From 1e8b7cd80612cc8dccadd23e368c80a357bf2891 Mon Sep 17 00:00:00 2001
From: traveler <traveler@wasted-bandwidth.net>
Date: Thu, 30 Apr 2026 10:23:13 -0500
Subject: [PATCH] gremlin: auto-fix swarm/authentik.yaml (11 issues fixed)

  - Added default restart_policy for "redis"
  - Added aarch64 exclusion for "redis"
  - Added arm exclusion for "redis"
  - Added default restart_policy for "authentik"
  - Added aarch64 exclusion for "authentik"
  - Added arm exclusion for "authentik"
  - Added default restart_policy for "worker"
  - Added aarch64 exclusion for "worker"
  - Added arm exclusion for "worker"
  - Added diun.enable: "true" to "redis"
  - Added diun.enable: "true" to "worker"
---
 swarm/authentik.yaml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/swarm/authentik.yaml b/swarm/authentik.yaml
index b66811e..de9bd09 100644
--- a/swarm/authentik.yaml
+++ b/swarm/authentik.yaml
@@ -54,10 +54,18 @@ services:
     networks:
       - authentik
     deploy:
+      restart_policy:
+        condition: any
+        delay: 5s
+        max_attempts: 3
+        window: 120s
       placement:
         constraints:
+          - node.platform.arch != arm
+          - node.platform.arch != aarch64
           - node.hostname == znas
       labels:
+        diun.enable: "true"
         gremlin.uid.exempt: "true"
         gremlin.uid.reason: "Redis manages its own internal users"
         gremlin.caddy.skip: "true"
@@ -87,8 +95,15 @@ services:
       - "9080:9000"
       - "9443:9443"
     deploy:
+      restart_policy:
+        condition: any
+        delay: 5s
+        max_attempts: 3
+        window: 120s
       placement:
         constraints:
+          - node.platform.arch != arm
+          - node.platform.arch != aarch64
           - node.hostname == znas
       labels:
         caddy: auth.netgrimoire.com
@@ -131,10 +146,18 @@ services:
     networks:
       - authentik
     deploy:
+      restart_policy:
+        condition: any
+        delay: 5s
+        max_attempts: 3
+        window: 120s
       placement:
         constraints:
+          - node.platform.arch != arm
+          - node.platform.arch != aarch64
           - node.hostname == znas
       labels:
+        diun.enable: "true"
         gremlin.uid.exempt: "true"
         gremlin.uid.reason: "Authentik worker runs as 1964:1964 via user: directive"
         gremlin.caddy.skip: "true"