Refactor docker-compose setup and update Authentik version to 2025.4.2
This commit is contained in:
Philip Henning
parent
81b2fbc91c
commit
321acaf85d
8 changed files with 285 additions and 392 deletions
1
.gitignore
vendored
1
.gitignore
vendored
|
|
@ -1,7 +1,6 @@
|
|||
# Project
|
||||
.env
|
||||
lego.env
|
||||
docker-compose.yml
|
||||
data/*
|
||||
data/nginx/*
|
||||
!data
|
||||
|
|
|
|||
46
README.md
46
README.md
|
|
@ -202,37 +202,43 @@ TARGET_IPV6=$(dig +short "${TARGET_DOMAIN}" AAAA | grep -E '^(([0-9a-fA-F]{1,4}:
|
|||
### Fist run
|
||||
|
||||
```shell
|
||||
docker compose build --no-cache \
|
||||
./scripts/compose.sh build --no-cache \
|
||||
--build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') \
|
||||
--build-arg SRC_REV=$(git rev-parse --short HEAD) \
|
||||
&& docker compose up -d; docker compose logs -f
|
||||
&& ./scripts/compose.sh up -d; ./scripts/compose.sh logs -f
|
||||
```
|
||||
|
||||
## Upgrade
|
||||
|
||||
### Test
|
||||
|
||||
1. Check if the backups are up to date: `docker compose run --rm restore-cli /usr/local/bin/restic snapshots`
|
||||
2. Update `AUTHENTIK_TAG` to the desired tag in `env.test.template`.
|
||||
3. Commit & push changes to the Repo.
|
||||
4. Run `diff --color='auto' env.test.template .env` to display the diff between
|
||||
`env.test.template` and `.env`.
|
||||
5. Port the made changes to `.env`.
|
||||
6. `docker-compose-2.32.4 pull`
|
||||
7. `docker-compose-2.32.4 down`
|
||||
8. `docker-compose-2.32.4 up -d; docker-compose-2.32.4 logs -f`
|
||||
1. Check if the backups are up to date: `./scripts/compose.sh run --rm restore-cli /usr/local/bin/restic snapshots`
|
||||
2. Create a new branch `git checkout -b <version>`.
|
||||
3. Download the the docker compose for the version you want to update:
|
||||
`curl -fsSL -o docker-compose.yml https://goauthentik.io/version/<version>/docker-compose.yml`
|
||||
4. Update `AUTHENTIK_TAG` to the desired tag in `env.test.template`.
|
||||
5. Commit & push changes to the Repo.
|
||||
6. Run `diff --color='auto' env.test.template .env` to display the diff between
|
||||
`env.test.template` and `.env`.
|
||||
7. Port the made changes to `.env`.
|
||||
8. `./scripts/compose.sh pull`
|
||||
9. `./scripts/compose.sh down`
|
||||
10. `./scripts/compose.sh up -d; ./scripts/compose.sh logs -f`
|
||||
|
||||
### Prod
|
||||
|
||||
1. Check if the backups are up to date: `docker compose run --rm restore-cli /usr/local/bin/restic snapshots`
|
||||
2. Update `AUTHENTIK_TAG` to the desired tag in `env.prod.template`.
|
||||
3. Commit & push changes to the Repo.
|
||||
4. Run `diff --color='auto' env.prod.template .env` to display the diff between
|
||||
`env.prod.template` and `.env`.
|
||||
5. Port the made changes to `.env`.
|
||||
6. `docker compose pull`
|
||||
7. `docker compose down`
|
||||
8. `docker compose up -d; docker compose logs -f`
|
||||
1. Check if the backups are up to date: `./scripts/compose.sh run --rm restore-cli /usr/local/bin/restic snapshots`
|
||||
2. Create a new branch `git checkout -b <version>`.
|
||||
3. Download the the docker compose for the version you want to update:
|
||||
`curl -fsSL -o docker-compose.yml https://goauthentik.io/version/<version>/docker-compose.yml`
|
||||
4. Update `AUTHENTIK_TAG` to the desired tag in `env.prod.template`.
|
||||
5. Commit & push changes to the Repo.
|
||||
6. Run `diff --color='auto' env.prod.template .env` to display the diff between
|
||||
`env.prod.template` and `.env`.
