services: authentik: image: ghcr.io/goauthentik/server:2026.5.6 container_name: authentik restart: unless-stopped command: server env_file: - .env environment: AUTHENTIK_REDIS__HOST: redis AUTHENTIK_POSTGRESQL__HOST: postgres AUTHENTIK_POSTGRESQL__NAME: authentik AUTHENTIK_POSTGRESQL__USER: authentik AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD} AUTHENTIK_AVATARS: none AUTHENTIK_LOG_LEVEL: info AUTHENTIK_SECURITY__TRUSTED_PROXY_CIDR: 172.18.0.0/16 volumes: - ./media:/media - ./custom-templates:/templates - ./assets:/web/dist/assets/xiteng:ro - ./blueprints/xiteng-brand.yaml:/blueprints/xiteng-brand.yaml:ro - ./blueprints/xiteng-chat.yaml:/blueprints/xiteng-chat.yaml:ro - ./blueprints/xiteng-recovery.yaml:/blueprints/xiteng-recovery.yaml:ro - ./blueprints/xiteng-passwordless.yaml:/blueprints/xiteng-passwordless.yaml:ro - ./bootstrap.py:/bootstrap/portal_identity.py:ro - ./secrets:/run/secrets labels: # --- Traefik 路由 --- - "traefik.enable=true" - "traefik.http.routers.authentik.rule=Host(`auth.xiteng.site`)" - "traefik.http.services.authentik.loadbalancer.server.port=9000" - "traefik.http.routers.authentik.entrypoints=websecure" - "traefik.http.routers.authentik.tls=true" - "traefik.http.routers.authentik.tls.certresolver=cfresolver" # 强制 X-Forwarded-Proto 为 https（Tunnel 走 HTTP:80 入口，Traefik 不知道外层是 HTTPS） - "traefik.http.middlewares.force-https-headers.headers.customrequestheaders.X-Forwarded-Proto=https" - "traefik.http.routers.authentik.middlewares=force-https-headers" - "traefik.http.routers.authentik-http.middlewares=force-https-headers" # --- HTTP 入口 --- - "traefik.http.routers.authentik-http.rule=Host(`auth.xiteng.site`)" - "traefik.http.routers.authentik-http.service=authentik" - "traefik.http.routers.authentik-http.entrypoints=web" # Label-managed static paths. The shared edge-cache controller creates # higher-priority Traefik routes and the matching Cloudflare Cache Rule. - "xiteng.site.cache.frontend.enabled=true" - "xiteng.site.cache.frontend.routers=authentik,authentik-http" - "xiteng.site.cache.frontend.paths=/static/dist/" - "xiteng.site.cache.frontend.edge-ttl=604800" - "xiteng.site.cache.frontend.stale-while-revalidate=86400" # --- Xiteng Site dynamic catalog --- - "xiteng.site.component.authentik.enabled=true" - "xiteng.site.component.authentik.name=Authentik" - "xiteng.site.component.authentik.description=隐藏的 OAuth2/OIDC、ForwardAuth 与身份数据引擎；通过 Portal 管理。" - "xiteng.site.component.authentik.section=infrastructure" - "xiteng.site.component.authentik.category=身份与访问" - "xiteng.site.component.authentik.access=internal" - "xiteng.site.component.authentik.access-label=后台身份引擎 · 通过 Portal 管理" - "xiteng.site.component.authentik.icon=AK" - "xiteng.site.component.authentik.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/authentik.svg" - "xiteng.site.component.authentik.accent=red" - "xiteng.site.component.authentik.order=200" - "xiteng.site.component.authentik.monitor.enabled=true" - "xiteng.site.component.authentik.monitor.url=http://authentik:9000/-/health/ready/" networks: - homelab_net worker: image: ghcr.io/goauthentik/server:2026.5.6 container_name: authentik-worker restart: unless-stopped command: worker env_file: - .env environment: AUTHENTIK_REDIS__HOST: redis AUTHENTIK_POSTGRESQL__HOST: postgres AUTHENTIK_POSTGRESQL__NAME: authentik AUTHENTIK_POSTGRESQL__USER: authentik AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD} AUTHENTIK_AVATARS: none AUTHENTIK_LOG_LEVEL: info user: root volumes: - ./media:/media - ./custom-templates:/templates - ./blueprints/xiteng-recovery.yaml:/blueprints/xiteng-recovery.yaml:ro - ./blueprints/xiteng-brand.yaml:/blueprints/xiteng-brand.yaml:ro - ./blueprints/xiteng-chat.yaml:/blueprints/xiteng-chat.yaml:ro - ./blueprints/xiteng-passwordless.yaml:/blueprints/xiteng-passwordless.yaml:ro labels: - "traefik.enable=false" - "xiteng.site.component.authentik-worker.enabled=true" - "xiteng.site.component.authentik-worker.name=Authentik Worker" - "xiteng.site.component.authentik-worker.description=执行身份系统后台任务并自动应用 Blueprint。" - "xiteng.site.component.authentik-worker.section=infrastructure" - "xiteng.site.component.authentik-worker.category=身份与访问" - "xiteng.site.component.authentik-worker.access=internal" - "xiteng.site.component.authentik-worker.access-label=后台任务组件" - "xiteng.site.component.authentik-worker.icon=WK" - "xiteng.site.component.authentik-worker.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/authentik.svg" - "xiteng.site.component.authentik-worker.accent=yellow" - "xiteng.site.component.authentik-worker.order=205" depends_on: - postgres - redis networks: - homelab_net postgres: image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777 container_name: authentik-db restart: unless-stopped environment: POSTGRES_USER: authentik POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD} POSTGRES_DB: authentik labels: - "xiteng.site.component.authentik-db.enabled=true" - "xiteng.site.component.authentik-db.name=Authentik PostgreSQL" - "xiteng.site.component.authentik-db.description=保存身份、Provider、应用与策略配置。" - "xiteng.site.component.authentik-db.section=infrastructure" - "xiteng.site.component.authentik-db.category=数据层" - "xiteng.site.component.authentik-db.access=internal" - "xiteng.site.component.authentik-db.access-label=仅容器网络" - "xiteng.site.component.authentik-db.icon=PG" - "xiteng.site.component.authentik-db.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/postgresql.svg" - "xiteng.site.component.authentik-db.accent=blue" - "xiteng.site.component.authentik-db.order=510" volumes: - ./pgdata:/var/lib/postgresql/data networks: - homelab_net redis: image: redis:alpine@sha256:978f0e01593e65eed801f2402944efcd936d43b5027e4908a7897baf88ed6241 container_name: authentik-redis restart: unless-stopped labels: - "xiteng.site.component.authentik-redis.enabled=true" - "xiteng.site.component.authentik-redis.name=Authentik Redis" - "xiteng.site.component.authentik-redis.description=为身份服务提供缓存与任务状态。" - "xiteng.site.component.authentik-redis.section=infrastructure" - "xiteng.site.component.authentik-redis.category=数据层" - "xiteng.site.component.authentik-redis.access=internal" - "xiteng.site.component.authentik-redis.access-label=仅容器网络" - "xiteng.site.component.authentik-redis.icon=RD" - "xiteng.site.component.authentik-redis.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/redis.svg" - "xiteng.site.component.authentik-redis.accent=red" - "xiteng.site.component.authentik-redis.order=520" volumes: - ./redis:/data networks: - homelab_net networks: homelab_net: external: true