159 lines
7.5 KiB
YAML
159 lines
7.5 KiB
YAML
services:
|
||
authentik:
|
||
image: ghcr.io/goauthentik/server:2026.5.6
|
||
container_name: authentik
|
||
restart: unless-stopped
|
||
command: server
|
||
env_file:
|
||
- .env
|
||
environment:
|
||
AUTHENTIK_REDIS__HOST: redis
|
||
AUTHENTIK_POSTGRESQL__HOST: postgres
|
||
AUTHENTIK_POSTGRESQL__NAME: authentik
|
||
AUTHENTIK_POSTGRESQL__USER: authentik
|
||
AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
|
||
AUTHENTIK_AVATARS: none
|
||
AUTHENTIK_LOG_LEVEL: info
|
||
AUTHENTIK_SECURITY__TRUSTED_PROXY_CIDR: 172.18.0.0/16
|
||
volumes:
|
||
- ./media:/media
|
||
- ./custom-templates:/templates
|
||
- ./assets:/web/dist/assets/xiteng:ro
|
||
- ./blueprints/xiteng-brand.yaml:/blueprints/xiteng-brand.yaml:ro
|
||
- ./blueprints/xiteng-chat.yaml:/blueprints/xiteng-chat.yaml:ro
|
||
- ./blueprints/xiteng-recovery.yaml:/blueprints/xiteng-recovery.yaml:ro
|
||
- ./blueprints/xiteng-passwordless.yaml:/blueprints/xiteng-passwordless.yaml:ro
|
||
- ./bootstrap.py:/bootstrap/portal_identity.py:ro
|
||
- ./secrets:/run/secrets
|
||
labels:
|
||
# --- Traefik 路由 ---
|
||
- "traefik.enable=true"
|
||
- "traefik.http.routers.authentik.rule=Host(`auth.xiteng.site`)"
|
||
- "traefik.http.services.authentik.loadbalancer.server.port=9000"
|
||
- "traefik.http.routers.authentik.entrypoints=websecure"
|
||
- "traefik.http.routers.authentik.tls=true"
|
||
- "traefik.http.routers.authentik.tls.certresolver=cfresolver"
|
||
# 强制 X-Forwarded-Proto 为 https（Tunnel 走 HTTP:80 入口，Traefik 不知道外层是 HTTPS）
|
||
- "traefik.http.middlewares.force-https-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
|
||
- "traefik.http.routers.authentik.middlewares=force-https-headers"
|
||
- "traefik.http.routers.authentik-http.middlewares=force-https-headers"
|
||
# --- HTTP 入口 ---
|
||
- "traefik.http.routers.authentik-http.rule=Host(`auth.xiteng.site`)"
|
||
- "traefik.http.routers.authentik-http.service=authentik"
|
||
- "traefik.http.routers.authentik-http.entrypoints=web"
|
||
# Label-managed static paths. The shared edge-cache controller creates
|
||
# higher-priority Traefik routes and the matching Cloudflare Cache Rule.
|
||
- "xiteng.site.cache.frontend.enabled=true"
|
||
- "xiteng.site.cache.frontend.routers=authentik,authentik-http"
|
||
- "xiteng.site.cache.frontend.paths=/static/dist/"
|
||
- "xiteng.site.cache.frontend.edge-ttl=604800"
|
||
- "xiteng.site.cache.frontend.stale-while-revalidate=86400"
|
||
# --- Xiteng Site dynamic catalog ---
|
||
- "xiteng.site.component.authentik.enabled=true"
|
||
- "xiteng.site.component.authentik.name=Authentik"
|
||
- "xiteng.site.component.authentik.description=隐藏的 OAuth2/OIDC、ForwardAuth 与身份数据引擎；通过 Portal 管理。"
|
||
- "xiteng.site.component.authentik.section=infrastructure"
|
||
- "xiteng.site.component.authentik.category=身份与访问"
|
||
- "xiteng.site.component.authentik.access=internal"
|
||
- "xiteng.site.component.authentik.access-label=后台身份引擎 · 通过 Portal 管理"
|
||
- "xiteng.site.component.authentik.icon=AK"
|
||
- "xiteng.site.component.authentik.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/authentik.svg"
|
||
- "xiteng.site.component.authentik.accent=red"
|
||
- "xiteng.site.component.authentik.order=200"
|
||
- "xiteng.site.component.authentik.monitor.enabled=true"
|
||
- "xiteng.site.component.authentik.monitor.url=http://authentik:9000/-/health/ready/"
|
||
networks:
|
||
- homelab_net
|
||
|
||
worker:
|
||
image: ghcr.io/goauthentik/server:2026.5.6
|
||
container_name: authentik-worker
|
||
restart: unless-stopped
|
||
command: worker
|
||
env_file:
|
||
- .env
|
||
environment:
|
||
AUTHENTIK_REDIS__HOST: redis
|
||
AUTHENTIK_POSTGRESQL__HOST: postgres
