authentik compose

networks:
  authentik:
    internal: true
  proxy:
    external: true

services:
  authentik-db:
    image: postgres:16-alpine
    container_name: authentik-db
    restart: unless-stopped
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}']
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    volumes:
      - $HOME/data/authentik/db:/var/lib/postgresql/data
      - /etc/localtime:/etc/localtime:ro
    environment:
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_DB=${POSTGRES_DB}
    networks:
      - authentik
    tty: true
    cpus: 2
    mem_limit: 200m

  authentik-cache:
    image: redis:alpine
    container_name: authentik-cache
    command: --save 60 1 --loglevel warning
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    volumes:
      - $HOME/data/authentik/cache:/data
      - /etc/localtime:/etc/localtime:ro
    networks:
      - authentik
    tty: true
    cpus: 1
    mem_limit: 100m

  authentik:
    image: ghcr.io/goauthentik/server:${AUTHENTIK_IMAGE_VER}
    container_name: authentik
    restart: unless-stopped
    command: server
    environment:
      - AUTHENTIK_REDIS__HOST=${REDIS_HOST}
      - AUTHENTIK_POSTGRESQL__HOST=${POSTGRES_HOST}
      - AUTHENTIK_POSTGRESQL__USER=${POSTGRES_USER}
      - AUTHENTIK_POSTGRESQL__NAME=${POSTGRES_DB}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${POSTGRES_PASSWORD}
      - AUTHENTIK_ERROR_REPORTING__ENABLED=true
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
      - AUTHENTIK_REDIS__DB=1
      - AUTHENTIK_REDIS__PORT=6379
      - AUTHENTIK_POSTGRESQL__PORT=5432
    volumes:
      - $HOME/data/authentik/media:/media
      - $HOME/data/authentik/templates:/templates
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 9000:9000/tcp
      - 9443:9443/tcp
    extra_hosts:
      - host.docker.internal:host-gateway
    depends_on:
      - authentik-db
      - authentik-cache
    networks:
      - authentik
      - proxy
    tty: true
    cpus: 2
    mem_limit: 400m

  authentik-worker:
    image: ghcr.io/goauthentik/server:${AUTHENTIK_IMAGE_VER}
    container_name: authentik-worker
    restart: unless-stopped
    command: worker
    environment:
      - AUTHENTIK_REDIS__HOST=${REDIS_HOST}
      - AUTHENTIK_POSTGRESQL__HOST=${POSTGRES_HOST}
      - AUTHENTIK_POSTGRESQL__USER=${POSTGRES_USER}
      - AUTHENTIK_POSTGRESQL__NAME=${POSTGRES_DB}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${POSTGRES_PASSWORD}
      - AUTHENTIK_ERROR_REPORTING__ENABLED=true
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
      - AUTHENTIK_REDIS__DB=1
      - AUTHENTIK_REDIS__PORT=6379
      - AUTHENTIK_POSTGRESQL__PORT=5432
    user: root
    volumes:
      - $HOME/data/authentik/media:/media
      - $HOME/data/authentik/certs:/certs
      - $HOME/data/authentik/templates:/templates
      - /etc/localtime:/etc/localtime:ro
    networks:
      - authentik
      - proxy
    depends_on:
      - authentik-db
      - authentik-cache
    tty: true
    #cpus: 2
    #mem_limit: 400m