Refactor docker-compose setup and update Authentik version to 2025.4.2

.gitignore

@@ -1,7 +1,6 @@
 # Project
 .env
 lego.env
-docker-compose.yml
 data/*
 data/nginx/*
 !data

README.md

@@ -202,37 +202,43 @@ TARGET_IPV6=$(dig +short "${TARGET_DOMAIN}" AAAA | grep -E '^(([0-9a-fA-F]{1,4}:
 ### Fist run
 
 ```shell
-docker compose build --no-cache \
+./scripts/compose.sh build --no-cache \
     --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') \
     --build-arg SRC_REV=$(git rev-parse --short HEAD) \
-  && docker compose up -d; docker compose logs -f
+  && ./scripts/compose.sh up -d; ./scripts/compose.sh logs -f
 ```
 
 ## Upgrade
 
 ### Test
 
-1. Check if the backups are up to date: `docker compose run --rm restore-cli /usr/local/bin/restic snapshots`
+1. Check if the backups are up to date: `./scripts/compose.sh run --rm restore-cli /usr/local/bin/restic snapshots`
-2. Update `AUTHENTIK_TAG` to the desired tag in `env.test.template`.
+2. Create a new branch `git checkout -b <version>`.
-3. Commit & push changes to the Repo.
+3. Download the the docker compose for the version you want to update:
-4. Run `diff --color='auto' env.test.template .env` to display the diff between
+   `curl -fsSL -o docker-compose.yml https://goauthentik.io/version/<version>/docker-compose.yml`
+4. Update `AUTHENTIK_TAG` to the desired tag in `env.test.template`.
+5. Commit & push changes to the Repo.
+6. Run `diff --color='auto' env.test.template .env` to display the diff between
    `env.test.template` and `.env`.
-5. Port the made changes to `.env`.
+7. Port the made changes to `.env`.
-6. `docker-compose-2.32.4 pull`
+8. `./scripts/compose.sh pull`
-7. `docker-compose-2.32.4 down`
+9. `./scripts/compose.sh down`
-8. `docker-compose-2.32.4 up -d; docker-compose-2.32.4 logs -f`
+10. `./scripts/compose.sh up -d; ./scripts/compose.sh logs -f`
 
 ### Prod
 
-1. Check if the backups are up to date: `docker compose run --rm restore-cli /usr/local/bin/restic snapshots`
+1. Check if the backups are up to date: `./scripts/compose.sh run --rm restore-cli /usr/local/bin/restic snapshots`
-2. Update `AUTHENTIK_TAG` to the desired tag in `env.prod.template`.
+2. Create a new branch `git checkout -b <version>`.
-3. Commit & push changes to the Repo.
+3. Download the the docker compose for the version you want to update:
-4. Run `diff --color='auto' env.prod.template .env` to display the diff between
+   `curl -fsSL -o docker-compose.yml https://goauthentik.io/version/<version>/docker-compose.yml`
+4. Update `AUTHENTIK_TAG` to the desired tag in `env.prod.template`.
+5. Commit & push changes to the Repo.
+6. Run `diff --color='auto' env.prod.template .env` to display the diff between
    `env.prod.template` and `.env`.
-5. Port the made changes to `.env`.
+7. Port the made changes to `.env`.
-6. `docker compose pull`
+8. `./scripts/compose.sh pull`
-7. `docker compose down`
+9. `./scripts/compose.sh down`
-8. `docker compose up -d; docker compose logs -f`
+10. `./scripts/compose.sh up -d; ./scripts/compose.sh logs -f`
 
