services:
  authentik:
    image: ghcr.io/goauthentik/server:latest
    container_name: authentik
    restart: unless-stopped
    command: server
    env_file:
      - .env
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgres
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
      AUTHENTIK_AVATARS: none
      AUTHENTIK_LOG_LEVEL: info
    volumes:
      - ./media:/media
      - ./custom-templates:/templates
    labels:
      # --- Traefik 路由 ---
      - "traefik.enable=true"
      - "traefik.http.routers.authentik.rule=Host(`auth.xiteng.site`)"
      - "traefik.http.services.authentik.loadbalancer.server.port=9000"
      - "traefik.http.routers.authentik.entrypoints=websecure"
      - "traefik.http.routers.authentik.tls=true"
      - "traefik.http.routers.authentik.tls.certresolver=cfresolver"
      # --- HTTP 入口 ---
      - "traefik.http.routers.authentik-http.rule=Host(`auth.xiteng.site`)"
      - "traefik.http.routers.authentik-http.service=authentik"
      - "traefik.http.routers.authentik-http.entrypoints=web"
      # --- Homepage ---
      - "homepage.group=我的服务"
      - "homepage.name=Authentik"
      - "homepage.icon=authentik"
      - "homepage.href=https://auth.xiteng.site"
      - "homepage.description=统一认证"
      # --- AutoKuma ---
      - "kuma.authentik.http.name=Authentik"
      - "kuma.authentik.http.url=http://authentik:9000/-/health/ready/"
      - "kuma.authentik.http.interval=60"
      - "kuma.authentik.http.max_retries=3"
    networks:
      - homelab_net

  postgres:
    image: postgres:16-alpine
    container_name: authentik-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: authentik
      POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD}
      POSTGRES_DB: authentik
    volumes:
      - ./pgdata:/var/lib/postgresql/data
    networks:
      - homelab_net

  redis:
    image: redis:alpine
    container_name: authentik-redis
    restart: unless-stopped
    volumes:
      - ./redis:/data
    networks:
      - homelab_net

networks:
  homelab_net:
    external: true