121 lines
4.2 KiB
YAML
121 lines
4.2 KiB
YAML
---
|
|
services:
|
|
geoipupdate:
|
|
image: "maxmindinc/geoipupdate:v7.1.1"
|
|
restart: unless-stopped
|
|
volumes:
|
|
- "geoip:/usr/share/GeoIP"
|
|
environment:
|
|
GEOIPUPDATE_EDITION_IDS: "GeoLite2-City GeoLite2-ASN"
|
|
GEOIPUPDATE_FREQUENCY: "8"
|
|
GEOIPUPDATE_ACCOUNT_ID: "${GEOIPUPDATE_ACCOUNT_ID:?MaxMind GeoIP account ID required}"
|
|
GEOIPUPDATE_LICENSE_KEY_FILE: /run/secrets/geoip_license_key
|
|
secrets:
|
|
- geoip_license_key
|
|
|
|
postgresql: !reset []
|
|
# env_file: !override []
|
|
# environment:
|
|
# POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
|
|
# secrets:
|
|
# - postgres_password
|
|
# networks:
|
|
# - backend
|
|
# ports: !override []
|
|
|
|
redis:
|
|
networks:
|
|
- backend
|
|
|
|
server:
|
|
depends_on:
|
|
postgresql: !reset []
|
|
env_file: !reset []
|
|
environment:
|
|
AUTHENTIK_EMAIL__PASSWORD: file:///run/secrets/authentik_email_password
|
|
AUTHENTIK_POSTGRESQL__HOST: ${AUTHENTIK_POSTGRESQL__HOST:?Authentik PostgreSQL host required}
|
|
AUTHENTIK_POSTGRESQL__PORT: ${AUTHENTIK_POSTGRESQL__PORT:?Authentik PostgreSQL port required}
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/postgres_password
|
|
AUTHENTIK_POSTGRESQL__SSLMODE: ${AUTHENTIK_POSTGRESQL__SSLMODE:-disable}
|
|
AUTHENTIK_POSTGRESQL__SSLROOTCERT: ${AUTHENTIK_POSTGRESQL__SSLROOTCERT:-/etc/ssl/certs/ca-certificates.crt}
|
|
AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
|
|
ports: !reset []
|
|
secrets:
|
|
- authentik_email_password
|
|
- authentik_secret_key
|
|
- postgres_password
|
|
volumes:
|
|
- media:/media
|
|
- ./data/authentik/custom-templates:/templates
|
|
- geoip:/geoip
|
|
networks:
|
|
- backend
|
|
- frontend
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=frontend"
|
|
|
|
- "traefik.http.services.sso-server.loadbalancer.server.port=9443" # set port the container listenes to
|
|
- "traefik.http.services.sso-server.loadbalancer.server.scheme=https"
|
|
|
|
- "traefik.http.routers.sso-server-web.rule=Host(`${PUBLIC_DOMAIN}`)"
|
|
- "traefik.http.routers.sso-server-web.service=sso-server@docker"
|
|
- "traefik.http.routers.sso-server-web.entrypoints=web"
|
|
- "traefik.http.routers.sso-server-web.middlewares=redirect-to-https@file"
|
|
|
|
- "traefik.http.routers.sso-server-websecure.rule=Host(`${PUBLIC_DOMAIN}`)" # change hostname!
|
|
- "traefik.http.routers.sso-server-websecure.service=sso-server@docker"
|
|
- "traefik.http.routers.sso-server-websecure.entrypoints=websecure"
|
|
- "traefik.http.routers.sso-server-websecure.tls=true"
|
|
- "traefik.http.routers.sso-server-websecure.tls.options=modern@file"
|
|
- "traefik.http.routers.sso-server-websecure.tls.certresolver=acmeDns"
|
|
- "traefik.http.routers.sso-server-websecure.tls.domains[0].main=${TLS_DOMAIN}"
|
|
- "traefik.http.routers.sso-server-websecure.middlewares=secHeaders@file, hsts-header@file"
|
|
|
|
|
|
worker:
|
|
depends_on:
|
|
postgresql: !reset []
|
|
env_file: !reset []
|
|
environment:
|
|
AUTHENTIK_EMAIL__PASSWORD: file:///run/secrets/authentik_email_password
|
|
AUTHENTIK_POSTGRESQL__HOST: ${AUTHENTIK_POSTGRESQL__HOST:?Authentik PostgreSQL host required}
|
|
AUTHENTIK_POSTGRESQL__PORT: ${AUTHENTIK_POSTGRESQL__PORT:?Authentik PostgreSQL port required}
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/postgres_password
|
|
AUTHENTIK_POSTGRESQL__SSLMODE: ${AUTHENTIK_POSTGRESQL__SSLMODE:-disable}
|
|
AUTHENTIK_POSTGRESQL__SSLROOTCERT: ${AUTHENTIK_POSTGRESQL__SSLROOTCERT:-/etc/ssl/certs/ca-certificates.crt}
|
|
AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
|
|
secrets:
|
|
- authentik_email_password
|
|
- authentik_secret_key
|
|
- postgres_password
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- media:/media
|
|
- certs:/certs
|
|
- ./data/authentik/custom-templates:/templates
|
|
- geoip:/geoip
|
|
networks:
|
|
- backend
|
|
|
|
secrets:
|
|
authentik_email_password:
|
|
environment: AUTHENTIK_EMAIL__PASSWORD
|
|
authentik_secret_key:
|
|
environment: AUTHENTIK_SECRET_KEY
|
|
geoip_license_key:
|
|
environment: GEOIPUPDATE_LICENSE_KEY
|
|
postgres_password:
|
|
environment: PG_PASS
|
|
|
|
volumes:
|
|
geoip:
|
|
driver: local
|
|
media:
|
|
driver: local
|
|
certs:
|
|
driver: local
|
|
|
|
networks:
|
|
backend:
|
|
frontend:
|