feat: deploy Authentik with age-encrypted secrets

docker-compose.yml

@@ -1,10 +1,10 @@
 services:
   postgresql:
     env_file:
-    - .env
+    - env/common.env
     environment:
       POSTGRES_DB: ${PG_DB:-authentik}
-      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
+      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
       POSTGRES_USER: ${PG_USER:-authentik}
     healthcheck:
       interval: 30s
@@ -16,6 +16,8 @@ services:
       timeout: 5s
     image: docker.io/library/postgres:16-alpine
     restart: unless-stopped
+    secrets:
+    - postgres_password
     volumes:
     - database:/var/lib/postgresql/data
   redis:
@@ -40,19 +42,24 @@ services:
       redis:
         condition: service_healthy
     env_file:
-    - .env
+    - env/common.env
     environment:
+      AUTHENTIK_EMAIL__PASSWORD: file:///run/secrets/authentik_email_password
       AUTHENTIK_POSTGRESQL__HOST: postgresql
       AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/postgres_password
       AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
       AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
     image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.1}
     ports:
     - ${COMPOSE_PORT_HTTP:-9000}:9000
     - ${COMPOSE_PORT_HTTPS:-9443}:9443
     restart: unless-stopped
+    secrets:
+    - authentik_email_password
+    - authentik_secret_key
+    - postgres_password
     volumes:
     - ./media:/media
     - ./custom-templates:/templates
@@ -64,22 +71,36 @@ services:
       redis:
         condition: service_healthy
     env_file:
-    - .env
+    - env/common.env
     environment:
+      AUTHENTIK_EMAIL__PASSWORD: file:///run/secrets/authentik_email_password
       AUTHENTIK_POSTGRESQL__HOST: postgresql
       AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/postgres_password
       AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
       AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
     image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.1}
     restart: unless-stopped
+    secrets:
+    - authentik_email_password
+    - authentik_secret_key
+    - postgres_password
     user: root
     volumes:
     - /var/run/docker.sock:/var/run/docker.sock
     - ./media:/media
     - ./certs:/certs
     - ./custom-templates:/templates
+secrets:
+  authentik_email_password:
+    environment: AUTHENTIK_EMAIL__PASSWORD
+  authentik_secret_key:
+    environment: AUTHENTIK_SECRET_KEY
+  geoip_license_key:
+    environment: GEOIPUPDATE_LICENSE_KEY
+  postgres_password:
+    environment: PG_PASS
 volumes:
   database:
     driver: local