docker-compose.yaml

# Authentik Identity Provider Stack
# Environment variables are loaded from .env file by default
# See README.md for detailed documentation
#
# ARM64 COMPATIBILITY NOTES:
# - All services support ARM64 architecture
# - Using latest tags for better ARM64 support where applicable

version: "3.8"

services:
  authentik-server:
    container_name: "${CONTAINER_NAME_PREFIX}_authentik_server"
    image: "ghcr.io/goauthentik/server:${AUTHENTIK_VERSION:-2025.2}"
    command: server
    user: "${PUID}:${PGID}"
    environment:
      - TZ=${TZ}
      - AUTHENTIK_REDIS__HOST=redis
      - AUTHENTIK_POSTGRESQL__HOST=database
      - AUTHENTIK_POSTGRESQL__PORT=5432
      - AUTHENTIK_POSTGRESQL__USER=${AUTHENTIK_DB_USERNAME}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD}
      - AUTHENTIK_POSTGRESQL__NAME=${AUTHENTIK_DB_DATABASE_NAME}
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
      - AUTHENTIK_ERROR_REPORTING__ENABLED=${AUTHENTIK_ERROR_REPORTING:-false}
      - AUTHENTIK_TENANTS__ENABLED=${AUTHENTIK_TENANTS_ENABLED:-false}
      # Email Configuration
      - AUTHENTIK_EMAIL__HOST=${AUTHENTIK_EMAIL__HOST:-localhost}
      - AUTHENTIK_EMAIL__PORT=${AUTHENTIK_EMAIL__PORT:-25}
      - AUTHENTIK_EMAIL__USERNAME=${AUTHENTIK_EMAIL__USERNAME:-}
      - AUTHENTIK_EMAIL__PASSWORD=${AUTHENTIK_EMAIL__PASSWORD:-}
      - AUTHENTIK_EMAIL__USE_TLS=${AUTHENTIK_EMAIL__USE_TLS:-false}
      - AUTHENTIK_EMAIL__USE_SSL=${AUTHENTIK_EMAIL__USE_SSL:-false}
      - AUTHENTIK_EMAIL__TIMEOUT=${AUTHENTIK_EMAIL__TIMEOUT:-10}
      - AUTHENTIK_EMAIL__FROM=${AUTHENTIK_EMAIL__FROM:-authentik@localhost}
    volumes:
      - "authentik_media_volume:/media"
      - "authentik_templates_volume:/templates"
      - "/etc/localtime:/etc/localtime:ro"
    networks:
      authentik_app:
      authentik_db:
    labels:
      - "traefik.enable=true"
      # Main Interface - Public Domain HTTP
      - "traefik.http.routers.authentik-public-http.rule=Host(`${AUTHENTIK_PUBLIC_DOMAIN}`)"
      - "traefik.http.routers.authentik-public-http.entrypoints=web"
      - "traefik.http.routers.authentik-public-http.service=authentik"
      # Main Interface - Public Domain HTTPS
      - "traefik.http.routers.authentik-public-https.rule=Host(`${AUTHENTIK_PUBLIC_DOMAIN}`)"
      - "traefik.http.routers.authentik-public-https.entrypoints=websecure"
      - "traefik.http.routers.authentik-public-https.service=authentik"
      - "traefik.http.routers.authentik-public-https.tls=true"
      - "traefik.http.routers.authentik-public-https.tls.certresolver=${AUTHENTIK_CERT_RESOLVER:-letsencrypt}"
      # Main Interface - Private Domain HTTP
      - "traefik.http.routers.authentik-private-http.rule=Host(`${AUTHENTIK_PRIVATE_DOMAIN}`)"
      - "traefik.http.routers.authentik-private-http.entrypoints=web"
      - "traefik.http.routers.authentik-private-http.service=authentik"
      # Main Interface - Private Domain HTTPS
      - "traefik.http.routers.authentik-private-https.rule=Host(`${AUTHENTIK_PRIVATE_DOMAIN}`)"
      - "traefik.http.routers.authentik-private-https.entrypoints=websecure"
      - "traefik.http.routers.authentik-private-https.service=authentik"
      - "traefik.http.routers.authentik-private-https.tls=true"
      - "traefik.http.routers.authentik-private-https.tls.certresolver=${AUTHENTIK_CERT_RESOLVER:-letsencrypt}"
      # Service Configuration
      - "traefik.http.services.authentik.loadbalancer.server.port=9000"
    depends_on:
      - redis
      - database
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "ak", "healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    privileged: ${ENABLE_AUTHENTIK_PRIVILEGES:-false}