|
||||
7. Port the made changes to `.env`.
|
||||
8. `./scripts/compose.sh pull`
|
||||
9. `./scripts/compose.sh down`
|
||||
10. `./scripts/compose.sh up -d; ./scripts/compose.sh logs -f`
|
||||
|
||||
## Disaster recovery / restore
|
||||
|
||||
|
|
|
|||
121
docker-compose.override.yml
Normal file
121
docker-compose.override.yml
Normal file
|
|
@ -0,0 +1,121 @@
|
|||
---
|
||||
|
||||
services:
|
||||
geoipupdate:
|
||||
image: "maxmindinc/geoipupdate:latest"
|
||||
volumes:
|
||||
- "geoip:/usr/share/GeoIP"
|
||||
environment:
|
||||
GEOIPUPDATE_EDITION_IDS: "GeoLite2-City GeoLite2-ASN"
|
||||
GEOIPUPDATE_FREQUENCY: "8"
|
||||
GEOIPUPDATE_ACCOUNT_ID: "${GEOIPUPDATE_ACCOUNT_ID:?MaxMind GeoIP account ID required}"
|
||||
GEOIPUPDATE_LICENSE_KEY: "${GEOIPUPDATE_LICENSE_KEY:?MaxMind GeoIP license key required}"
|
||||
|
||||
postgresql:
|
||||
image: docker.io/library/postgres:${POSTGRES_TAG:?POSTGRES_TAG is not configured}
|
||||
volumes:
|
||||
- database:/var/lib/postgresql/data
|
||||
- backups_db:/var/lib/postgresql/backups
|
||||
networks:
|
||||
- backend
|
||||
|
||||
redis:
|
||||
image: docker.io/library/redis:${REDIS_TAG:?REDIS_TAG is not configured}
|
||||
networks:
|
||||
- backend
|
||||
|
||||
server:
|
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
|
||||
environment:
|
||||
B23_ALLOW_UP: ${B23_ALLOW_UP:?Use the script ./scripts/compose.sh to run this compose!}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database}
|
||||
ports: []
|
||||
networks:
|
||||
- backend
|
||||
|
||||
worker:
|
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
|
||||
environment:
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database}
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- ./data/authentik/media:/media
|
||||
- ./data/authentik/certs:/certs
|
||||
- ./data/authentik/custom-templates:/templates
|
||||
- geoip:/geoip
|
||||
networks:
|
||||
- backend
|
||||
|
||||
backup:
|
||||
image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
PRE_COMMANDS: |-
|
||||
cd /compose-project/
|
||||
[[ $($(docker compose &>/dev/null); echo "$?") -eq 0 ]] || apk add --no-cache docker-cli-compose
|
||||
docker compose exec -T postgresql pg_dump -U ${PG_USER:-authentik} -d ${PG_DB:-authentik} -f /var/lib/postgresql/backups/${PG_DB:-authentik}.sql
|
||||
RUN_ON_STARTUP: "false"
|
||||
BACKUP_CRON: "00 32 2 * * *"
|
||||
RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
|
||||
RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
|
||||
RESTIC_BACKUP_SOURCES: /var/lib/postgresql/backups /var/lib/authentik/backups /var/lib/lego/backups
|
||||
RESTIC_BACKUP_ARGS: >-
|
||||
--tag ${RESTIC_TAG:?Restic tag is required}
|
||||
--verbose
|
||||
RESTIC_FORGET_ARGS: >-
|
||||
--keep-last 10
|
||||
--keep-daily 7
|
||||
--keep-weekly 5
|
||||
--keep-monthly 12
|
||||
TZ: Europe/Berlin
|
||||
volumes:
|
||||
- ./data/restic/ssh/:/run/secrets/.ssh:ro
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- ./docker-compose.yml:/compose-project/docker-compose.yml:ro
|
||||
- ./.env:/compose-project/.env:ro
|
||||
- backups_db:/var/lib/postgresql/backups:ro
|
||||
- ./data/authentik/certs:/var/lib/authentik/backups/certs:ro
|
||||
- ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:ro
|
||||
