Portainer/authentik/docker-compose.yml

services:
  ths-authentik-postgres:
    image: ${AUTHENTIK_POSTGRES_IMAGE}
    container_name: ths-authentik-postgres
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD}
      POSTGRES_USER: ${AUTHENTIK_DB_USER}
      POSTGRES_DB: ${AUTHENTIK_DB_NAME}
    volumes:
      - ${AUTHENTIK_POSTGRES_PATH}:/var/lib/postgresql/data:Z
    networks:
      - ths_authentik_internal

  ths-authentik-redis:
    image: ${AUTHENTIK_REDIS_IMAGE}
    container_name: ths-authentik-redis
    restart: unless-stopped
    command: ["redis-server", "--save", "60", "1", "--loglevel", "warning"]
    volumes:
      - ${AUTHENTIK_REDIS_PATH}:/data:Z
    networks:
      - ths_authentik_internal

  ths-authentik-server:
    image: ${AUTHENTIK_IMAGE}
    container_name: ths-authentik-server
    pull_policy: always
    restart: unless-stopped
    command: ["server"]
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}

      # OJO: forzamos hosts internos para evitar colisiones y depender del .env
      AUTHENTIK_POSTGRESQL__HOST: ths-authentik-postgres
      AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_DB_USER}
      AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_DB_NAME}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}

      AUTHENTIK_REDIS__HOST: ths-authentik-redis

      AUTHENTIK_BOOTSTRAP_EMAIL: ${AUTHENTIK_BOOTSTRAP_EMAIL}
      AUTHENTIK_BOOTSTRAP_PASSWORD: ${AUTHENTIK_BOOTSTRAP_PASSWORD}
      AUTHENTIK_BOOTSTRAP_TOKEN: ${AUTHENTIK_BOOTSTRAP_TOKEN}
      AUTHENTIK_EMAIL__HOST: ${AUTHENTIK_EMAIL__HOST}
      AUTHENTIK_EMAIL__PORT: ${AUTHENTIK_EMAIL__PORT}
      AUTHENTIK_EMAIL__USERNAME: ${AUTHENTIK_EMAIL__USERNAME}
      AUTHENTIK_EMAIL__PASSWORD: ${AUTHENTIK_EMAIL__PASSWORD}
      AUTHENTIK_EMAIL__FROM: ${AUTHENTIK_EMAIL__FROM}
      AUTHENTIK_EMAIL__USE_TLS: ${AUTHENTIK_EMAIL__USE_TLS}
      AUTHENTIK_EMAIL__USE_SSL: ${AUTHENTIK_EMAIL__USE_SSL}

    depends_on:
      - ths-authentik-postgres
      - ths-authentik-redis

    expose:
      - "${AUTHENTIK_HTTP_PORT}"

    networks:
      - ths_authentik_internal
      - mail_internal
      - proxy

    labels:
      traefik.enable: "true"
      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"

      # Service Authentik (panel + endpoints)
      traefik.http.services.ths-authentik.loadbalancer.server.port: "${AUTHENTIK_HTTP_PORT}"

      # Panel Authentik
      traefik.http.routers.ths-authentik.rule: "Host(`${AUTHENTIK_DOMAIN}`)"
      traefik.http.routers.ths-authentik.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
      traefik.http.routers.ths-authentik.tls: "true"
      traefik.http.routers.ths-authentik.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
      traefik.http.routers.ths-authentik.service: "ths-authentik"

      # Middleware forwardAuth (para proteger otros servicios) -> usar ths-authentik@docker en tus stacks THS
      traefik.http.middlewares.ths-authentik.forwardauth.address: "http://ths-authentik-server:${AUTHENTIK_HTTP_PORT}/outpost.goauthentik.io/auth/traefik"
      traefik.http.middlewares.ths-authentik.forwardauth.trustForwardHeader: "true"
      traefik.http.middlewares.ths-authentik.forwardauth.authResponseHeaders: "X-Authentik-Username,X-Authentik-Groups,X-Authentik-Email,X-Authentik-Uid,X-Authentik-Jwt"
      traefik.http.middlewares.ths-authentik.forwardauth.maxResponseBodySize: "1048576"

      # Outpost para subdominios sherlockhomeless.net, además de apex/www
      traefik.http.routers.ths-authentik-outpost.rule: "(HostRegexp(`[a-z0-9-]+\\.sherlockhomeless\\.net`) || Host(`sherlockhomeless.net`) || Host(`www.sherlockhomeless.net`)) && PathPrefix(`/outpost.goauthentik.io/`)"
      traefik.http.routers.ths-authentik-outpost.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
      traefik.http.routers.ths-authentik-outpost.tls: "true"
      traefik.http.routers.ths-authentik-outpost.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
      traefik.http.routers.ths-authentik-outpost.service: "ths-authentik"
      traefik.http.routers.ths-authentik-outpost.priority: "1000"

  ths-authentik-worker:
    image: ${AUTHENTIK_IMAGE}
    container_name: ths-authentik-worker
    restart: unless-stopped
    command: ["worker"]
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}

      # OJO: forzamos hosts internos igual que en server
      AUTHENTIK_POSTGRESQL__HOST: ths-authentik-postgres
      AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_DB_USER}
      AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_DB_NAME}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}

      AUTHENTIK_REDIS__HOST: ths-authentik-redis
      AUTHENTIK_EMAIL__HOST: ${AUTHENTIK_EMAIL__HOST}
      AUTHENTIK_EMAIL__PORT: ${AUTHENTIK_EMAIL__PORT}
      AUTHENTIK_EMAIL__USERNAME: ${AUTHENTIK_EMAIL__USERNAME}
      AUTHENTIK_EMAIL__PASSWORD: ${AUTHENTIK_EMAIL__PASSWORD}
      AUTHENTIK_EMAIL__FROM: ${AUTHENTIK_EMAIL__FROM}
      AUTHENTIK_EMAIL__USE_TLS: ${AUTHENTIK_EMAIL__USE_TLS}
      AUTHENTIK_EMAIL__USE_SSL: ${AUTHENTIK_EMAIL__USE_SSL}

    depends_on:
      - ths-authentik-postgres
      - ths-authentik-redis

    networks:
      - ths_authentik_internal
      - mail_internal

networks:
  mail_internal:
    external: true
  proxy:
    external: true
  ths_authentik_internal:
    driver: bridge