  authentik-worker:
    container_name: "${CONTAINER_NAME_PREFIX}_authentik_worker"
    image: "ghcr.io/goauthentik/server:${AUTHENTIK_VERSION:-2025.2}"
    command: worker
    user: root  # Required for Docker socket access
    environment:
      - TZ=${TZ}
      - AUTHENTIK_REDIS__HOST=redis
      - AUTHENTIK_POSTGRESQL__HOST=database
      - AUTHENTIK_POSTGRESQL__PORT=5432
      - AUTHENTIK_POSTGRESQL__USER=${AUTHENTIK_DB_USERNAME}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD}
      - AUTHENTIK_POSTGRESQL__NAME=${AUTHENTIK_DB_DATABASE_NAME}
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
      - AUTHENTIK_ERROR_REPORTING__ENABLED=${AUTHENTIK_ERROR_REPORTING:-false}
      - AUTHENTIK_TENANTS__ENABLED=${AUTHENTIK_TENANTS_ENABLED:-false}
      # Email Configuration (required for worker to send verification emails)
      - AUTHENTIK_EMAIL__HOST=${AUTHENTIK_EMAIL__HOST:-localhost}
      - AUTHENTIK_EMAIL__PORT=${AUTHENTIK_EMAIL__PORT:-25}
      - AUTHENTIK_EMAIL__USERNAME=${AUTHENTIK_EMAIL__USERNAME:-}
      - AUTHENTIK_EMAIL__PASSWORD=${AUTHENTIK_EMAIL__PASSWORD:-}
      - AUTHENTIK_EMAIL__USE_TLS=${AUTHENTIK_EMAIL__USE_TLS:-false}
      - AUTHENTIK_EMAIL__USE_SSL=${AUTHENTIK_EMAIL__USE_SSL:-false}
      - AUTHENTIK_EMAIL__TIMEOUT=${AUTHENTIK_EMAIL__TIMEOUT:-10}
      - AUTHENTIK_EMAIL__FROM=${AUTHENTIK_EMAIL__FROM:-authentik@localhost}
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "authentik_media_volume:/media"
      - "authentik_certs_volume:/certs"
      - "authentik_templates_volume:/templates"
      - "/etc/localtime:/etc/localtime:ro"
    networks:
      - authentik_app
      - authentik_db
    depends_on:
      - redis
      - database
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "ak", "healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  redis:
    container_name: "${CONTAINER_NAME_PREFIX}_authentik_redis"
    image: "redis:7-alpine"
    command: ["redis-server", "--save", "60", "1", "--loglevel", "warning"]
    environment:
      - TZ=${TZ}
    volumes:
      - "authentik_redis_volume:/data"
    networks:
      - authentik_db
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    restart: unless-stopped

  database:
    container_name: "${CONTAINER_NAME_PREFIX}_authentik_postgres"
    image: "postgres:16-alpine"
    environment:
      - TZ=${TZ}
      - POSTGRES_PASSWORD=${AUTHENTIK_DB_PASSWORD}
      - POSTGRES_USER=${AUTHENTIK_DB_USERNAME}
      - POSTGRES_DB=${AUTHENTIK_DB_DATABASE_NAME}
      - POSTGRES_INITDB_ARGS=--data-checksums
    networks:
      - authentik_db
    volumes:
      - "authentik_db_volume:/var/lib/postgresql/data"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-file: '5'
        max-size: 10m

  geoipupdate:
    container_name: "${CONTAINER_NAME_PREFIX}_authentik_geoip"
    image: "maxmindinc/geoipupdate:latest"
    environment:
      - TZ=${TZ}
      - GEOIPUPDATE_EDITION_IDS=GeoLite2-City
      - GEOIPUPDATE_FREQUENCY=8
      - GEOIPUPDATE_ACCOUNT_ID=${GEOIP_ACCOUNT_ID:-}
      - GEOIPUPDATE_LICENSE_KEY=${GEOIP_LICENSE_KEY:-}
    volumes:
      - "authentik_geoip_volume:/usr/share/GeoIP"
    networks:
      - authentik_app
    restart: unless-stopped
    deploy:
      replicas: ${ENABLE_GEOIP_UPDATE:-1}

  cloudflared:
    container_name: "${CONTAINER_NAME_PREFIX}_authentik_cloudflared"
    image: "cloudflare/cloudflared:latest"
    entrypoint: ["cloudflared", "--no-autoupdate"]
    command: ["tunnel", "run"]
    user: "${PUID}:${PGID}"
    environment:
      - TUNNEL_TOKEN=${AUTHENTIK_CLOUDFLARE_TUNNEL_TOKEN}
    networks:
      - authentik_app
    restart: unless-stopped
    deploy:
      replicas: ${ENABLE_AUTHENTIK_CLOUDFLARED:-0}
    healthcheck:
      test: ["CMD", "cloudflared", "tunnel", "status"]
      interval: 120s
      timeout: 30s
      retries: 5
      start_period: 60s

networks:
  # App network with internet access for all services
  authentik_app:
    name: "${AUTHENTIK_APP_NETWORK}"
    driver: bridge

  # Database network for database communication
  authentik_db:
    name: "${AUTHENTIK_DB_NETWORK}"
    internal: true
    driver: bridge

volumes:
  # Media volume for uploaded files and custom assets
  authentik_media_volume:
    name: "${CONTAINER_NAME_PREFIX}_authentik_media"
    driver: local
  
  # Templates volume for custom templates
  authentik_templates_volume:
    name: "${CONTAINER_NAME_PREFIX}_authentik_templates"
    driver: local
  
  # Certificates volume for custom certificates
  authentik_certs_volume:
    name: "${CONTAINER_NAME_PREFIX}_authentik_certs"
    driver: local

  
  # Redis volume for cache data
  authentik_redis_volume:
    name: "${CONTAINER_NAME_PREFIX}_authentik_redis"
    driver: local
  
  # Database volume for PostgreSQL data
  authentik_db_volume:
    name: "${CONTAINER_NAME_PREFIX}_authentik_db"
    driver: local
  
  # GeoIP volume for location data
  authentik_geoip_volume:
    name: "${CONTAINER_NAME_PREFIX}_authentik_geoip"
    driver: local