 ## Disaster recovery / restore
 

docker-compose.override.yml

@@ -0,0 +1,121 @@
+---
+
+services:
+  geoipupdate:
+    image: "maxmindinc/geoipupdate:latest"
+    volumes:
+      - "geoip:/usr/share/GeoIP"
+    environment:
+      GEOIPUPDATE_EDITION_IDS: "GeoLite2-City GeoLite2-ASN"
+      GEOIPUPDATE_FREQUENCY: "8"
+      GEOIPUPDATE_ACCOUNT_ID: "${GEOIPUPDATE_ACCOUNT_ID:?MaxMind GeoIP account ID required}"
+      GEOIPUPDATE_LICENSE_KEY: "${GEOIPUPDATE_LICENSE_KEY:?MaxMind GeoIP license key required}"
+
+  postgresql:
+    image: docker.io/library/postgres:${POSTGRES_TAG:?POSTGRES_TAG is not configured}
+    volumes:
+      - database:/var/lib/postgresql/data
+      - backups_db:/var/lib/postgresql/backups
+    networks:
+      - backend
+
+  redis:
+    image: docker.io/library/redis:${REDIS_TAG:?REDIS_TAG is not configured}
+    networks:
+      - backend
+
+  server:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
+    environment:
+      B23_ALLOW_UP: ${B23_ALLOW_UP:?Use the script ./scripts/compose.sh to run this compose!}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database}
+    ports: []
+    networks:
+      - backend
+
+  worker:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
+    environment:
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./data/authentik/media:/media
+      - ./data/authentik/certs:/certs
+      - ./data/authentik/custom-templates:/templates
+      - geoip:/geoip
+    networks:
+      - backend
+
+  backup:
+    image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
+    restart: unless-stopped
+    environment:
+      PRE_COMMANDS: |-
+        cd /compose-project/
+        [[ $($(docker compose &>/dev/null); echo "$?") -eq 0 ]] || apk add --no-cache docker-cli-compose
+        docker compose exec -T postgresql pg_dump -U ${PG_USER:-authentik} -d ${PG_DB:-authentik} -f /var/lib/postgresql/backups/${PG_DB:-authentik}.sql
+      RUN_ON_STARTUP: "false"
+      BACKUP_CRON: "00 32 2 * * *"
+      RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
+      RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
+      RESTIC_BACKUP_SOURCES: /var/lib/postgresql/backups /var/lib/authentik/backups /var/lib/lego/backups
+      RESTIC_BACKUP_ARGS: >-
+        --tag ${RESTIC_TAG:?Restic tag is required}
+        --verbose
+      RESTIC_FORGET_ARGS: >-
+        --keep-last 10
+        --keep-daily 7
+        --keep-weekly 5
+        --keep-monthly 12
+      TZ: Europe/Berlin
+    volumes:
+      - ./data/restic/ssh/:/run/secrets/.ssh:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./docker-compose.yml:/compose-project/docker-compose.yml:ro
+      - ./.env:/compose-project/.env:ro
+      - backups_db:/var/lib/postgresql/backups:ro
+      - ./data/authentik/certs:/var/lib/authentik/backups/certs:ro
+      - ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:ro
+      - ./data/authentik/media:/var/lib/authentik/backups/media:ro
+      - ./data/.lego:/var/lib/lego/backups:ro
+
+  prune-backup:
+    image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
+    restart: unless-stopped
+    environment:
+      SKIP_INIT: "true"
+      RUN_ON_STARTUP: "false"
+      PRUNE_CRON: "00 47 3 * * *"
+      RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
+      RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
+      TZ: Europe/Berlin
+    volumes:
+      - ./data/restic/ssh/:/run/secrets/.ssh:ro
+
+  # prüft ob backups noch in Ordnung sind, evtl. erweitern zum prüfen der Daten
+  check-backup:
+    image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
+    restart: unless-stopped
+    environment:
+      #RUN_ON_STARTUP: "true"
+      SKIP_INIT: "true"
+      CHECK_CRON: "00 08 04 * * *"
+      RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
+      RESTIC_PASSWORD: ${RESTIC_REPO_PASSWORD}
+      #POST_COMMANDS_FAILURE: echo "Post Command Failure test" > /restic/message
+      TZ: Europe/Berlin
+    volumes:
+      - ./data/restic/ssh/:/run/secrets/.ssh:ro
+
+  restore-cli:
+    image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
+    entrypoint: /entrypoint-restore
+
+volumes:
+  backups_db:
+    driver: local
+  geoip:
+    driver: local
+
+networks:
+  backend:

docker-compose.prod.yml

@@ -1,112 +1,13 @@
 ---
-# Based on authentiks official docker-compose.yml
-# Version: 2025.2.1
 