- ./data/authentik/media:/var/lib/authentik/backups/media:ro
|
||||
- ./data/.lego:/var/lib/lego/backups:ro
|
||||
|
||||
prune-backup:
|
||||
image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
SKIP_INIT: "true"
|
||||
RUN_ON_STARTUP: "false"
|
||||
PRUNE_CRON: "00 47 3 * * *"
|
||||
RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
|
||||
RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
|
||||
TZ: Europe/Berlin
|
||||
volumes:
|
||||
- ./data/restic/ssh/:/run/secrets/.ssh:ro
|
||||
|
||||
# prüft ob backups noch in Ordnung sind, evtl. erweitern zum prüfen der Daten
|
||||
check-backup:
|
||||
image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
#RUN_ON_STARTUP: "true"
|
||||
SKIP_INIT: "true"
|
||||
CHECK_CRON: "00 08 04 * * *"
|
||||
RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
|
||||
RESTIC_PASSWORD: ${RESTIC_REPO_PASSWORD}
|
||||
#POST_COMMANDS_FAILURE: echo "Post Command Failure test" > /restic/message
|
||||
TZ: Europe/Berlin
|
||||
volumes:
|
||||
- ./data/restic/ssh/:/run/secrets/.ssh:ro
|
||||
|
||||
restore-cli:
|
||||
image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
|
||||
entrypoint: /entrypoint-restore
|
||||
|
||||
volumes:
|
||||
backups_db:
|
||||
driver: local
|
||||
geoip:
|
||||
driver: local
|
||||
|
||||
networks:
|
||||
backend:
|
||||
|
|
@ -1,112 +1,13 @@
|
|||
---
|
||||
# Based on authentiks official docker-compose.yml
|
||||
# Version: 2025.2.1
|
||||
|
||||
services:
|
||||
geoipupdate:
|
||||
image: "maxmindinc/geoipupdate:latest"
|
||||
volumes:
|
||||
- "geoip:/usr/share/GeoIP"
|
||||
environment:
|
||||
GEOIPUPDATE_EDITION_IDS: "GeoLite2-City GeoLite2-ASN"
|
||||
GEOIPUPDATE_FREQUENCY: "8"
|
||||
GEOIPUPDATE_ACCOUNT_ID: "${GEOIPUPDATE_ACCOUNT_ID:?MaxMind GeoIP account ID required}"
|
||||
GEOIPUPDATE_LICENSE_KEY: "${GEOIPUPDATE_LICENSE_KEY:?MaxMind GeoIP license key required}"
|
||||
|
||||
postgresql:
|
||||
image: docker.io/library/postgres:${POSTGRES_TAG:?POSTGRES_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
|
||||
start_period: 20s
|
||||
interval: 30s
|
||||
retries: 5
|
||||
timeout: 5s
|
||||
volumes:
|
||||
- database:/var/lib/postgresql/data
|
||||
- backups_db:/var/lib/postgresql/backups
|
||||
environment:
|
||||
POSTGRES_PASSWORD: ${PG_PASS:?database password required}
|
||||
POSTGRES_USER: ${PG_USER:-authentik}
|
||||
POSTGRES_DB: ${PG_DB:-authentik}
|
||||
env_file:
|
||||
- .env
|
||||
networks:
|
||||
- backend
|
||||
|
||||
redis:
|
||||
image: docker.io/library/redis:${REDIS_TAG:?REDIS_TAG is not configured}
|
||||
command: --save 60 1 --loglevel warning
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
|
||||
start_period: 20s
|
||||
interval: 30s
|
||||
retries: 5
|
||||
timeout: 3s
|
||||
volumes:
|
||||
- redis:/data
|
||||
networks:
|
||||
- backend
|
||||
|
||||
server:
|
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
command: server
|
||||
environment:
|
||||
AUTHENTIK_REDIS__HOST: redis
|
||||
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
||||
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database}
|
||||
volumes:
|
||||
- ./data/authentik/media:/media
|
||||
- ./data/authentik/custom-templates:/templates
|
||||
- geoip:/geoip
|
||||
env_file:
|
||||
- .env
|
||||
depends_on:
|
||||
postgresql:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_healthy
|
||||
B23_ALLOW_UP: "true"
|
||||
networks:
|
||||
- backend
|
||||
- frontend
|
||||
|
||||
worker:
|
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
command: worker
|
||||
environment:
|
||||
AUTHENTIK_REDIS__HOST: redis
|
||||
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
||||
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database}
|
||||
# `user: root` and the docker socket volume are optional.
|
||||
# See more for the docker socket integration here:
|
||||
# https://goauthentik.io/docs/outposts/integrations/docker
|
||||
# Removing `user: root` also prevents the worker from fixing the permissions
|
||||
# on the mounted folders, so when removing this make sure the folders have the correct UID/GID
|
||||
# (1000:1000 by default)
|
||||
user: root
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- ./data/authentik/media:/media
|
||||
- ./data/authentik/certs:/certs
|
||||
- ./data/authentik/custom-templates:/templates
|
||||
- geoip:/geoip
|
||||
env_file:
|
||||
- .env
|
||||
depends_on:
|
||||
postgresql:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_healthy
|
||||
networks:
|
||||
- backend
|
||||
|
||||
nginx:
|
||||
build:
|
||||
context: ./docker/nginx
|
||||
|
|
@ -150,96 +51,5 @@ services:
|
|||
networks:
|
||||
- frontend
|
||||
|
||||
backup:
|
||||
image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
PRE_COMMANDS: |-
|
||||
cd /compose-project/
|
||||
[[ $($(docker compose &>/dev/null); echo "$?") -eq 0 ]] || apk add --no-cache docker-cli-compose
|
||||
docker compose exec -T postgresql pg_dump -U ${PG_USER:-authentik} -d ${PG_DB:-authentik} -f /var/lib/postgresql/backups/${PG_DB:-authentik}.sql
|
||||
RUN_ON_STARTUP: "false"
|
||||
BACKUP_CRON: "00 32 2 * * *"
|
||||
RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
|
||||
RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
|
||||
RESTIC_BACKUP_SOURCES: /var/lib/postgresql/backups /var/lib/authentik/backups /var/lib/lego/backups
|
||||
RESTIC_BACKUP_ARGS: >-
|
||||
--tag ${RESTIC_TAG:?Restic tag is required}
|
||||
--verbose
|
||||
RESTIC_FORGET_ARGS: >-
|
||||
--keep-last 10
|
||||
--keep-daily 7
|
||||
--keep-weekly 5
|
||||
--keep-monthly 12
|
||||
TZ: Europe/Berlin
|
||||
volumes:
|
||||
- ./data/restic/ssh/:/run/secrets/.ssh:ro
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- ./docker-compose.yml:/compose-project/docker-compose.yml:ro
|
||||
- ./.env:/compose-project/.env:ro
|
||||
- backups_db:/var/lib/postgresql/backups:ro
|
||||
- ./data/authentik/certs:/var/lib/authentik/backups/certs:ro
|
||||
- ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:ro
|
||||
- ./data/authentik/media:/var/lib/authentik/backups/media:ro
|
||||
- ./data/.lego:/var/lib/lego/backups:ro
|
||||
|
||||
prune-backup:
|
||||
image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
SKIP_INIT: "true"
|
||||
RUN_ON_STARTUP: "false"
|
||||
PRUNE_CRON: "00 47 3 * * *"
|
||||
RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
|
||||
RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
|
||||
TZ: Europe/Berlin
|
||||
volumes:
|
||||
- ./data/restic/ssh/:/run/secrets/.ssh:ro
|
||||
|
||||
