services:
  authentik_proxy:
    image: ghcr.io/goauthentik/proxy:${AUTHENTIK_TAG:?Authentik tag is not configured}
    # Optionally specify the container's network, which must be able to reach the core authentik server.
    # networks:
    #   - foo
    ports:
      - 127.0.0.1:42080:42080
      - 127.0.0.1:42443:42443
    networks:
      - dokploy-network
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      AUTHENTIK_HOST: ${AUTHENTIK_HOST:?Authentik host is not configured}
      AUTHENTIK_INSECURE: ${AUTHENTIK_INSECURE:?Authentik insecure is not configured}
      AUTHENTIK_LISTEN__HTTP: "0.0.0.0:42080"
      AUTHENTIK_LISTEN__HTTPS: "0.0.0.0:42443"
      AUTHENTIK_TOKEN: ${AUTHENTIK_TOKEN:?Authentik token is not configured}
      AUTHENTIK_HOST_BROWSER: ${AUTHENTIK_HOST_BROWSER:?Authentik host browser is not configured}

networks:
  dokploy-network:
    external: true