From 894ccff668b23b70aa68f6f9535986da182f0b24 Mon Sep 17 00:00:00 2001 From: thhsh Date: Mon, 21 Jul 2025 16:56:06 -0400 Subject: [PATCH] Replace Pocket ID with Authentik --- README.md | 10 ++-- authentik/.env | 22 ++++++++ authentik/README.md | 29 +++++++++++ authentik/docker-compose.yml | 98 +++++++++++++++++++++++++++++++++++ pocket-id.png | Bin 4463 -> 0 bytes pocket-id/.env | 11 ---- pocket-id/README.md | 20 ------- pocket-id/docker-compose.yml | 19 ------- 8 files changed, 154 insertions(+), 55 deletions(-) create mode 100644 authentik/.env create mode 100644 authentik/README.md create mode 100644 authentik/docker-compose.yml delete mode 100644 pocket-id.png delete mode 100644 pocket-id/.env delete mode 100644 pocket-id/README.md delete mode 100644 pocket-id/docker-compose.yml diff --git a/README.md b/README.md index a01bf95..df2bb81 100644 --- a/README.md +++ b/README.md @@ -5,14 +5,14 @@ The configs, tweaks, and pieces that make up the `id.starcat.systems` accounts s [![Forgejo Last Commit (main)](https://img.shields.io/gitea/last-commit/starcat-infra/auth-server/main?gitea_url=https%3A%2F%2Fgit.starcat.systems&style=flat&logo=git&logoColor=fff&logoSize=auto&label=last%20commit%20(main))](https://git.starcat.systems/starcat-infra/auth-server/src/branch/main) ## Contents -- `pockey-id`: - - `docker-compose.yml`: the Docker Compose file that runs Pocket ID - - `.env`: environment variables to configure Pocket ID +- `authentik`: + - `docker-compose.yml`: the Docker Compose file that runs Authentik + - `.env`: environment variables to configure Authentik - `caddy`: - - `Caddyfile`: the Caddy server configuration (reverse proxies Pocket ID) + - `Caddyfile`: the Caddy server configuration (reverse proxies Authentik) ## More Information -For more information on this repo, please see [Pocket ID in the handbook](https://about.starcat.systems/handbook/infrastructure/security/pocket-id/). +For more information on this repo, please see [Authentik in the handbook](https://about.starcat.systems/handbook/infrastructure/security/authentik/). ## Repo Mirrors Repo contents are automatically pushed to the following mirrors: diff --git a/authentik/.env b/authentik/.env new file mode 100644 index 0000000..9953599 --- /dev/null +++ b/authentik/.env @@ -0,0 +1,22 @@ +# Authentik .env app configuration +# Configures the Authentik application +# File location: /srv/authentik/.env +# More information - git repo: https://git.starcat.systems/starcat-infra/auth-server +# More information - handbook: https://about.starcat.systems/handbook/infrastructure/security/authentik/ +# See the documentation for more information: https://docs.goauthentik.io/docs/install-config/configuration/ +PG_PASS=*REDACTED* +AUTHENTIK_SECRET_KEY=*REDACTED* +AUTHENTIK_ERROR_REPORTING__ENABLED=true +# SMTP Host Emails are sent to +AUTHENTIK_EMAIL__HOST=*REDACTED* +AUTHENTIK_EMAIL__PORT=465 +# Optionally authenticate (don't add quotation marks to your password) +AUTHENTIK_EMAIL__USERNAME=accounts-noreply@starcat.systems +AUTHENTIK_EMAIL__PASSWORD=*REDACTED* +# Use StartTLS +AUTHENTIK_EMAIL__USE_TLS=false +# Use SSL +AUTHENTIK_EMAIL__USE_SSL=true +AUTHENTIK_EMAIL__TIMEOUT=10 +# Email address authentik will send from, should have a correct @domain +AUTHENTIK_EMAIL__FROM=accounts-noreply@starcat.systems \ No newline at end of file diff --git a/authentik/README.md b/authentik/README.md new file mode 100644 index 0000000..4192f36 --- /dev/null +++ b/authentik/README.md @@ -0,0 +1,29 @@ +# Authentik README +## what +The Docker Compose and `.env` files that run Authentik + +## where +``` +/srv/authentik/docker-compose.yml +/srv/authentik/.env +``` + +## redacted values +For security, secrets have been redacted from these files. StarCat team members can find these values in [1Password](https://start.1password.com/open/i?a=B5NVCNGFJBCCLCDCN5FKFPGVBI&v=35hhast2kp5lgw3iud374426oa&i=wulgiodikbbu4x5rxvco4zren4&h=starcatsys.1password.com). Soon, these values will be autofilled from Vault when the container starts. + +## making changes +If you make changes to `.env`, just pull the latest image and restart the service: + +``` +docker compose pull +docker compose up -d +``` + +## upgrading +To upgrade Authentik, download the latest `docker-compose.yml` file, (optionally) put our comments at the top of the file, pull the latest images, and restart the service: + +``` +wget -O docker-compose.yml https://goauthentik.io/docker-compose.yml +docker compose pull +docker compose up -d +``` \ No newline at end of file diff --git a/authentik/docker-compose.yml b/authentik/docker-compose.yml new file mode 100644 index 0000000..8502812 --- /dev/null +++ b/authentik/docker-compose.yml @@ -0,0 +1,98 @@ +# Docker Compose file for Authentik +# Location: /srv/authentik/docker-compose.yml +# IMPORTANT: When Authentik upgrades versions, the docker-compose.yml file changes. This file on Git may not be up to date. See the following for details: +# https://git.starcat.systems/starcat-infra/auth-server/src/branch/main/authentik/README.md +# https://docs.goauthentik.io/docs/install-config/upgrade + +--- + +services: + postgresql: + image: docker.io/library/postgres:16-alpine + restart: unless-stopped + healthcheck: + test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"] + start_period: 20s + interval: 30s + retries: 5 + timeout: 5s + volumes: + - database:/var/lib/postgresql/data + environment: + POSTGRES_PASSWORD: ${PG_PASS:?database password required} + POSTGRES_USER: ${PG_USER:-authentik} + POSTGRES_DB: ${PG_DB:-authentik} + env_file: + - .env + redis: + image: docker.io/library/redis:alpine + command: --save 60 1 --loglevel warning + restart: unless-stopped + healthcheck: + test: ["CMD-SHELL", "redis-cli ping | grep PONG"] + start_period: 20s + interval: 30s + retries: 5 + timeout: 3s + volumes: + - redis:/data + server: + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.3} + restart: unless-stopped + command: server + environment: + AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required} + AUTHENTIK_REDIS__HOST: redis + AUTHENTIK_POSTGRESQL__HOST: postgresql + AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik} + AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik} + AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS} + volumes: + - ./media:/media + - ./custom-templates:/templates + env_file: + - .env + ports: + - "${COMPOSE_PORT_HTTP:-9000}:9000" + - "${COMPOSE_PORT_HTTPS:-9443}:9443" + depends_on: + postgresql: + condition: service_healthy + redis: + condition: service_healthy + worker: + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.3} + restart: unless-stopped + command: worker + environment: + AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required} + AUTHENTIK_REDIS__HOST: redis + AUTHENTIK_POSTGRESQL__HOST: postgresql + AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik} + AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik} + AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS} + # `user: root` and the docker socket volume are optional. + # See more for the docker socket integration here: + # https://goauthentik.io/docs/outposts/integrations/docker + # Removing `user: root` also prevents the worker from fixing the permissions + # on the mounted folders, so when removing this make sure the folders have the correct UID/GID + # (1000:1000 by default) + user: root + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - ./media:/media + - ./certs:/certs + - ./custom-templates:/templates + env_file: + - .env + depends_on: + postgresql: + condition: service_healthy + redis: + condition: service_healthy + +volumes: + database: + driver: local + redis: + driver: local diff --git a/pocket-id.png b/pocket-id.png deleted file mode 100644 index 8aa7f00f905fe5b6885b8eb2db4a8fe2a969e32c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4463 zcmZ`+XE|ze=_&zG8Bcp+Lk?Z@+G-f+0^oNG0PJ%Bj-XrEWdOXz0a&#LKrR)4t4}kV z9^8c-6pyvlRl)hiCl_D%8UUsUO;sf$--(T^KqC|5)^23K=lJpV_DonVf9~|6gG^dG z+pP&_40D;_bNh6$)baOHNy%c`>{d^cBy=?gAAVz9)*-(6c`TKFwbPP?)2_-$RMZfm zv@`M(*RDdP5!0gBb{J-8=$Yh;u^f~=KDJmpMlRJ4ZS7PHO}Cv+zQmXWy{tsx&y%4l)!a}{OqUoDs7&6TeYnH(7T0hT)nl7CgDl-_x6@MLrZrx7g}IqKswZTQ0VAc_I&JC z7*LDyj$txp^Bvb`&C_Cj%w;P~FznsZKRw;Imc1ar-CR-+Q-%xZ>ppq+8!JpmIzrr_WGsu|Hl%KcL z(Xdpiaw?CKFSvuT@#t{$ZRQ6q(*P}^=HJ}t?kF#)@vwURX3l$TPM2{+;5PC zWTA}VCy^&jkG9lpI9(QCO``jhyNM2TEG~b04!