于 2026-05-27 从 `s3.xiteng.site` 迁移至 `file.xiteng.site`。
+
+## 认证架构
+
+```
+用户请求 → Cloudflare → cloudflared → Traefik
+                                        │
+                          ┌─────────────┤
+                          ▼             ▼
+                    ForwardAuth     OAuth2/OIDC
+                    (中间件子请求)    (应用层重定向)
+                          │             │
+                          ▼             ▼
+                   Authentik Outpost  Authentik Server
+                   (proxy container)  (Django)
+```
+
+- **OAuth2/OIDC**: Gitea、HedgeDoc、Homepage 各自持有 client_id/secret，用户从应用发起登录
+- **ForwardAuth**: SeaweedFS、Uptime Kuma 由 Traefik 中间件在请求到达前拦截验证
+- **独立 Outpost**: SeaweedFS 和 Uptime Kuma 各用独立 proxy outpost 容器（避免 cookie domain 冲突）

 ## 目录结构

 ```
 homelab/
-├── compose.yml            # 共享网络定义 (homelab_net)
-├── .env                   # 统一环境变量（敏感，gitignore）
+├── compose.yml              # 共享网络定义 (homelab_net)
+├── .env                     # 统一环境变量（敏感，gitignore）
+├── authentik/
+│   ├── compose.yml
+│   └── data/
 ├── cloudflared/
 │   ├── compose.yml
 │   └── config.yml
 ├── frpc/
 │   ├── compose.yml
-│   └── frpc.toml          # 敏感，gitignore
+│   └── frpc.toml            # 敏感，gitignore
 ├── gitea/
 │   ├── compose.yml
 │   └── data/
@@ -53,12 +83,18 @@ homelab/
 ├── homepage/
 │   ├── compose.yml
 │   └── config/
-├── minio/
+├── outpost/
+│   ├── compose.yml          # Uptime Kuma outpost
+│   └── ...
+├── outpost-seaweedfs/
+│   └── compose.yml          # SeaweedFS 独立 outpost
+├── seaweedfs/
 │   ├── compose.yml
+│   ├── security.toml        # JWT 已全部注释（社区版 UI 不支持 OIDC）
 │   └── data/
 ├── traefik/
 │   ├── compose.yml
-│   └── letsencrypt/       # gitignore
+│   └── letsencrypt/         # gitignore
 └── uptime-kuma/
    ├── compose.yml
    └── data/
@@ -74,10 +110,14 @@ homelab/
 # 按依赖顺序启动
 docker compose -f compose.yml up -d          # 创建网络
 docker compose -f traefik/compose.yml up -d
+docker compose -f authentik/compose.yml up -d
 docker compose -f gitea/compose.yml up -d
 docker compose -f hedgedoc/compose.yml up -d
+docker compose -f seaweedfs/compose.yml up -d
 docker compose -f uptime-kuma/compose.yml up -d
 docker compose -f homepage/compose.yml up -d
+docker compose -f outpost/compose.yml up -d
+docker compose -f outpost-seaweedfs/compose.yml up -d
 docker compose -f cloudflared/compose.yml up -d
 docker compose -f frpc/compose.yml up -d
 ```
@@ -0,0 +1,70 @@
+services:
+  authentik:
+    image: ghcr.io/goauthentik/server:latest
+    container_name: authentik
+    restart: unless-stopped
+    command: server
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_POSTGRESQL__HOST: postgres
+      AUTHENTIK_POSTGRESQL__NAME: authentik
+      AUTHENTIK_POSTGRESQL__USER: authentik
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
+      AUTHENTIK_AVATARS: none
+      AUTHENTIK_LOG_LEVEL: info
+    volumes:
+      - ./media:/media
+      - ./custom-templates:/templates
+    labels:
+      # --- Traefik 路由 ---
+      - "traefik.enable=true"
+      - "traefik.http.routers.authentik.rule=Host(`auth.xiteng.site`)"
+      - "traefik.http.services.authentik.loadbalancer.server.port=9000"
+      - "traefik.http.routers.authentik.entrypoints=websecure"
+      - "traefik.http.routers.authentik.tls=true"
+      - "traefik.http.routers.authentik.tls.certresolver=cfresolver"
+      # --- HTTP 入口 ---
+      - "traefik.http.routers.authentik-http.rule=Host(`auth.xiteng.site`)"
+      - "traefik.http.routers.authentik-http.service=authentik"
+      - "traefik.http.routers.authentik-http.entrypoints=web"
+      # --- Homepage ---
+      - "homepage.group=我的服务"
+      - "homepage.name=Authentik"
+      - "homepage.icon=authentik"
+      - "homepage.href=https://auth.xiteng.site"
+      - "homepage.description=统一认证"
+      # --- AutoKuma ---
+      - "kuma.authentik.http.name=Authentik"
+      - "kuma.authentik.http.url=http://authentik:9000/-/health/ready/"
+      - "kuma.authentik.http.interval=60"
+      - "kuma.authentik.http.max_retries=3"
+    networks:
+      - homelab_net
+
+  postgres:
+    image: postgres:16-alpine
+    container_name: authentik-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: authentik
+      POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD}
+      POSTGRES_DB: authentik
+    volumes:
+      - ./pgdata:/var/lib/postgresql/data
+    networks:
+      - homelab_net
+
+  redis:
+    image: redis:alpine
+    container_name: authentik-redis
+    restart: unless-stopped
+    volumes:
+      - ./redis:/data
+    networks:
+      - homelab_net
+
+networks:
+  homelab_net:
+    external: true
@@ -1,6 +1,6 @@
 services:
  cloudflared:
-    image: cloudflare/cloudflared:latest
+    image: cloudflare/cloudflared:2025.5.0
    container_name: cloudflared
    restart: unless-stopped
    command: tunnel --protocol http2 run