services:
  outpost:
    image: ghcr.io/goauthentik/proxy:2026.5.0
    container_name: authentik-outpost
    restart: unless-stopped
    environment:
      AUTHENTIK_HOST: https://auth.xiteng.site
      AUTHENTIK_TOKEN: ${AUTHENTIK_OUTPOST_TOKEN}
      AUTHENTIK_INSECURE: "true"
    ports:
      - "9002:9000"
      - "9443:9443"
    labels:
      # --- Outpost 自身管理界面 ---
      - "traefik.enable=true"
      - "traefik.http.routers.outpost.rule=Host(`outpost.xiteng.site`)"
      - "traefik.http.services.outpost.loadbalancer.server.port=9000"
      - "traefik.http.routers.outpost.entrypoints=websecure"
      - "traefik.http.routers.outpost.tls=true"
      - "traefik.http.routers.outpost.tls.certresolver=cfresolver"
      - "traefik.http.routers.outpost-http.rule=Host(`outpost.xiteng.site`)"
      - "traefik.http.routers.outpost-http.service=outpost"
      - "traefik.http.routers.outpost-http.entrypoints=web"
    networks:
      - homelab_net

networks:
  homelab_net:
    external: true