+)MS&#M$G7H@ytG8es)$_2yTKAhP z{=L`nJwE6qGbvgBjIE-K?Ry^UZroMj7o|qJoaa*`h3yzQhKi0vt{T1be>5fa-4#PZ zLhL8lCMUo9Xb}0623zIX*vxL_*rv1g8X3nbbqWYCtiX+9ZTy;*waFH!sNeE2Gvj>B zRLSURXs`R9pUsPrC60O$b0u+Jd#g37D4`KzaYe=OuEIkz4W4Uqs_ytdto9BLBS%)J zF{~n%I_HPm9g?D=aiP~3ZdCYZcD@vnfpG58k>8QI5(&N`NM2qNeF+^BqVc;-@5Ly*Q~C7Jo^r;#wzf8bxRTGv5Qs9w z-M`7rgtcqK-$_k^!9acF?C@I^NkN5d3c71i`R7+jfu`5aqORW^WQqZI)_v(_u3knk z|GIx6Z(`!%1m2O6o`Dg{d6cDW*8Ow|AJIQNP*wvV>y3XK;!)>bc%1i+1b|mQ4~-r^ z)QZo~*Jyl80eJcOOG-=MS>4@{{C-oY8h~LRXE!(8`*jx%xd0gm{(F;ieX>5DB0L-d z^OjHhZ^?69VuoyNi{JU_{z~Dydl!zviOI>8DW87}#A)5rNx-st((Bi@-{~bFZh2BZ zQ~S;Gy1E7x^f-@_%F2Xf5i7UG5ogF}o|Kftf_%n*G12PRVnfN3vS!GBWqOWx&#{j) zhk>GQXD6rJa6NhZ=#G7erIKP|VuayWU_ied*&B44k@8=-uCA`6^8g!U&ySv+9t-{@ zb79LGo11G3#w$P+iEWu^4QxiA(*jU5)a3W)w%Yl+BNWmjn9{Gt8GLLG*?wgiNH={~ zSCP@LU-fl$=`EW7iRIwnD8l2Xyq?MEm?7vvK< z!^5K5)JA+gn@@*_XFCM>;0X-ZWKbd^A`uk14GpQ!KSM-LP#hf_ySK2guse{a#xmX( zY_(aP_es!j`BU#}ueC7|6_~z-h3+qEYH0ml7ys?_!5q&@cEa^3);Yq*FtqDE3g|d= zkPMHEC<_sZx}!D>z_-H0VWrBRTlOBCb-iJLGEBC#gpN|l%}ta%G6DwDNQ%nK3(3)F z?s%V*=hR*+BR4%7A4QPl=I4JhGR^~pss0e8`$&52lU`Pq`Cq=LQn5J2J+{EpKi?wK zDPlPlxj_#NAta0vKcTET?owm7VxXcMX7c_KHLxSg?OWN^)YCPl>g(^9paaKy8>FC$ zWcbGq9X(OAndGrPF7ZyD;2PO)CR2>Mkt$Vrk9{V(_ZC(VMWaA0Qei2Re43*bj@rs zU$0=H0WGCz)eh_qbSF|aQB^A^Cjo$$78t%xq?2NZjg3{Hgf@*0dJt;ldM}u<@;W=g zTm-}qWul9oiMO**0Sz*O=a8a%Dm?0%^Z*mjM{;s9_a44r2uc ziG`dvHn-9AQGmjEEHf&eyrMYXzUOVO&t&gDt;5B|6#=Z9H0AD*0%S2BpT(U4?{KV) zkBh^_#LysO&Nc)TNkA1>w6KUs!P|~Ve|a}0P@NH=9Hy7 zg&%m}O*T<=!*z)A*jS^G>xD4lA}j1 z94fv1R!+R^xi}L9MPAQPm0!<3vBxwD{yh5KFSfGjzX>s2?wa5OJ!JIR?vi2}49j)L zCtVaeRVjaZ1#)&}%B~2RvMGo{lrksq2?`#r^)nPWpHX3C$MtO7KRTF;*G-cEg#L%M zO-uIe*Yon0`xg2mvd7qqrRaco#Vv&c>-f1CHtCo5Gw-6uQ{#9P?=!poSOb8SJhz}A z{GPh{zDyZ!WSEDC2OTF-%=80d^z$n~P?z)H6Q*D5B=;y`+FeVrM9ll3&}hNfs2GIn zAOK<|+grhfeE1esTTAELQj(HvqPV3LVfaS5BG|6FC=I-k?@TLoW8w=}SDjTlJ*$eM zd{Nk9PYU4sEbF8o#cK0U`2wLryvb`N(dK7ySsAW3IvO{`4rXpjA(6yHg*WP@%EP^v z1?ZTy)zvAXt@mFLwFB17z}eY(dDfDpJ@8+#GAs8ev%bE*<>}+iYSoKn6<1XycIl-K z7alm=J!=@6Yj`%tNp$lg0X(ZO#9DJ-DFrsmN&Y1>zO*p>L;?{o4d_5B6E-i8zy8xf zu)^vo@yi#bt(F~za0U(?lRkD}J;UEHiCL?2RluA{I1cI$j8`UW1%Vkgk%ukgB5;MB z^=ixDy{0C)rr;kkhVH)5L{HK)HkmoOxO81Ve6aN2EGfCIm5J!|h-L&WMRj%3Gz`?w zv|pYpJSIy@IWITOZmz3K9$^)|AuFZ$=lM{D;zrQMGncwX& zu}zc{3x4_ zAKYuR9g)W;mFD{TsQq|OfzJUv-~bhT)^FuRfS~c-qpPEMzwEuee@foJ&o`BJ$(>P< zT!R!uuK7fZJuSJfwMd}HJ7Rgpdrly8LK?yVZ;V86a>^y_ej zd#mO-9D`6};B+|T;0D$(pr9C>4U-?2vA|tE*T{aj^yh@QMM4CUFjkSn5lPi+e}Zsi90>HV}y8Q4b{n7?SZyTgppx zpof+)qTm%8L4sW&iPFV0-WSM}W-)0VW2@9sbYQx#@r~3E@k-GSoPQ zkdXopScUhRN!9*u#9cO!%8fNey48HWc?p_u*NM{im*)^);|2Wd*q8xClZmvThZ<#X zf3s6JGin|Np`ZTxspiqJA_^ch0~Ts2=18HsLyIyoVZ8(e(-Nu{`V-79UhUR9Dh8++ zWBV8QGp6D`U4ZpXO(XMR;5Y15M#hW(HSidTM4AiS`Nst7 z7p?&dh%U0VI2TA4_F>2=80u7ids^B+n$S$|Yy8d)H7b|5j}D4|j7Oo1G1}r7rZs&* znvBMuhRlzrxKiYs--6M9gX7yVcPK7Pr%f6MpUc0j1Y_#5MtmNC#HD2ZDnBF;t=$r) zxM`@Y4R4;uzu({AR8(5>qWYJt;+Y=C`@a9R0Tmkk=VpljBxLDs19Gb)Ad&dHqc}`mnLCyPFEDEwOp(6S8f>Iavb+SCkZu<^NOU2Y(wh|8HbNTdE_tjk&cG`p<+ zk!<9GVT1Zjy38D+r+|ebVK9w)p_`4?E}gZw#QEiP1YCQ?rN