services:
  postgresql:
    environment:
      POSTGRES_DB: ${PG_DB:-authentik}
      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
      POSTGRES_USER: ${PG_USER:-authentik}
    healthcheck:
      interval: 30s
      retries: 5
      start_period: 20s
      test:
      - CMD-SHELL
      - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
      timeout: 5s
    image: docker.io/library/postgres:16-alpine
    networks:
      - internal
    restart: unless-stopped
    volumes:
    - database:/var/lib/postgresql/data
  server:
    command: server
    depends_on:
      postgresql:
        condition: service_healthy
    environment:
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}

      AUTHENTIK_EMAIL__HOST: mail.postale.io
      AUTHENTIK_EMAIL__PORT: 587
      AUTHENTIK_EMAIL__USERNAME: ${EMAIL__ADDRESS}
      AUTHENTIK_EMAIL__PASSWORD: ${EMAIL__PASSWORD} 
      AUTHENTIK_EMAIL__USE_TLS: true
      AUTHENTIK_EMAIL__USE_SSL: false
      AUTHENTIK_EMAIL__TIMEOUT: 60
      AUTHENTIK_EMAIL__FROM: ${EMAIL__ADDRESS}
    image: ghcr.io/goauthentik/server:2026.2.2
    networks:
      - proxy
      - internal
    restart: unless-stopped
    volumes:
    - shared_media:/media
    - shared_data:/data
    - shared_templates:/templates
    labels:
      traefik.enable: true
      traefik.http.routers.authentik.rule: "Host(`auth.urmel.de`)"
      traefik.http.routers.authentik.tls: true
      traefik.http.routers.authentik.tls.certresolver: hetzner
      traefik.http.routers.authentik.priority: 10
      traefik.http.routers.authentik.service: authentik
      traefik.http.services.authentik.loadbalancer.server.port: 9000

      # https://goneuland.de/authentik-in-kombination-mit-traefik/#2_Authentik_im_Stack_vorbereiten
      traefik.http.routers.authentik-outpost.rule: "HostRegexp(`{subdomain:[a-z0-9-]+.}urmel.de`) && PathPrefix(`/outpost.goauthentik.io/`)"
      traefik.http.routers.authentik-outpost.tls: true
      traefik.http.routers.authentik-outpost.priority: 15
      traefik.http.routers.authentik-outpost.service: authentik-outpost
      traefik.http.services.authentik-outpost.loadbalancer.server.port: 9000

  worker:
    command: worker
    depends_on:
      postgresql:
        condition: service_healthy
    environment:
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}

      AUTHENTIK_EMAIL__HOST: mail.postale.io
      AUTHENTIK_EMAIL__PORT: 587
      AUTHENTIK_EMAIL__USERNAME: ${EMAIL__ADDRESS}
      AUTHENTIK_EMAIL__PASSWORD: ${EMAIL__PASSWORD} 
      AUTHENTIK_EMAIL__USE_TLS: true
      AUTHENTIK_EMAIL__USE_SSL: false
      AUTHENTIK_EMAIL__TIMEOUT: 60
      AUTHENTIK_EMAIL__FROM: ${EMAIL__ADDRESS}
    image: ghcr.io/goauthentik/server:2026.2.2
    networks:
      - internal
    restart: unless-stopped
    user: root
    volumes:
    - /var/run/docker.sock:/var/run/docker.sock
    - shared_media:/media
    - worker_certs:/certs
    - shared_data:/data
    - shared_templates:/templates

networks:
  proxy:
    name: traefik_exposed
    external: true
  internal:

volumes:
  database:
    driver: local
  shared_media:
  shared_data:
  shared_templates:
  worker_certs: