diff --git a/.gitignore b/.gitignore index cdf5903..d858fb7 100644 --- a/.gitignore +++ b/.gitignore @@ -1,7 +1,6 @@ # Project .env lego.env -docker-compose.yml data/* data/nginx/* !data diff --git a/README.md b/README.md index ebc6b4d..53e484d 100644 --- a/README.md +++ b/README.md @@ -202,37 +202,43 @@ TARGET_IPV6=$(dig +short "${TARGET_DOMAIN}" AAAA | grep -E '^(([0-9a-fA-F]{1,4}: ### Fist run ```shell -docker compose build --no-cache \ +./scripts/compose.sh build --no-cache \ --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') \ --build-arg SRC_REV=$(git rev-parse --short HEAD) \ - && docker compose up -d; docker compose logs -f + && ./scripts/compose.sh up -d; ./scripts/compose.sh logs -f ``` ## Upgrade ### Test -1. Check if the backups are up to date: `docker compose run --rm restore-cli /usr/local/bin/restic snapshots` -2. Update `AUTHENTIK_TAG` to the desired tag in `env.test.template`. -3. Commit & push changes to the Repo. -4. Run `diff --color='auto' env.test.template .env` to display the diff between -`env.test.template` and `.env`. -5. Port the made changes to `.env`. -6. `docker-compose-2.32.4 pull` -7. `docker-compose-2.32.4 down` -8. `docker-compose-2.32.4 up -d; docker-compose-2.32.4 logs -f` +1. Check if the backups are up to date: `./scripts/compose.sh run --rm restore-cli /usr/local/bin/restic snapshots` +2. Create a new branch `git checkout -b `. +3. Download the the docker compose for the version you want to update: + `curl -fsSL -o docker-compose.yml https://goauthentik.io/version//docker-compose.yml` +4. Update `AUTHENTIK_TAG` to the desired tag in `env.test.template`. +5. Commit & push changes to the Repo. +6. Run `diff --color='auto' env.test.template .env` to display the diff between + `env.test.template` and `.env`. +7. Port the made changes to `.env`. +8. `./scripts/compose.sh pull` +9. `./scripts/compose.sh down` +10. `./scripts/compose.sh up -d; ./scripts/compose.sh logs -f` ### Prod -1. Check if the backups are up to date: `docker compose run --rm restore-cli /usr/local/bin/restic snapshots` -2. Update `AUTHENTIK_TAG` to the desired tag in `env.prod.template`. -3. Commit & push changes to the Repo. -4. Run `diff --color='auto' env.prod.template .env` to display the diff between -`env.prod.template` and `.env`. -5. Port the made changes to `.env`. -6. `docker compose pull` -7. `docker compose down` -8. `docker compose up -d; docker compose logs -f` +1. Check if the backups are up to date: `./scripts/compose.sh run --rm restore-cli /usr/local/bin/restic snapshots` +2. Create a new branch `git checkout -b `. +3. Download the the docker compose for the version you want to update: + `curl -fsSL -o docker-compose.yml https://goauthentik.io/version//docker-compose.yml` +4. Update `AUTHENTIK_TAG` to the desired tag in `env.prod.template`. +5. Commit & push changes to the Repo. +6. Run `diff --color='auto' env.prod.template .env` to display the diff between + `env.prod.template` and `.env`. +7. Port the made changes to `.env`. +8. `./scripts/compose.sh pull` +9. `./scripts/compose.sh down` +10. `./scripts/compose.sh up -d; ./scripts/compose.sh logs -f` ## Disaster recovery / restore diff --git a/docker-compose.override.yml b/docker-compose.override.yml new file mode 100644 index 0000000..7321fe2 --- /dev/null +++ b/docker-compose.override.yml @@ -0,0 +1,121 @@ +--- + +services: + geoipupdate: + image: "maxmindinc/geoipupdate:latest" + volumes: + - "geoip:/usr/share/GeoIP" + environment: + GEOIPUPDATE_EDITION_IDS: "GeoLite2-City GeoLite2-ASN" + GEOIPUPDATE_FREQUENCY: "8" + GEOIPUPDATE_ACCOUNT_ID: "${GEOIPUPDATE_ACCOUNT_ID:?MaxMind GeoIP account ID required}" + GEOIPUPDATE_LICENSE_KEY: "${GEOIPUPDATE_LICENSE_KEY:?MaxMind GeoIP license key required}" + + postgresql: + image: docker.io/library/postgres:${POSTGRES_TAG:?POSTGRES_TAG is not configured} + volumes: + - database:/var/lib/postgresql/data + - backups_db:/var/lib/postgresql/backups + networks: + - backend + + redis: + image: docker.io/library/redis:${REDIS_TAG:?REDIS_TAG is not configured} + networks: + - backend + + server: + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured} + environment: + B23_ALLOW_UP: ${B23_ALLOW_UP:?Use the script ./scripts/compose.sh to run this compose!} + AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database} + ports: [] + networks: + - backend + + worker: + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured} + environment: + AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database} + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - ./data/authentik/media:/media + - ./data/authentik/certs:/certs + - ./data/authentik/custom-templates:/templates + - geoip:/geoip + networks: + - backend + + backup: + image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured} + restart: unless-stopped + environment: + PRE_COMMANDS: |- + cd /compose-project/ + [[ $($(docker compose &>/dev/null); echo "$?") -eq 0 ]] || apk add --no-cache docker-cli-compose + docker compose exec -T postgresql pg_dump -U ${PG_USER:-authentik} -d ${PG_DB:-authentik} -f /var/lib/postgresql/backups/${PG_DB:-authentik}.sql + RUN_ON_STARTUP: "false" + BACKUP_CRON: "00 32 2 * * *" + RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup + RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}' + RESTIC_BACKUP_SOURCES: /var/lib/postgresql/backups /var/lib/authentik/backups /var/lib/lego/backups + RESTIC_BACKUP_ARGS: >- + --tag ${RESTIC_TAG:?Restic tag is required} + --verbose + RESTIC_FORGET_ARGS: >- + --keep-last 10 + --keep-daily 7 + --keep-weekly 5 + --keep-monthly 12 + TZ: Europe/Berlin + volumes: + - ./data/restic/ssh/:/run/secrets/.ssh:ro + - /var/run/docker.sock:/var/run/docker.sock + - ./docker-compose.yml:/compose-project/docker-compose.yml:ro + - ./.env:/compose-project/.env:ro + - backups_db:/var/lib/postgresql/backups:ro + - ./data/authentik/certs:/var/lib/authentik/backups/certs:ro + - ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:ro + - ./data/authentik/media:/var/lib/authentik/backups/media:ro + - ./data/.lego:/var/lib/lego/backups:ro + + prune-backup: + image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured} + restart: unless-stopped + environment: + SKIP_INIT: "true" + RUN_ON_STARTUP: "false" + PRUNE_CRON: "00 47 3 * * *" + RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup + RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}' + TZ: Europe/Berlin + volumes: + - ./data/restic/ssh/:/run/secrets/.ssh:ro + + # prüft ob backups noch in Ordnung sind, evtl. erweitern zum prüfen der Daten + check-backup: + image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured} + restart: unless-stopped + environment: + #RUN_ON_STARTUP: "true" + SKIP_INIT: "true" + CHECK_CRON: "00 08 04 * * *" + RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup + RESTIC_PASSWORD: ${RESTIC_REPO_PASSWORD} + #POST_COMMANDS_FAILURE: echo "Post Command Failure test" > /restic/message + TZ: Europe/Berlin + volumes: + - ./data/restic/ssh/:/run/secrets/.ssh:ro + + restore-cli: + image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured} + entrypoint: /entrypoint-restore + +volumes: + backups_db: + driver: local + geoip: + driver: local + +networks: + backend: \ No newline at end of file diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index 1e23a60..e739822 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -1,112 +1,13 @@ --- -# Based on authentiks official docker-compose.yml -# Version: 2025.2.1 services: - geoipupdate: - image: "maxmindinc/geoipupdate:latest" - volumes: - - "geoip:/usr/share/GeoIP" - environment: - GEOIPUPDATE_EDITION_IDS: "GeoLite2-City GeoLite2-ASN" - GEOIPUPDATE_FREQUENCY: "8" - GEOIPUPDATE_ACCOUNT_ID: "${GEOIPUPDATE_ACCOUNT_ID:?MaxMind GeoIP account ID required}" - GEOIPUPDATE_LICENSE_KEY: "${GEOIPUPDATE_LICENSE_KEY:?MaxMind GeoIP license key required}" - - postgresql: - image: docker.io/library/postgres:${POSTGRES_TAG:?POSTGRES_TAG is not configured} - restart: unless-stopped - healthcheck: - test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"] - start_period: 20s - interval: 30s - retries: 5 - timeout: 5s - volumes: - - database:/var/lib/postgresql/data - - backups_db:/var/lib/postgresql/backups - environment: - POSTGRES_PASSWORD: ${PG_PASS:?database password required} - POSTGRES_USER: ${PG_USER:-authentik} - POSTGRES_DB: ${PG_DB:-authentik} - env_file: - - .env - networks: - - backend - - redis: - image: docker.io/library/redis:${REDIS_TAG:?REDIS_TAG is not configured} - command: --save 60 1 --loglevel warning - restart: unless-stopped - healthcheck: - test: ["CMD-SHELL", "redis-cli ping | grep PONG"] - start_period: 20s - interval: 30s - retries: 5 - timeout: 3s - volumes: - - redis:/data - networks: - - backend - server: - image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured} - restart: unless-stopped - command: server environment: - AUTHENTIK_REDIS__HOST: redis - AUTHENTIK_POSTGRESQL__HOST: postgresql - AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik} - AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik} - AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database} - volumes: - - ./data/authentik/media:/media - - ./data/authentik/custom-templates:/templates - - geoip:/geoip - env_file: - - .env - depends_on: - postgresql: - condition: service_healthy - redis: - condition: service_healthy + B23_ALLOW_UP: "true" networks: - backend - frontend - worker: - image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured} - restart: unless-stopped - command: worker - environment: - AUTHENTIK_REDIS__HOST: redis - AUTHENTIK_POSTGRESQL__HOST: postgresql - AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik} - AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik} - AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database} - # `user: root` and the docker socket volume are optional. - # See more for the docker socket integration here: - # https://goauthentik.io/docs/outposts/integrations/docker - # Removing `user: root` also prevents the worker from fixing the permissions - # on the mounted folders, so when removing this make sure the folders have the correct UID/GID - # (1000:1000 by default) - user: root - volumes: - - /var/run/docker.sock:/var/run/docker.sock - - ./data/authentik/media:/media - - ./data/authentik/certs:/certs - - ./data/authentik/custom-templates:/templates - - geoip:/geoip - env_file: - - .env - depends_on: - postgresql: - condition: service_healthy - redis: - condition: service_healthy - networks: - - backend - nginx: build: context: ./docker/nginx @@ -150,96 +51,5 @@ services: networks: - frontend - backup: - image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured} - restart: unless-stopped - environment: - PRE_COMMANDS: |- - cd /compose-project/ - [[ $($(docker compose &>/dev/null); echo "$?") -eq 0 ]] || apk add --no-cache docker-cli-compose - docker compose exec -T postgresql pg_dump -U ${PG_USER:-authentik} -d ${PG_DB:-authentik} -f /var/lib/postgresql/backups/${PG_DB:-authentik}.sql - RUN_ON_STARTUP: "false" - BACKUP_CRON: "00 32 2 * * *" - RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup - RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}' - RESTIC_BACKUP_SOURCES: /var/lib/postgresql/backups /var/lib/authentik/backups /var/lib/lego/backups - RESTIC_BACKUP_ARGS: >- - --tag ${RESTIC_TAG:?Restic tag is required} - --verbose - RESTIC_FORGET_ARGS: >- - --keep-last 10 - --keep-daily 7 - --keep-weekly 5 - --keep-monthly 12 - TZ: Europe/Berlin - volumes: - - ./data/restic/ssh/:/run/secrets/.ssh:ro - - /var/run/docker.sock:/var/run/docker.sock - - ./docker-compose.yml:/compose-project/docker-compose.yml:ro - - ./.env:/compose-project/.env:ro - - backups_db:/var/lib/postgresql/backups:ro - - ./data/authentik/certs:/var/lib/authentik/backups/certs:ro - - ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:ro - - ./data/authentik/media:/var/lib/authentik/backups/media:ro - - ./data/.lego:/var/lib/lego/backups:ro - - prune-backup: - image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured} - restart: unless-stopped - environment: - SKIP_INIT: "true" - RUN_ON_STARTUP: "false" - PRUNE_CRON: "00 47 3 * * *" - RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup - RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}' - TZ: Europe/Berlin - volumes: - - ./data/restic/ssh/:/run/secrets/.ssh:ro - - # prüft ob backups noch in Ordnung sind, evtl. erweitern zum prüfen der Daten - check-backup: - image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured} - restart: unless-stopped - environment: - #RUN_ON_STARTUP: "true" - SKIP_INIT: "true" - CHECK_CRON: "00 08 04 * * *" - RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup - RESTIC_PASSWORD: ${RESTIC_REPO_PASSWORD} - #POST_COMMANDS_FAILURE: echo "Post Command Failure test" > /restic/message - TZ: Europe/Berlin - volumes: - - ./data/restic/ssh/:/run/secrets/.ssh:ro - - restore-cli: - image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured} - entrypoint: /entrypoint-restore - environment: - RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup - RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}' - TZ: Europe/Berlin - volumes: - - ./data/restic/ssh/:/run/secrets/.ssh:ro - - ./docker-compose.yml:/compose-project/docker-compose.yml:ro - - ./.env:/compose-project/.env:ro - - backups_db:/var/lib/postgresql/backups:rw - - ./data/authentik/certs:/var/lib/authentik/backups/certs:rw - - ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:rw - - ./data/authentik/media:/var/lib/authentik/backups/media:rw - - ./data/.lego:/var/lib/lego/backups:rw - - -volumes: - backups_db: - driver: local - database: - driver: local - redis: - driver: local - geoip: - driver: local - - networks: - backend: - frontend: + frontend: \ No newline at end of file diff --git a/docker-compose.test.yml b/docker-compose.test.yml index 7981d17..6b258f8 100644 --- a/docker-compose.test.yml +++ b/docker-compose.test.yml @@ -1,75 +1,8 @@ --- -# Based on authentiks official docker-compose.yml -# Version: 2025.2.1 - services: - geoipupdate: - image: "maxmindinc/geoipupdate:latest" - volumes: - - "geoip:/usr/share/GeoIP" - environment: - GEOIPUPDATE_EDITION_IDS: "GeoLite2-City GeoLite2-ASN" - GEOIPUPDATE_FREQUENCY: "8" - GEOIPUPDATE_ACCOUNT_ID: "${GEOIPUPDATE_ACCOUNT_ID:?MaxMind GeoIP account ID required}" - GEOIPUPDATE_LICENSE_KEY: "${GEOIPUPDATE_LICENSE_KEY:?MaxMind GeoIP license key required}" - - postgresql: - image: docker.io/library/postgres:${POSTGRES_TAG:?POSTGRES_TAG is not configured} - restart: unless-stopped - healthcheck: - test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"] - start_period: 20s - interval: 30s - retries: 5 - timeout: 5s - volumes: - - database:/var/lib/postgresql/data - - backups_db:/var/lib/postgresql/backups - environment: - POSTGRES_PASSWORD: ${PG_PASS:?database password required} - POSTGRES_USER: ${PG_USER:-authentik} - POSTGRES_DB: ${PG_DB:-authentik} - env_file: - - .env - networks: - - backend - - redis: - image: docker.io/library/redis:${REDIS_TAG:?REDIS_TAG is not configured} - command: --save 60 1 --loglevel warning - restart: unless-stopped - healthcheck: - test: ["CMD-SHELL", "redis-cli ping | grep PONG"] - start_period: 20s - interval: 30s - retries: 5 - timeout: 3s - volumes: - - redis:/data - networks: - - backend - server: - image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured} - restart: unless-stopped - command: server environment: - AUTHENTIK_REDIS__HOST: redis - AUTHENTIK_POSTGRESQL__HOST: postgresql - AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik} - AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik} - AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database} - volumes: - - ./data/authentik/media:/media - - ./data/authentik/custom-templates:/templates - - geoip:/geoip - env_file: - - .env - depends_on: - postgresql: - condition: service_healthy - redis: - condition: service_healthy + B23_ALLOW_UP: "true" networks: - backend - web @@ -84,115 +17,6 @@ services: - "traefik.http.services.sso.loadbalancer.server.port=9443" # set port the container listenes to - "traefik.http.services.sso.loadbalancer.server.scheme=https" - worker: - image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured} - restart: unless-stopped - command: worker - environment: - AUTHENTIK_REDIS__HOST: redis - AUTHENTIK_POSTGRESQL__HOST: postgresql - AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik} - AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik} - AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database} - # `user: root` and the docker socket volume are optional. - # See more for the docker socket integration here: - # https://goauthentik.io/docs/outposts/integrations/docker - # Removing `user: root` also prevents the worker from fixing the permissions - # on the mounted folders, so when removing this make sure the folders have the correct UID/GID - # (1000:1000 by default) - user: root - volumes: - - /var/run/docker.sock:/var/run/docker.sock - - ./data/authentik/media:/media - - ./data/authentik/certs:/certs - - ./data/authentik/custom-templates:/templates - - geoip:/geoip - env_file: - - .env - depends_on: - postgresql: - condition: service_healthy - redis: - condition: service_healthy - networks: - - backend - - backup: - image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured} - restart: unless-stopped - environment: - PRE_COMMANDS: |- - cd /compose-project/ - [[ $($(docker compose &>/dev/null); echo "$?") -eq 0 ]] || apk add --no-cache docker-cli-compose - docker compose exec -T postgresql pg_dump -U ${PG_USER:-authentik} -d ${PG_DB:-authentik} -f /var/lib/postgresql/backups/${PG_DB:-authentik}.sql - RUN_ON_STARTUP: "false" - BACKUP_CRON: "00 32 2 * * *" - RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup - RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}' - RESTIC_BACKUP_SOURCES: /var/lib/postgresql/backups /var/lib/authentik/backups /var/lib/lego/backups - RESTIC_BACKUP_ARGS: >- - --tag ${RESTIC_TAG:?Restic tag is required} - --verbose - RESTIC_FORGET_ARGS: >- - --keep-last 10 - --keep-daily 7 - --keep-weekly 5 - --keep-monthly 12 - TZ: Europe/Berlin - volumes: - - ./data/restic/ssh/:/run/secrets/.ssh:ro - - /var/run/docker.sock:/var/run/docker.sock - - ./docker-compose.yml:/compose-project/docker-compose.yml:ro - - ./.env:/compose-project/.env:ro - - backups_db:/var/lib/postgresql/backups:ro - - ./data/authentik/certs:/var/lib/authentik/backups/certs:ro - - ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:ro - - ./data/authentik/media:/var/lib/authentik/backups/media:ro - - ./data/.lego:/var/lib/lego/backups:ro - - prune-backup: - image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured} - restart: unless-stopped - environment: - SKIP_INIT: "true" - RUN_ON_STARTUP: "false" - PRUNE_CRON: "00 47 3 * * *" - RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup - RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}' - TZ: Europe/Berlin - volumes: - - ./data/restic/ssh/:/run/secrets/.ssh:ro - - restore-cli: - image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured} - entrypoint: /entrypoint-restore - environment: - RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup - RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}' - TZ: Europe/Berlin - volumes: - - ./data/restic/ssh/:/run/secrets/.ssh:ro - - ./docker-compose.yml:/compose-project/docker-compose.yml:ro - - ./.env:/compose-project/.env:ro - - backups_db:/var/lib/postgresql/backups:rw - - ./data/authentik/certs:/var/lib/authentik/backups/certs:rw - - ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:rw - - ./data/authentik/media:/var/lib/authentik/backups/media:rw - - ./data/.lego:/var/lib/lego/backups:rw - - -volumes: - backups_db: - driver: local - database: - driver: local - redis: - driver: local - geoip: - driver: local - - networks: - backend: web: - external: true + external: true \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..25340e3 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,92 @@ +--- + +services: + postgresql: + image: docker.io/library/postgres:16-alpine + restart: unless-stopped + healthcheck: + test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"] + start_period: 20s + interval: 30s + retries: 5 + timeout: 5s + volumes: + - database:/var/lib/postgresql/data + environment: + POSTGRES_PASSWORD: ${PG_PASS:?database password required} + POSTGRES_USER: ${PG_USER:-authentik} + POSTGRES_DB: ${PG_DB:-authentik} + env_file: + - .env + redis: + image: docker.io/library/redis:alpine + command: --save 60 1 --loglevel warning + restart: unless-stopped + healthcheck: + test: ["CMD-SHELL", "redis-cli ping | grep PONG"] + start_period: 20s + interval: 30s + retries: 5 + timeout: 3s + volumes: + - redis:/data + server: + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.4.2} + restart: unless-stopped + command: server + environment: + AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required} + AUTHENTIK_REDIS__HOST: redis + AUTHENTIK_POSTGRESQL__HOST: postgresql + AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik} + AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik} + AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS} + volumes: + - ./media:/media + - ./custom-templates:/templates + env_file: + - .env + ports: + - "${COMPOSE_PORT_HTTP:-9000}:9000" + - "${COMPOSE_PORT_HTTPS:-9443}:9443" + depends_on: + postgresql: + condition: service_healthy + redis: + condition: service_healthy + worker: + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.4.2} + restart: unless-stopped + command: worker + environment: + AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required} + AUTHENTIK_REDIS__HOST: redis + AUTHENTIK_POSTGRESQL__HOST: postgresql + AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik} + AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik} + AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS} + # `user: root` and the docker socket volume are optional. + # See more for the docker socket integration here: + # https://goauthentik.io/docs/outposts/integrations/docker + # Removing `user: root` also prevents the worker from fixing the permissions + # on the mounted folders, so when removing this make sure the folders have the correct UID/GID + # (1000:1000 by default) + user: root + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - ./media:/media + - ./certs:/certs + - ./custom-templates:/templates + env_file: + - .env + depends_on: + postgresql: + condition: service_healthy + redis: + condition: service_healthy + +volumes: + database: + driver: local + redis: + driver: local diff --git a/env.test.template b/env.test.template index 7cf2c4b..de1120c 100644 --- a/env.test.template +++ b/env.test.template @@ -4,7 +4,7 @@ PUBLIC_DOMAIN=sso.test.base23.de COMPOSE_PROJECT_NAME=sso-base23-de # Server Versions -AUTHENTIK_TAG=2025.2.4 +AUTHENTIK_TAG=2025.4.2 POSTGRES_TAG=16.6-alpine REDIS_TAG=7.4.2-alpine RESTICKER_TAG=0.0.2-restic0.17.0 diff --git a/scripts/compose.sh b/scripts/compose.sh new file mode 100755 index 0000000..65590b4 --- /dev/null +++ b/scripts/compose.sh @@ -0,0 +1,41 @@ +#!/usr/bin/env bash +set -euf -o pipefail + +# Check if yq is installed +if ! command -v yq &>/dev/null; then + echo "yq is required but not installed. Please install it manually." + exit 1 +fi + +STAGE="${1:-}" +shift || true + +if [[ -z "${STAGE,,}" ]]; then + echo "Usage: $0 " + echo "Example: $0 test" + exit 1 +fi + +if [[ "${STAGE,,}" == "prod" ]]; then + DOCKER_COMPOSE_CLI="docker compose" +elif [[ "${STAGE,,}" == "test" ]]; then + DOCKER_COMPOSE_CLI="docker-compose-2.32.4" +else + echo "Invalid stage: ${STAGE,,}. Use 'prod' or 'test'." + exit 1 +fi + +cd "$(dirname "$(realpath "$0")")/../" +AUTHENTIK_DOCKER_COMPOSE_PATH="$(realpath "$(pwd)")" + +# Merge docker-compose files using yq +# 1st merger is docker-compose.override.yml on top of the base docker-compose.yml +# 2nd merger is the stage-specific docker-compose file on top of the result of the first merger +# The final result is piped to docker compose command +yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' \ + docker-compose.yml \ + docker-compose.override.yml \ + | yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' \ + - \ + docker-compose.${STAGE,,}.yml \ + | ${DOCKER_COMPOSE_CLI} -f- ${@:-}