# prüft ob backups noch in Ordnung sind, evtl. erweitern zum prüfen der Daten
|
||||
check-backup:
|
||||
image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
#RUN_ON_STARTUP: "true"
|
||||
SKIP_INIT: "true"
|
||||
CHECK_CRON: "00 08 04 * * *"
|
||||
RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
|
||||
RESTIC_PASSWORD: ${RESTIC_REPO_PASSWORD}
|
||||
#POST_COMMANDS_FAILURE: echo "Post Command Failure test" > /restic/message
|
||||
TZ: Europe/Berlin
|
||||
volumes:
|
||||
- ./data/restic/ssh/:/run/secrets/.ssh:ro
|
||||
|
||||
restore-cli:
|
||||
image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
|
||||
entrypoint: /entrypoint-restore
|
||||
environment:
|
||||
RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
|
||||
RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
|
||||
TZ: Europe/Berlin
|
||||
volumes:
|
||||
- ./data/restic/ssh/:/run/secrets/.ssh:ro
|
||||
- ./docker-compose.yml:/compose-project/docker-compose.yml:ro
|
||||
- ./.env:/compose-project/.env:ro
|
||||
- backups_db:/var/lib/postgresql/backups:rw
|
||||
- ./data/authentik/certs:/var/lib/authentik/backups/certs:rw
|
||||
- ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:rw
|
||||
- ./data/authentik/media:/var/lib/authentik/backups/media:rw
|
||||
- ./data/.lego:/var/lib/lego/backups:rw
|
||||
|
||||
|
||||
volumes:
|
||||
backups_db:
|
||||
driver: local
|
||||
database:
|
||||
driver: local
|
||||
redis:
|
||||
driver: local
|
||||
geoip:
|
||||
driver: local
|
||||
|
||||
|
||||
networks:
|
||||
backend:
|
||||
frontend:
|
||||
|
|
@ -1,75 +1,8 @@
|
|||
---
|
||||
# Based on authentiks official docker-compose.yml
|
||||
# Version: 2025.2.1
|
||||
|
||||
services:
|
||||
geoipupdate:
|
||||
image: "maxmindinc/geoipupdate:latest"
|
||||
volumes:
|
||||
- "geoip:/usr/share/GeoIP"
|
||||
environment:
|
||||
GEOIPUPDATE_EDITION_IDS: "GeoLite2-City GeoLite2-ASN"
|
||||
GEOIPUPDATE_FREQUENCY: "8"
|
||||
GEOIPUPDATE_ACCOUNT_ID: "${GEOIPUPDATE_ACCOUNT_ID:?MaxMind GeoIP account ID required}"
|
||||
GEOIPUPDATE_LICENSE_KEY: "${GEOIPUPDATE_LICENSE_KEY:?MaxMind GeoIP license key required}"
|
||||
|
||||
postgresql:
|
||||
image: docker.io/library/postgres:${POSTGRES_TAG:?POSTGRES_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
|
||||
start_period: 20s
|
||||
interval: 30s
|
||||
retries: 5
|
||||
timeout: 5s
|
||||
volumes:
|
||||
- database:/var/lib/postgresql/data
|
||||
- backups_db:/var/lib/postgresql/backups
|
||||
environment:
|
||||
POSTGRES_PASSWORD: ${PG_PASS:?database password required}
|
||||
POSTGRES_USER: ${PG_USER:-authentik}
|
||||
POSTGRES_DB: ${PG_DB:-authentik}
|
||||
env_file:
|
||||
- .env
|
||||
networks:
|
||||
- backend
|
||||
|
||||
redis:
|
||||
image: docker.io/library/redis:${REDIS_TAG:?REDIS_TAG is not configured}
|
||||
command: --save 60 1 --loglevel warning
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
|
||||
start_period: 20s
|
||||
interval: 30s
|
||||
retries: 5
|
||||
timeout: 3s
|
||||
volumes:
|
||||
- redis:/data
|
||||
networks:
|
||||
- backend
|
||||
|
||||
server:
|
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
command: server
|
||||
environment:
|
||||
AUTHENTIK_REDIS__HOST: redis
|
||||
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
||||
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database}
