services:
  outpost:
    image: ghcr.io/goauthentik/proxy:2026.5.6
    container_name: authentik-outpost
    restart: unless-stopped
    environment:
      AUTHENTIK_HOST: https://auth.xiteng.site
      AUTHENTIK_TOKEN: ${AUTHENTIK_OUTPOST_TOKEN}
      AUTHENTIK_INSECURE: "true"
    ports:
      - "9002:9000"
      - "9443:9443"
    labels:
      # --- Outpost 自身管理界面 ---
      - "traefik.enable=true"
      - "traefik.http.routers.outpost.rule=Host(`outpost.xiteng.site`)"
      - "traefik.http.services.outpost.loadbalancer.server.port=9000"
      - "traefik.http.routers.outpost.entrypoints=websecure"
      - "traefik.http.routers.outpost.tls=true"
      - "traefik.http.routers.outpost.tls.certresolver=cfresolver"
      - "traefik.http.routers.outpost-http.rule=Host(`outpost.xiteng.site`)"
      - "traefik.http.routers.outpost-http.service=outpost"
      - "traefik.http.routers.outpost-http.entrypoints=web"
      # --- ComfyUI ForwardAuth callback ---
      - "traefik.http.routers.comfyui-outpost.rule=Host(`comfy.xiteng.site`) && PathPrefix(`/outpost.goauthentik.io/`)"
      - "traefik.http.routers.comfyui-outpost.entrypoints=websecure"
      - "traefik.http.routers.comfyui-outpost.service=outpost"
      - "traefik.http.routers.comfyui-outpost.priority=100"
      - "traefik.http.routers.comfyui-outpost.tls=true"
      - "traefik.http.routers.comfyui-outpost.tls.certresolver=cfresolver"
      - "traefik.http.routers.comfyui-outpost-http.rule=Host(`comfy.xiteng.site`) && PathPrefix(`/outpost.goauthentik.io/`)"
      - "traefik.http.routers.comfyui-outpost-http.entrypoints=web"
      - "traefik.http.routers.comfyui-outpost-http.service=outpost"
      - "traefik.http.routers.comfyui-outpost-http.priority=100"
      # --- InvokeAI ForwardAuth callback ---
      - "traefik.http.routers.invokeai-outpost.rule=Host(`invoke.xiteng.site`) && PathPrefix(`/outpost.goauthentik.io/`)"
      - "traefik.http.routers.invokeai-outpost.entrypoints=websecure"
      - "traefik.http.routers.invokeai-outpost.service=outpost"
      - "traefik.http.routers.invokeai-outpost.priority=100"
      - "traefik.http.routers.invokeai-outpost.tls=true"
      - "traefik.http.routers.invokeai-outpost.tls.certresolver=cfresolver"
      - "traefik.http.routers.invokeai-outpost-http.rule=Host(`invoke.xiteng.site`) && PathPrefix(`/outpost.goauthentik.io/`)"
      - "traefik.http.routers.invokeai-outpost-http.entrypoints=web"
      - "traefik.http.routers.invokeai-outpost-http.service=outpost"
      - "traefik.http.routers.invokeai-outpost-http.priority=100"
      # --- code-server ForwardAuth callback ---
      - "traefik.http.routers.code-server-outpost.rule=Host(`code.xiteng.site`) && PathPrefix(`/outpost.goauthentik.io/`)"
      - "traefik.http.routers.code-server-outpost.entrypoints=websecure"
      - "traefik.http.routers.code-server-outpost.service=outpost"
      - "traefik.http.routers.code-server-outpost.priority=100"
      - "traefik.http.routers.code-server-outpost.tls=true"
      - "traefik.http.routers.code-server-outpost.tls.certresolver=cfresolver"
      - "traefik.http.routers.code-server-outpost-http.rule=Host(`code.xiteng.site`) && PathPrefix(`/outpost.goauthentik.io/`)"
      - "traefik.http.routers.code-server-outpost-http.entrypoints=web"
      - "traefik.http.routers.code-server-outpost-http.service=outpost"
      - "traefik.http.routers.code-server-outpost-http.priority=100"
      # --- Xiteng Chat ForwardAuth callback ---
      - "traefik.http.routers.xiteng-chat-outpost.rule=Host(`chat.xiteng.site`) && PathPrefix(`/outpost.goauthentik.io/`)"
      - "traefik.http.routers.xiteng-chat-outpost.entrypoints=websecure"
      - "traefik.http.routers.xiteng-chat-outpost.service=outpost"
      - "traefik.http.routers.xiteng-chat-outpost.priority=100"
      - "traefik.http.routers.xiteng-chat-outpost.tls=true"
      - "traefik.http.routers.xiteng-chat-outpost.tls.certresolver=cfresolver"
      - "traefik.http.routers.xiteng-chat-outpost-http.rule=Host(`chat.xiteng.site`) && PathPrefix(`/outpost.goauthentik.io/`)"
      - "traefik.http.routers.xiteng-chat-outpost-http.entrypoints=web"
      - "traefik.http.routers.xiteng-chat-outpost-http.service=outpost"
      - "traefik.http.routers.xiteng-chat-outpost-http.priority=100"
      # --- Xiteng Portal administration ForwardAuth callback ---
      - "traefik.http.routers.xiteng-outpost.rule=Host(`xiteng.site`) && PathPrefix(`/outpost.goauthentik.io/`)"
      - "traefik.http.routers.xiteng-outpost.entrypoints=websecure"
      - "traefik.http.routers.xiteng-outpost.service=outpost"
      - "traefik.http.routers.xiteng-outpost.priority=300"
      - "traefik.http.routers.xiteng-outpost.tls=true"
      - "traefik.http.routers.xiteng-outpost.tls.certresolver=cfresolver"
      - "traefik.http.routers.xiteng-outpost-http.rule=Host(`xiteng.site`) && PathPrefix(`/outpost.goauthentik.io/`)"
      - "traefik.http.routers.xiteng-outpost-http.entrypoints=web"
      - "traefik.http.routers.xiteng-outpost-http.service=outpost"
      - "traefik.http.routers.xiteng-outpost-http.priority=300"
      # --- Xiteng Site dynamic catalog ---
      - "xiteng.site.component.authentik-outpost.enabled=true"
      - "xiteng.site.component.authentik-outpost.name=Authentik Proxy Outpost"
      - "xiteng.site.component.authentik-outpost.description=为受保护 Web 服务执行 ForwardAuth 流程。"
      - "xiteng.site.component.authentik-outpost.section=infrastructure"
      - "xiteng.site.component.authentik-outpost.category=身份与访问"
      - "xiteng.site.component.authentik-outpost.access=internal"
      - "xiteng.site.component.authentik-outpost.access-label=认证回调组件"
      - "xiteng.site.component.authentik-outpost.icon=OP"
      - "xiteng.site.component.authentik-outpost.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/authentik.svg"
      - "xiteng.site.component.authentik-outpost.accent=red"
      - "xiteng.site.component.authentik-outpost.order=210"
    networks:
      - homelab_net

networks:
  homelab_net:
    external: true