 services:
-  geoipupdate:
-    image: "maxmindinc/geoipupdate:latest"
-    volumes:
-      - "geoip:/usr/share/GeoIP"
-    environment:
-      GEOIPUPDATE_EDITION_IDS: "GeoLite2-City GeoLite2-ASN"
-      GEOIPUPDATE_FREQUENCY: "8"
-      GEOIPUPDATE_ACCOUNT_ID: "${GEOIPUPDATE_ACCOUNT_ID:?MaxMind GeoIP account ID required}"
-      GEOIPUPDATE_LICENSE_KEY: "${GEOIPUPDATE_LICENSE_KEY:?MaxMind GeoIP license key required}"
-
-  postgresql:
-    image: docker.io/library/postgres:${POSTGRES_TAG:?POSTGRES_TAG is not configured}
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
-      start_period: 20s
-      interval: 30s
-      retries: 5
-      timeout: 5s
-    volumes:
-      - database:/var/lib/postgresql/data
-      - backups_db:/var/lib/postgresql/backups
-    environment:
-      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
-      POSTGRES_USER: ${PG_USER:-authentik}
-      POSTGRES_DB: ${PG_DB:-authentik}
-    env_file:
-      - .env
-    networks:
-      - backend
-
-  redis:
-    image: docker.io/library/redis:${REDIS_TAG:?REDIS_TAG is not configured}
-    command: --save 60 1 --loglevel warning
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
-      start_period: 20s
-      interval: 30s
-      retries: 5
-      timeout: 3s
-    volumes:
-      - redis:/data
-    networks:
-      - backend
-
   server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
-    restart: unless-stopped
-    command: server
     environment:
-      AUTHENTIK_REDIS__HOST: redis
+      B23_ALLOW_UP: "true"
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database}
-    volumes:
-      - ./data/authentik/media:/media
-      - ./data/authentik/custom-templates:/templates
-      - geoip:/geoip
-    env_file:
-      - .env
-    depends_on:
-      postgresql:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
     networks:
       - backend
       - frontend
 
-  worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
-    restart: unless-stopped
-    command: worker
-    environment:
-      AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database}
-    # `user: root` and the docker socket volume are optional.
-    # See more for the docker socket integration here:
-    # https://goauthentik.io/docs/outposts/integrations/docker
-    # Removing `user: root` also prevents the worker from fixing the permissions
-    # on the mounted folders, so when removing this make sure the folders have the correct UID/GID
-    # (1000:1000 by default)
-    user: root
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ./data/authentik/media:/media
-      - ./data/authentik/certs:/certs
-      - ./data/authentik/custom-templates:/templates
-      - geoip:/geoip
-    env_file:
-      - .env
-    depends_on:
-      postgresql:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    networks:
-      - backend
-
   nginx:
     build:
       context: ./docker/nginx
@@ -150,96 +51,5 @@ services:
     networks:
       - frontend
 