|
||||
volumes:
|
||||
- ./data/authentik/media:/media
|
||||
- ./data/authentik/custom-templates:/templates
|
||||
- geoip:/geoip
|
||||
env_file:
|
||||
- .env
|
||||
depends_on:
|
||||
postgresql:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_healthy
|
||||
B23_ALLOW_UP: "true"
|
||||
networks:
|
||||
- backend
|
||||
- web
|
||||
|
|
@ -84,115 +17,6 @@ services:
|
|||
- "traefik.http.services.sso.loadbalancer.server.port=9443" # set port the container listenes to
|
||||
- "traefik.http.services.sso.loadbalancer.server.scheme=https"
|
||||
|
||||
worker:
|
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
command: worker
|
||||
environment:
|
||||
AUTHENTIK_REDIS__HOST: redis
|
||||
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
||||
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:?PG_PASS is required. - Password for authentik's postgresql database}
|
||||
# `user: root` and the docker socket volume are optional.
|
||||
# See more for the docker socket integration here:
|
||||
# https://goauthentik.io/docs/outposts/integrations/docker
|
||||
# Removing `user: root` also prevents the worker from fixing the permissions
|
||||
# on the mounted folders, so when removing this make sure the folders have the correct UID/GID
|
||||
# (1000:1000 by default)
|
||||
user: root
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- ./data/authentik/media:/media
|
||||
- ./data/authentik/certs:/certs
|
||||
- ./data/authentik/custom-templates:/templates
|
||||
- geoip:/geoip
|
||||
env_file:
|
||||
- .env
|
||||
depends_on:
|
||||
postgresql:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_healthy
|
||||
networks:
|
||||
- backend
|
||||
|
||||
backup:
|
||||
image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
PRE_COMMANDS: |-
|
||||
cd /compose-project/
|
||||
[[ $($(docker compose &>/dev/null); echo "$?") -eq 0 ]] || apk add --no-cache docker-cli-compose
|
||||
docker compose exec -T postgresql pg_dump -U ${PG_USER:-authentik} -d ${PG_DB:-authentik} -f /var/lib/postgresql/backups/${PG_DB:-authentik}.sql
|
||||
RUN_ON_STARTUP: "false"
|
||||
BACKUP_CRON: "00 32 2 * * *"
|
||||
RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
|
||||
RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
|
||||
RESTIC_BACKUP_SOURCES: /var/lib/postgresql/backups /var/lib/authentik/backups /var/lib/lego/backups
|
||||
RESTIC_BACKUP_ARGS: >-
|
||||
--tag ${RESTIC_TAG:?Restic tag is required}
|
||||
--verbose
|
||||
RESTIC_FORGET_ARGS: >-
|
||||
--keep-last 10
|
||||
--keep-daily 7
|
||||
--keep-weekly 5
|
||||
--keep-monthly 12
|
||||
TZ: Europe/Berlin
|
||||
volumes:
|
||||
- ./data/restic/ssh/:/run/secrets/.ssh:ro
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- ./docker-compose.yml:/compose-project/docker-compose.yml:ro
|
||||
- ./.env:/compose-project/.env:ro
|
||||
- backups_db:/var/lib/postgresql/backups:ro
|
||||
- ./data/authentik/certs:/var/lib/authentik/backups/certs:ro
|
||||
- ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:ro
|
||||
- ./data/authentik/media:/var/lib/authentik/backups/media:ro
|
||||
- ./data/.lego:/var/lib/lego/backups:ro
|
||||
|
||||
prune-backup:
|
||||
image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
SKIP_INIT: "true"
