liooil
8c7eddbaee
新增: - SeaweedFS v4.28 替代 MinIO (域名 file.xiteng.site) - Authentik Outpost (Uptime Kuma + SeaweedFS 独立实例) - ForwardAuth 为 Uptime Kuma 和 SeaweedFS 提供认证 - gpu-exporter.py 监控脚本 升级: - Traefik v3.6 → v3.7 - Authentik 固定版本 2026.5.0 + trusted proxy CIDR - HedgeDoc PG 11 → 16，添加 OIDC 认证 - Homepage 添加 OIDC 认证 安全: - Outpost token 迁移至 .env 引用（不再硬编码） - .gitignore 扩展覆盖数据/缓存/旧 MinIO - security.toml 清理注释掉的旧密钥 移除: - MinIO（已全部迁移至 SeaweedFS）
76 lines
2.6 KiB
YAML
76 lines
2.6 KiB
YAML
services:
|
||
authentik:
|
||
image: ghcr.io/goauthentik/server:2026.5.0
|
||
container_name: authentik
|
||
restart: unless-stopped
|
||
command: server
|
||
env_file:
|
||
- .env
|
||
environment:
|
||
AUTHENTIK_REDIS__HOST: redis
|
||
AUTHENTIK_POSTGRESQL__HOST: postgres
|
||
AUTHENTIK_POSTGRESQL__NAME: authentik
|
||
AUTHENTIK_POSTGRESQL__USER: authentik
|
||
AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
|
||
AUTHENTIK_AVATARS: none
|
||
AUTHENTIK_LOG_LEVEL: info
|
||
AUTHENTIK_SECURITY__TRUSTED_PROXY_CIDR: 172.18.0.0/16
|
||
volumes:
|
||
- ./media:/media
|
||
- ./custom-templates:/templates
|
||
labels:
|
||
# --- Traefik 路由 ---
|
||
- "traefik.enable=true"
|
||
- "traefik.http.routers.authentik.rule=Host(`auth.xiteng.site`)"
|
||
- "traefik.http.services.authentik.loadbalancer.server.port=9000"
|
||
- "traefik.http.routers.authentik.entrypoints=websecure"
|
||
- "traefik.http.routers.authentik.tls=true"
|
||
- "traefik.http.routers.authentik.tls.certresolver=cfresolver"
|
||
# 强制 X-Forwarded-Proto 为 https（Tunnel 走 HTTP:80 入口，Traefik 不知道外层是 HTTPS）
|
||
- "traefik.http.middlewares.force-https-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
|
||
- "traefik.http.routers.authentik.middlewares=force-https-headers"
|
||
- "traefik.http.routers.authentik-http.middlewares=force-https-headers"
|
||
# --- HTTP 入口 ---
|
||
- "traefik.http.routers.authentik-http.rule=Host(`auth.xiteng.site`)"
|
||
- "traefik.http.routers.authentik-http.service=authentik"
|
||
- "traefik.http.routers.authentik-http.entrypoints=web"
|
||
# --- Homepage ---
|
||
- "homepage.group=我的服务"
|
||
- "homepage.name=Authentik"
|
||
- "homepage.icon=authentik"
|
||
- "homepage.href=https://auth.xiteng.site"
|
||
- "homepage.description=统一认证"
|
||
# --- AutoKuma ---
|
||
- "kuma.authentik.http.name=Authentik"
|
||
- "kuma.authentik.http.url=http://authentik:9000/-/health/ready/"
|
||
- "kuma.authentik.http.interval=60"
|
||
- "kuma.authentik.http.max_retries=3"
|
||
networks:
|
||
- homelab_net
|
||
|
||
postgres:
|
||
image: postgres:16-alpine
|
||
container_name: authentik-db
|
||
restart: unless-stopped
|
||
environment:
|
||
POSTGRES_USER: authentik
|
||
POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD}
|
||
POSTGRES_DB: authentik
|
||
volumes:
|
||
- ./pgdata:/var/lib/postgresql/data
|
||
networks:
|
||
- homelab_net
|
||
|
||
redis:
|
||
image: redis:alpine
|
||
container_name: authentik-redis
|
||
restart: unless-stopped
|
||
volumes:
|
||
- ./redis:/data
|
||
networks:
|
||
- homelab_net
|
||
|
||
networks:
|
||
homelab_net:
|
||
external: true
|