feat: enhance Authentik deployment with age-encrypted secrets; change deployment to komodo

docker-compose.override.yml

@@ -1,8 +1,7 @@
 ---
-
 services:
   geoipupdate:
-    image: "maxmindinc/geoipupdate:${GEOIPUPDATE_TAG:?GEOIPUPDATE_TAG is not configured}"
+    image: "maxmindinc/geoipupdate:v7.1.1"
     restart: unless-stopped
     volumes:
       - "geoip:/usr/share/GeoIP"
@@ -14,29 +13,47 @@ services:
     secrets:
       - geoip_license_key
 
-  postgresql:
-    image: docker.io/library/postgres:${POSTGRES_TAG:?POSTGRES_TAG is not configured}
-    networks:
-      - backend
+  postgresql: !reset []
+    # env_file: !override []
+    # environment:
+    #   POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
+    # secrets:
+    #   - postgres_password
+    # networks:
+    #   - backend
+    # ports: !override []
 
   redis:
-    image: docker.io/library/redis:${REDIS_TAG:?REDIS_TAG is not configured}
     networks:
       - backend
 
   server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
-    ports: []
+    depends_on:
+      postgresql: !reset []
+    env_file: !reset []
+    environment:
+      AUTHENTIK_EMAIL__PASSWORD: file:///run/secrets/authentik_email_password
+      AUTHENTIK_POSTGRESQL__HOST: ${AUTHENTIK_POSTGRESQL__HOST:?Authentik PostgreSQL host required}
+      AUTHENTIK_POSTGRESQL__PORT: ${AUTHENTIK_POSTGRESQL__PORT:?Authentik PostgreSQL port required}
+      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/postgres_password
+      AUTHENTIK_POSTGRESQL__SSLMODE: ${AUTHENTIK_POSTGRESQL__SSLMODE:-disable}
+      AUTHENTIK_POSTGRESQL__SSLROOTCERT: ${AUTHENTIK_POSTGRESQL__SSLROOTCERT:-/etc/ssl/certs/ca-certificates.crt}
+      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
+    ports: !reset []
+    secrets:
+      - authentik_email_password
+      - authentik_secret_key
+      - postgres_password
     volumes:
       - media:/media
       - ./data/authentik/custom-templates:/templates
       - geoip:/geoip
     networks:
       - backend
-      - dokploy-network
+      - frontend
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=dokploy-network"
+      - "traefik.docker.network=frontend"
 
       - "traefik.http.services.sso-server.loadbalancer.server.port=9443" # set port the container listenes to
       - "traefik.http.services.sso-server.loadbalancer.server.scheme=https"
@@ -57,7 +74,19 @@ services:
 
 
   worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:?AUTHENTIK_TAG is not configured}
+    env_file: !reset []
+    environment:
+      AUTHENTIK_EMAIL__PASSWORD: file:///run/secrets/authentik_email_password
+      AUTHENTIK_POSTGRESQL__HOST: ${AUTHENTIK_POSTGRESQL__HOST:?Authentik PostgreSQL host required}
+      AUTHENTIK_POSTGRESQL__PORT: ${AUTHENTIK_POSTGRESQL__PORT:?Authentik PostgreSQL port required}
+      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/postgres_password
+      AUTHENTIK_POSTGRESQL__SSLMODE: ${AUTHENTIK_POSTGRESQL__SSLMODE:-disable}
+      AUTHENTIK_POSTGRESQL__SSLROOTCERT: ${AUTHENTIK_POSTGRESQL__SSLROOTCERT:-/etc/ssl/certs/ca-certificates.crt}
+      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
+    secrets:
+      - authentik_email_password
+      - authentik_secret_key
+      - postgres_password
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - media:/media
@@ -67,6 +96,16 @@ services:
     networks:
       - backend
 
+secrets:
+  authentik_email_password:
+    environment: AUTHENTIK_EMAIL__PASSWORD
+  authentik_secret_key:
+    environment: AUTHENTIK_SECRET_KEY
+  geoip_license_key:
+    environment: GEOIPUPDATE_LICENSE_KEY
+  postgres_password:
+    environment: PG_PASS
+
 volumes:
   geoip:
     driver: local
@@ -77,5 +116,5 @@ volumes:
 
 networks:
   backend:
-  dokploy-network:
+  frontend:
     external: true