|
||||
RUN_ON_STARTUP: "false"
|
||||
PRUNE_CRON: "00 47 3 * * *"
|
||||
RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
|
||||
RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
|
||||
TZ: Europe/Berlin
|
||||
volumes:
|
||||
- ./data/restic/ssh/:/run/secrets/.ssh:ro
|
||||
|
||||
restore-cli:
|
||||
image: registry.git.base23.de/base23/backup/resticker:${RESTICKER_TAG:?RESTICKER_TAG is not configured}
|
||||
entrypoint: /entrypoint-restore
|
||||
environment:
|
||||
RESTIC_REPOSITORY: sftp://${RESTIC_REPO_USER:?Restic repository user is required}@${RESTIC_REPO_ADDRESS:?Restic repository address is requried}:${RESTIC_REPO_PORT:?Restic repository port is required}//backup
|
||||
RESTIC_PASSWORD: '${RESTIC_REPO_PASSWORD:?Restic repository password is required}'
|
||||
TZ: Europe/Berlin
|
||||
volumes:
|
||||
- ./data/restic/ssh/:/run/secrets/.ssh:ro
|
||||
- ./docker-compose.yml:/compose-project/docker-compose.yml:ro
|
||||
- ./.env:/compose-project/.env:ro
|
||||
- backups_db:/var/lib/postgresql/backups:rw
|
||||
- ./data/authentik/certs:/var/lib/authentik/backups/certs:rw
|
||||
- ./data/authentik/custom-templates:/var/lib/authentik/backups/templates:rw
|
||||
- ./data/authentik/media:/var/lib/authentik/backups/media:rw
|
||||
- ./data/.lego:/var/lib/lego/backups:rw
|
||||
|
||||
|
||||
volumes:
|
||||
backups_db:
|
||||
driver: local
|
||||
database:
|
||||
driver: local
|
||||
redis:
|
||||
driver: local
|
||||
geoip:
|
||||
driver: local
|
||||
|
||||
|
||||
networks:
|
||||
backend:
|
||||
web:
|
||||
external: true
|
||||
92
docker-compose.yml
Normal file
92
docker-compose.yml
Normal file
|
|
@ -0,0 +1,92 @@
|
|||
---
|
||||
|
||||
services:
|
||||
postgresql:
|
||||
image: docker.io/library/postgres:16-alpine
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
|
||||
start_period: 20s
|
||||
interval: 30s
|
||||
retries: 5
|
||||
timeout: 5s
|
||||
volumes:
|
||||
- database:/var/lib/postgresql/data
|
||||
environment:
|
||||
POSTGRES_PASSWORD: ${PG_PASS:?database password required}
|
||||
POSTGRES_USER: ${PG_USER:-authentik}
|
||||
POSTGRES_DB: ${PG_DB:-authentik}
|
||||
env_file:
|
||||
- .env
|
||||
redis:
|
||||
image: docker.io/library/redis:alpine
|
||||
command: --save 60 1 --loglevel warning
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
|
||||
start_period: 20s
|
||||
interval: 30s
|
||||
retries: 5
|
||||
timeout: 3s
|
||||
volumes:
|
||||
- redis:/data
|
||||
server:
|
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.4.2}
|
||||
restart: unless-stopped
|
||||
command: server
|
||||
environment:
|
||||
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
|
||||
AUTHENTIK_REDIS__HOST: redis
|
||||
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
||||
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
|
||||
volumes:
|
||||
- ./media:/media
|
||||
- ./custom-templates:/templates
|
||||
env_file:
|
||||
- .env
|
||||
ports:
|
||||
- "${COMPOSE_PORT_HTTP:-9000}:9000"
|
||||
- "${COMPOSE_PORT_HTTPS:-9443}:9443"
|
||||
depends_on:
|
||||
postgresql:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_healthy
|
||||
worker:
|
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.4.2}
|
||||
restart: unless-stopped
|
||||
command: worker
|
||||
environment:
