docker-compose/authentik
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: deploy Authentik with age-encrypted secrets

Browse source
This commit is contained in:
Philip Henning 2026-08-21 14:04:26 +02:00
parent 9f8f619f3e
commit e966ec09ae
9 changed files with 240 additions and 260 deletions
Download patch file Download diff file Expand all files Collapse all files

47
tests/compose-secrets.sh Normal file
View file

@ -0,0 +1,47 @@
#!/usr/bin/env bash
set -euo pipefail
repo_root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
test_dir=$(mktemp -d)
trap 'rm -rf -- "$test_dir"' EXIT
install -d "$test_dir/env" "$test_dir/.komodo"
cp -- "$repo_root/docker-compose.yml" "$test_dir/docker-compose.yml"
cp -- "$repo_root/docker-compose.override.yml" "$test_dir/docker-compose.override.yml"
cp -- "$repo_root/env/common.env" "$test_dir/env/common.env"
cat > "$test_dir/.komodo/prod.env" <<'EOF'
PG_PASS=SENTINEL_POSTGRES_PASSWORD
AUTHENTIK_SECRET_KEY=SENTINEL_AUTHENTIK_SECRET_KEY
AUTHENTIK_EMAIL__PASSWORD=SENTINEL_EMAIL_PASSWORD
GEOIPUPDATE_LICENSE_KEY=SENTINEL_GEOIP_LICENSE_KEY
EOF
(
cd "$test_dir"
docker compose \
--env-file env/common.env \
--env-file .komodo/prod.env \
--file docker-compose.yml \
--file docker-compose.override.yml \
config --format json
) > "$test_dir/rendered.json"
if grep -F 'SENTINEL_' "$test_dir/rendered.json"; then
printf 'Rendered Compose configuration contains plaintext secrets\n' >&2
exit 1
fi
jq -e '
.services.postgresql.environment.POSTGRES_PASSWORD_FILE == "/run/secrets/postgres_password" and
(.services.postgresql.environment | has("POSTGRES_PASSWORD") | not) and
.services.server.environment.AUTHENTIK_POSTGRESQL__PASSWORD == "file:///run/secrets/postgres_password" and
.services.server.environment.AUTHENTIK_SECRET_KEY == "file:///run/secrets/authentik_secret_key" and
.services.server.environment.AUTHENTIK_EMAIL__PASSWORD == "file:///run/secrets/authentik_email_password" and
.services.geoipupdate.environment.GEOIPUPDATE_LICENSE_KEY_FILE == "/run/secrets/geoip_license_key" and
([.services.postgresql.secrets[].source] | sort) == ["postgres_password"] and
([.services.server.secrets[].source] | sort) == ["authentik_email_password", "authentik_secret_key", "postgres_password"] and
([.services.worker.secrets[].source] | sort) == ["authentik_email_password", "authentik_secret_key", "postgres_password"] and
([.services.geoipupdate.secrets[].source] | sort) == ["geoip_license_key"] and
(.services.redis | has("secrets") | not)
' "$test_dir/rendered.json" >/dev/null