-  backup:
-    image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
-    restart: unless-stopped
-    environment:
-      PRE_COMMANDS: |-
-        cd /compose-project/
-        [[ $($(docker compose &>/dev/null); echo "$?") -eq 0 ]] || apk add --no-cache docker-cli-compose
-        docker compose exec -T postgresql pg_dump -U ${PG_USER:-authentik} -d ${PG_DB:-authentik} -f /var/lib/postgresql/backups/${PG_DB:-authentik}.sql
-      RUN_ON_STARTUP: "false"
-      BACKUP_CRON: "00 32 2 * * *"
-      RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
-      RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
-      RESTIC_BACKUP_SOURCES: /var/lib/postgresql/backups /var/lib/authentik/backups /var/lib/lego/backups
-      RESTIC_BACKUP_ARGS: >-
-        --tag ${RESTIC_TAG:?Restic tag is required}
-        --verbose
-      RESTIC_FORGET_ARGS: >-
-        --keep-last 10
-        --keep-daily 7
-        --keep-weekly 5
-        --keep-monthly 12
-      TZ: Europe/Berlin
-    volumes:
-      - ./data/restic/ssh/:/run/secrets/.ssh:ro
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ./docker-compose.yml:/compose-project/docker-compose.yml:ro
-      - ./.env:/compose-project/.env:ro
-      - backups_db:/var/lib/postgresql/backups:ro
-      - ./data/authentik/certs:/var/lib/authentik/backups/certs:ro
-      - ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:ro
-      - ./data/authentik/media:/var/lib/authentik/backups/media:ro
-      - ./data/.lego:/var/lib/lego/backups:ro
-
-  prune-backup:
-    image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
-    restart: unless-stopped
-    environment:
-      SKIP_INIT: "true"
-      RUN_ON_STARTUP: "false"
-      PRUNE_CRON: "00 47 3 * * *"
-      RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
-      RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
-      TZ: Europe/Berlin
-    volumes:
-      - ./data/restic/ssh/:/run/secrets/.ssh:ro
-
-  # prüft ob backups noch in Ordnung sind, evtl. erweitern zum prüfen der Daten
-  check-backup:
-    image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
-    restart: unless-stopped
-    environment:
-      #RUN_ON_STARTUP: "true"
-      SKIP_INIT: "true"
-      CHECK_CRON: "00 08 04 * * *"
-      RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
-      RESTIC_PASSWORD: ${RESTIC_REPO_PASSWORD}
-      #POST_COMMANDS_FAILURE: echo "Post Command Failure test" > /restic/message
-      TZ: Europe/Berlin
-    volumes:
-      - ./data/restic/ssh/:/run/secrets/.ssh:ro
-
-  restore-cli:
-    image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
-    entrypoint: /entrypoint-restore
-    environment:
-      RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
-      RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
-      TZ: Europe/Berlin
-    volumes:
-      - ./data/restic/ssh/:/run/secrets/.ssh:ro
-      - ./docker-compose.yml:/compose-project/docker-compose.yml:ro
-      - ./.env:/compose-project/.env:ro
-      - backups_db:/var/lib/postgresql/backups:rw
-      - ./data/authentik/certs:/var/lib/authentik/backups/certs:rw
-      - ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:rw
-      - ./data/authentik/media:/var/lib/authentik/backups/media:rw
-      - ./data/.lego:/var/lib/lego/backups:rw
-
-
-volumes:
-  backups_db:
-    driver: local
-  database:
-    driver: local
-  redis:
-    driver: local
-  geoip:
-    driver: local
-
-
 networks:
-  backend:
   frontend:

docker-compose.test.yml

@@ -1,75 +1,8 @@
 ---
-# Based on authentiks official docker-compose.yml
-# Version: 2025.2.1
-
 services:
-  geoipupdate:
-    image: "maxmindinc/geoipupdate:latest"
-    volumes:
-      - "geoip:/usr/share/GeoIP"
-    environment:
-      GEOIPUPDATE_EDITION_IDS: "GeoLite2-City GeoLite2-ASN"
-      GEOIPUPDATE_FREQUENCY: "8"
-      GEOIPUPDATE_ACCOUNT_ID: "${GEOIPUPDATE_ACCOUNT_ID:?MaxMind GeoIP account ID required}"
-      GEOIPUPDATE_LICENSE_KEY: "${GEOIPUPDATE_LICENSE_KEY:?MaxMind GeoIP license key required}"
-
-  postgresql:
-    image: docker.io/library/postgres:${POSTGRES_TAG:?POSTGRES_TAG is not configured}
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
-      start_period: 20s
-      interval: 30s
-      retries: 5
-      timeout: 5s
-    volumes:
-      - database:/var/lib/postgresql/data
-      - backups_db:/var/lib/postgresql/backups
-    environment:
-      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
-      POSTGRES_USER: ${PG_USER:-authentik}
-      POSTGRES_DB: ${PG_DB:-authentik}
-    env_file:
-      - .env
-    networks:
-      - backend
-
-  redis:
-    image: docker.io/library/redis:${REDIS_TAG:?REDIS_TAG is not configured}
-    command: --save 60 1 --loglevel warning
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
-      start_period: 20s
-      interval: 30s
-      retries: 5
-      timeout: 3s
-    volumes:
-      - redis:/data
-    networks:
-      - backend
-
   server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
-    restart: unless-stopped
-    command: server
     environment:
-      AUTHENTIK_REDIS__HOST: redis
+      B23_ALLOW_UP: "true"
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database}
-    volumes:
-      - ./data/authentik/media:/media
-      - ./data/authentik/custom-templates:/templates
-      - geoip:/geoip
-    env_file:
-      - .env
-    depends_on:
-      postgresql:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
     networks:
       - backend
       - web
@@ -84,115 +17,6 @@ services:
       - "traefik.http.services.sso.loadbalancer.server.port=9443" # set port the container listenes to
       - "traefik.http.services.sso.loadbalancer.server.scheme=https"
 
