feat: enhance Authentik deployment with age-encrypted secrets; change deployment to komodo

docker-compose.yml

@@ -1,10 +1,10 @@
 services:
   postgresql:
     env_file:
-    - env/common.env
+    - .env
     environment:
       POSTGRES_DB: ${PG_DB:-authentik}
-      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
+      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
       POSTGRES_USER: ${PG_USER:-authentik}
     healthcheck:
       interval: 30s
@@ -16,8 +16,6 @@ services:
       timeout: 5s
     image: docker.io/library/postgres:16-alpine
     restart: unless-stopped
-    secrets:
-    - postgres_password
     volumes:
     - database:/var/lib/postgresql/data
   redis:
@@ -42,24 +40,19 @@ services:
       redis:
         condition: service_healthy
     env_file:
-    - env/common.env
+    - .env
     environment:
-      AUTHENTIK_EMAIL__PASSWORD: file:///run/secrets/authentik_email_password
       AUTHENTIK_POSTGRESQL__HOST: postgresql
       AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/postgres_password
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
       AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
       AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.1}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.6}
     ports:
     - ${COMPOSE_PORT_HTTP:-9000}:9000
     - ${COMPOSE_PORT_HTTPS:-9443}:9443
     restart: unless-stopped
-    secrets:
-    - authentik_email_password
-    - authentik_secret_key
-    - postgres_password
     volumes:
     - ./media:/media
     - ./custom-templates:/templates
@@ -71,36 +64,22 @@ services:
       redis:
         condition: service_healthy
     env_file:
-    - env/common.env
+    - .env
     environment:
-      AUTHENTIK_EMAIL__PASSWORD: file:///run/secrets/authentik_email_password
       AUTHENTIK_POSTGRESQL__HOST: postgresql
       AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/postgres_password
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
       AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
       AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.1}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.6}
     restart: unless-stopped
-    secrets:
-    - authentik_email_password
-    - authentik_secret_key
-    - postgres_password
     user: root
     volumes:
     - /var/run/docker.sock:/var/run/docker.sock
     - ./media:/media
     - ./certs:/certs
     - ./custom-templates:/templates
-secrets:
-  authentik_email_password:
-    environment: AUTHENTIK_EMAIL__PASSWORD
-  authentik_secret_key:
-    environment: AUTHENTIK_SECRET_KEY
-  geoip_license_key:
-    environment: GEOIPUPDATE_LICENSE_KEY
-  postgres_password:
-    environment: PG_PASS
 volumes:
   database:
     driver: local