|
||
AUTHENTIK_POSTGRESQL__NAME: authentik
|
||
AUTHENTIK_POSTGRESQL__USER: authentik
|
||
AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
|
||
AUTHENTIK_AVATARS: none
|
||
AUTHENTIK_LOG_LEVEL: info
|
||
user: root
|
||
volumes:
|
||
- ./media:/media
|
||
- ./custom-templates:/templates
|
||
- ./blueprints/xiteng-recovery.yaml:/blueprints/xiteng-recovery.yaml:ro
|
||
- ./blueprints/xiteng-brand.yaml:/blueprints/xiteng-brand.yaml:ro
|
||
- ./blueprints/xiteng-chat.yaml:/blueprints/xiteng-chat.yaml:ro
|
||
- ./blueprints/xiteng-passwordless.yaml:/blueprints/xiteng-passwordless.yaml:ro
|
||
labels:
|
||
- "traefik.enable=false"
|
||
- "xiteng.site.component.authentik-worker.enabled=true"
|
||
- "xiteng.site.component.authentik-worker.name=Authentik Worker"
|
||
- "xiteng.site.component.authentik-worker.description=执行身份系统后台任务并自动应用 Blueprint。"
|
||
- "xiteng.site.component.authentik-worker.section=infrastructure"
|
||
- "xiteng.site.component.authentik-worker.category=身份与访问"
|
||
- "xiteng.site.component.authentik-worker.access=internal"
|
||
- "xiteng.site.component.authentik-worker.access-label=后台任务组件"
|
||
- "xiteng.site.component.authentik-worker.icon=WK"
|
||
- "xiteng.site.component.authentik-worker.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/authentik.svg"
|
||
- "xiteng.site.component.authentik-worker.accent=yellow"
|
||
- "xiteng.site.component.authentik-worker.order=205"
|
||
depends_on:
|
||
- postgres
|
||
- redis
|
||
networks:
|
||
- homelab_net
|
||
|
||
postgres:
|
||
image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
|
||
container_name: authentik-db
|
||
restart: unless-stopped
|
||
environment:
|
||
POSTGRES_USER: authentik
|
||
POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD}
|
||
POSTGRES_DB: authentik
|
||
labels:
|
||
- "xiteng.site.component.authentik-db.enabled=true"
|
||
- "xiteng.site.component.authentik-db.name=Authentik PostgreSQL"
|
||
- "xiteng.site.component.authentik-db.description=保存身份、Provider、应用与策略配置。"
|
||
- "xiteng.site.component.authentik-db.section=infrastructure"
|
||
- "xiteng.site.component.authentik-db.category=数据层"
|
||
- "xiteng.site.component.authentik-db.access=internal"
|
||
- "xiteng.site.component.authentik-db.access-label=仅容器网络"
|
||
- "xiteng.site.component.authentik-db.icon=PG"
|
||
- "xiteng.site.component.authentik-db.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/postgresql.svg"
|
||
- "xiteng.site.component.authentik-db.accent=blue"
|
||
- "xiteng.site.component.authentik-db.order=510"
|
||
volumes:
|
||
- ./pgdata:/var/lib/postgresql/data
|
||
networks:
|
||
- homelab_net
|
||
|
||
redis:
|
||
image: redis:alpine@sha256:978f0e01593e65eed801f2402944efcd936d43b5027e4908a7897baf88ed6241
|
||
container_name: authentik-redis
|
||
restart: unless-stopped
|
||
labels:
|
||
- "xiteng.site.component.authentik-redis.enabled=true"
|
||
- "xiteng.site.component.authentik-redis.name=Authentik Redis"
|
||
- "xiteng.site.component.authentik-redis.description=为身份服务提供缓存与任务状态。"
|
||
- "xiteng.site.component.authentik-redis.section=infrastructure"
|
||
- "xiteng.site.component.authentik-redis.category=数据层"
|
||
- "xiteng.site.component.authentik-redis.access=internal"
|
||
- "xiteng.site.component.authentik-redis.access-label=仅容器网络"
|
||
- "xiteng.site.component.authentik-redis.icon=RD"
|
||
- "xiteng.site.component.authentik-redis.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/redis.svg"
|
||
- "xiteng.site.component.authentik-redis.accent=red"
|
||
- "xiteng.site.component.authentik-redis.order=520"
|
||
volumes:
|
||
- ./redis:/data
|
||
networks:
|
||
- homelab_net
|
||
|
||
networks:
|
||
homelab_net:
|
||
external: true
|