-  worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
-    restart: unless-stopped
-    command: worker
-    environment:
-      AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database}
-    # `user: root` and the docker socket volume are optional.
-    # See more for the docker socket integration here:
-    # https://goauthentik.io/docs/outposts/integrations/docker
-    # Removing `user: root` also prevents the worker from fixing the permissions
-    # on the mounted folders, so when removing this make sure the folders have the correct UID/GID
-    # (1000:1000 by default)
-    user: root
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ./data/authentik/media:/media
-      - ./data/authentik/certs:/certs
-      - ./data/authentik/custom-templates:/templates
-      - geoip:/geoip
-    env_file:
-      - .env
-    depends_on:
-      postgresql:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
 networks:
-      - backend
-
-  backup:
-    image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
-    restart: unless-stopped
-    environment:
-      PRE_COMMANDS: |-
-        cd /compose-project/
-        [[ $($(docker compose &>/dev/null); echo "$?") -eq 0 ]] || apk add --no-cache docker-cli-compose
-        docker compose exec -T postgresql pg_dump -U ${PG_USER:-authentik} -d ${PG_DB:-authentik} -f /var/lib/postgresql/backups/${PG_DB:-authentik}.sql
-      RUN_ON_STARTUP: "false"
-      BACKUP_CRON: "00 32 2 * * *"
-      RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
-      RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
-      RESTIC_BACKUP_SOURCES: /var/lib/postgresql/backups /var/lib/authentik/backups /var/lib/lego/backups
-      RESTIC_BACKUP_ARGS: >-
-        --tag ${RESTIC_TAG:?Restic tag is required}
-        --verbose
-      RESTIC_FORGET_ARGS: >-
-        --keep-last 10
-        --keep-daily 7
-        --keep-weekly 5
-        --keep-monthly 12
-      TZ: Europe/Berlin
-    volumes:
-      - ./data/restic/ssh/:/run/secrets/.ssh:ro
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ./docker-compose.yml:/compose-project/docker-compose.yml:ro
-      - ./.env:/compose-project/.env:ro
-      - backups_db:/var/lib/postgresql/backups:ro
-      - ./data/authentik/certs:/var/lib/authentik/backups/certs:ro
-      - ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:ro
-      - ./data/authentik/media:/var/lib/authentik/backups/media:ro
-      - ./data/.lego:/var/lib/lego/backups:ro
-
-  prune-backup:
-    image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
-    restart: unless-stopped
-    environment:
-      SKIP_INIT: "true"
-      RUN_ON_STARTUP: "false"
-      PRUNE_CRON: "00 47 3 * * *"
-      RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
-      RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
-      TZ: Europe/Berlin
-    volumes:
-      - ./data/restic/ssh/:/run/secrets/.ssh:ro
-
-  restore-cli:
-    image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
-    entrypoint: /entrypoint-restore
-    environment:
-      RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
-      RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
-      TZ: Europe/Berlin
-    volumes:
-      - ./data/restic/ssh/:/run/secrets/.ssh:ro
-      - ./docker-compose.yml:/compose-project/docker-compose.yml:ro
-      - ./.env:/compose-project/.env:ro
-      - backups_db:/var/lib/postgresql/backups:rw
-      - ./data/authentik/certs:/var/lib/authentik/backups/certs:rw
-      - ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:rw
-      - ./data/authentik/media:/var/lib/authentik/backups/media:rw
-      - ./data/.lego:/var/lib/lego/backups:rw
-
-
-volumes:
-  backups_db:
-    driver: local
-  database:
-    driver: local
-  redis:
-    driver: local
-  geoip:
-    driver: local
-
-
-networks:
-  backend:
   web:
     external: true