|
||||
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
|
||||
AUTHENTIK_REDIS__HOST: redis
|
||||
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
||||
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
|
||||
# `user: root` and the docker socket volume are optional.
|
||||
# See more for the docker socket integration here:
|
||||
# https://goauthentik.io/docs/outposts/integrations/docker
|
||||
# Removing `user: root` also prevents the worker from fixing the permissions
|
||||
# on the mounted folders, so when removing this make sure the folders have the correct UID/GID
|
||||
# (1000:1000 by default)
|
||||
user: root
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- ./media:/media
|
||||
- ./certs:/certs
|
||||
- ./custom-templates:/templates
|
||||
env_file:
|
||||
- .env
|
||||
depends_on:
|
||||
postgresql:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_healthy
|
||||
|
||||
volumes:
|
||||
database:
|
||||
driver: local
|
||||
redis:
|
||||
driver: local
|
||||
|
|
@ -4,7 +4,7 @@ PUBLIC_DOMAIN=sso.test.base23.de
|
|||
COMPOSE_PROJECT_NAME=sso-base23-de
|
||||
|
||||
# Server Versions
|
||||
AUTHENTIK_TAG=2025.2.4
|
||||
AUTHENTIK_TAG=2025.4.2
|
||||
POSTGRES_TAG=16.6-alpine
|
||||
REDIS_TAG=7.4.2-alpine
|
||||
RESTICKER_TAG=0.0.2-restic0.17.0
|
||||
|
|
|
|||
41
scripts/compose.sh
Executable file
41
scripts/compose.sh
Executable file
|
|
@ -0,0 +1,41 @@
|
|||
#!/usr/bin/env bash
|
||||
set -euf -o pipefail
|
||||
|
||||
# Check if yq is installed
|
||||
if ! command -v yq &>/dev/null; then
|
||||
echo "yq is required but not installed. Please install it manually."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
STAGE="${1:-}"
|
||||
shift || true
|
||||
|
||||
if [[ -z "${STAGE,,}" ]]; then
|
||||
echo "Usage: $0 <prod|test>"
|
||||
echo "Example: $0 test"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ "${STAGE,,}" == "prod" ]]; then
|
||||
DOCKER_COMPOSE_CLI="docker compose"
|
||||
elif [[ "${STAGE,,}" == "test" ]]; then
|
||||
DOCKER_COMPOSE_CLI="docker-compose-2.32.4"
|
||||
else
|
||||
echo "Invalid stage: ${STAGE,,}. Use 'prod' or 'test'."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cd "$(dirname "$(realpath "$0")")/../"
|
||||
AUTHENTIK_DOCKER_COMPOSE_PATH="$(realpath "$(pwd)")"
|
||||
|
||||
# Merge docker-compose files using yq
|
||||
# 1st merger is docker-compose.override.yml on top of the base docker-compose.yml
|
||||
# 2nd merger is the stage-specific docker-compose file on top of the result of the first merger
|
||||
# The final result is piped to docker compose command
|
||||
yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' \
|
||||
docker-compose.yml \
|
||||
docker-compose.override.yml \
|
||||
| yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' \
|
||||
- \
|
||||
docker-compose.${STAGE,,}.yml \
|
||||
| ${DOCKER_COMPOSE_CLI} -f- ${@:-}
|
||||
Loading…
Add table
Add a link
Reference in a new issue