services:
    authentik_proxy:
        image: ghcr.io/goauthentik/proxy:${AUTHENTIK_TAG:?Authentik tag is not configured}
        # Optionally specify the container's network, which must be able to reach the core authentik server.
        # networks:
        #   - foo
        ports:
            - 127.0.0.1:42080:42080
            - 127.0.0.1:42443:42443
        environment:
            AUTHENTIK_HOST: ${AUTHENTIK_HOST:?Authentik host is not configured}
            AUTHENTIK_INSECURE: "false"
            AUTHENTIK_LISTEN__HTTP: "0.0.0.0:42080"
            AUTHENTIK_LISTEN__HTTPS: "0.0.0.0:42443"
            AUTHENTIK_TOKEN: ${AUTHENTIK_TOKEN:?Authentik token is not configured}