docker-compose.yml

@@ -0,0 +1,92 @@
+---
+
+services:
+  postgresql:
+    image: docker.io/library/postgres:16-alpine
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
+      start_period: 20s
+      interval: 30s
+      retries: 5
+      timeout: 5s
+    volumes:
+      - database:/var/lib/postgresql/data
+    environment:
+      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
+      POSTGRES_USER: ${PG_USER:-authentik}
+      POSTGRES_DB: ${PG_DB:-authentik}
+    env_file:
+      - .env
+  redis:
+    image: docker.io/library/redis:alpine
+    command: --save 60 1 --loglevel warning
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
+      start_period: 20s
+      interval: 30s
+      retries: 5
+      timeout: 3s
+    volumes:
+      - redis:/data
+  server:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.4.2}
+    restart: unless-stopped
+    command: server
+    environment:
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+    volumes:
+      - ./media:/media
+      - ./custom-templates:/templates
+    env_file:
+      - .env
+    ports:
+      - "${COMPOSE_PORT_HTTP:-9000}:9000"
+      - "${COMPOSE_PORT_HTTPS:-9443}:9443"
+    depends_on:
+      postgresql:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+  worker:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.4.2}
+    restart: unless-stopped
+    command: worker
+    environment:
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+    # `user: root` and the docker socket volume are optional.
+    # See more for the docker socket integration here:
+    # https://goauthentik.io/docs/outposts/integrations/docker
+    # Removing `user: root` also prevents the worker from fixing the permissions
+    # on the mounted folders, so when removing this make sure the folders have the correct UID/GID
+    # (1000:1000 by default)
+    user: root
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./media:/media
+      - ./certs:/certs
+      - ./custom-templates:/templates
+    env_file:
+      - .env
+    depends_on:
+      postgresql:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+volumes:
+  database:
+    driver: local
+  redis:
+    driver: local

env.test.template

@@ -4,7 +4,7 @@ PUBLIC_DOMAIN=sso.test.base23.de
 COMPOSE_PROJECT_NAME=sso-base23-de
 
 # Server Versions
-AUTHENTIK_TAG=2025.2.4
+AUTHENTIK_TAG=2025.4.2
 POSTGRES_TAG=16.6-alpine
 REDIS_TAG=7.4.2-alpine
 RESTICKER_TAG=0.0.2-restic0.17.0

scripts/compose.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euf -o pipefail
+
+# Check if yq is installed
+if ! command -v yq &>/dev/null; then
+  echo "yq is required but not installed. Please install it manually."
+  exit 1
+fi
+
+STAGE="${1:-}"
+shift || true
+
+if [[ -z "${STAGE,,}" ]]; then
+  echo "Usage: $0 <prod|test>"
+  echo "Example: $0 test"
+  exit 1
+fi
+
+if [[ "${STAGE,,}" == "prod" ]]; then
+  DOCKER_COMPOSE_CLI="docker compose"
+elif [[ "${STAGE,,}" == "test" ]]; then
+  DOCKER_COMPOSE_CLI="docker-compose-2.32.4"
+else
+  echo "Invalid stage: ${STAGE,,}. Use 'prod' or 'test'."
+  exit 1
+fi
+
+cd "$(dirname "$(realpath "$0")")/../"
+AUTHENTIK_DOCKER_COMPOSE_PATH="$(realpath "$(pwd)")"
+
+# Merge docker-compose files using yq
+# 1st merger is docker-compose.override.yml on top of the base docker-compose.yml
+# 2nd merger is the stage-specific docker-compose file on top of the result of the first merger
+# The final result is piped to docker compose command
+yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' \
+    docker-compose.yml \
+    docker-compose.override.yml \
+  |  yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' \
+    - \
+    docker-compose.${STAGE,,}.yml \
+  | ${DOCKER_COMPOSE_CLI} -f- ${@:-}