services:
  postgresql:
    environment:
      POSTGRES_DB: authentik
      POSTGRES_PASSWORD: "{{ authentik.db_password }}"
      POSTGRES_USER: authentik
    healthcheck:
      interval: 30s
      retries: 5
      start_period: 20s
      test:
      - CMD-SHELL
      - pg_isready -d authentik -U authentik
      timeout: 5s
    image: docker.io/library/postgres:16-alpine
    networks:
      - internal
    restart: unless-stopped
    volumes:
      - ./data/db:/var/lib/postgresql/data

  authentik-proxy:
    # Server includes embeded proxy outpost
    command: server
    depends_on:
      postgresql:
        condition: service_healthy
    env_file: ".env"
    image: ghcr.io/goauthentik/server:{{ authentik.version }}
    networks:
      - proxy
      - internal
    restart: unless-stopped
    volumes:
      - ./data/authentik_media:/media
      - ./data/authentik_data:/data
      - ./data/authentik_templates:/templates
    labels:
      traefik.enable: true
      traefik.http.routers.authentik.rule: "Host(`{{ authentik.url }}`)"
      traefik.http.routers.authentik.tls: true
      traefik.http.routers.authentik.tls.certresolver: hetzner
      traefik.http.routers.authentik.priority: 100000001
      traefik.http.routers.authentik.service: authentik
      traefik.http.services.authentik.loadbalancer.server.port: 9000

      # https://goneuland.de/authentik-in-kombination-mit-traefik/#2_Authentik_im_Stack_vorbereiten
      traefik.http.routers.authentik-outpost.rule: "HostRegexp(`{subdomain:[a-zA-Z0-9-]+}.{{ authentik.url.split('.', 1)[1] }}`) && PathPrefix(`/outpost.goauthentik.io/`)"
      traefik.http.routers.authentik-outpost.tls: true
      traefik.http.routers.authentik-outpost.priority: 100000000
      traefik.http.routers.authentik-outpost.service: authentik-outpost
      traefik.http.services.authentik-outpost.loadbalancer.server.port: 9000

  authentik-worker:
    command: worker
    depends_on:
      postgresql:
        condition: service_healthy
    env_file: ".env"
    image: ghcr.io/goauthentik/server:{{ authentik.version }}
    networks:
      - internal
    restart: unless-stopped
    user: root
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./data/authentik_media:/media
      - ./data/authentik_data:/data
      - ./data/authentik_templates:/templates
      - ./data/authentik_certs:/certs

{% if authentik.radius.enabled %}
  radius_outpost:
    image: ghcr.io/goauthentik/radius:{{ authentik.version }}
    networks:
      - internal
    ports:
      - 1812:1812/udp
    env_file: ".env"
{% endif %}

networks:
  proxy:
    name: traefik_exposed
    external: true
  internal: {}