services:
  postgresql:
    image: docker.io/library/postgres:16-alpine
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d ${POSTGRES_DB} -U ${POSTGRES_USER}"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    volumes:
      - /DockerVol/Authentik/Postgres:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: F@lcon13
      POSTGRES_USER: authentik
      POSTGRES_DB: authentik
      TZ: America/Chicago
    networks:
      - authentik
    deploy:
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 3
        window: 120s
      placement:
        constraints:
          - node.platform.arch != arm
          - node.platform.arch != aarch64
          - node.hostname == znas
      labels:
        diun.enable: "true"
        gremlin.version: "2026-04-1"
        gremlin.uid.exempt: "true"
        gremlin.uid.reason: "Postgres manages its own internal users"
        gremlin.caddy.skip: "true"
        gremlin.homepage.skip: "true"
        gremlin.monitor.skip: "true"
        gremlin.network.skip: "true"

  redis:
    image: docker.io/library/redis:alpine
    user: "1964:1964"
    command: --save 60 1 --loglevel warning
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    environment:
      TZ: America/Chicago
    volumes:
      - /DockerVol/Authentik/redis:/data
    networks:
      - authentik
    deploy:
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 3
        window: 120s
      placement:
        constraints:
          - node.platform.arch != arm
          - node.platform.arch != aarch64
          - node.hostname == znas
      labels:
        diun.enable: "true"
        gremlin.uid.exempt: "true"
        gremlin.uid.reason: "Redis manages its own internal users"
        gremlin.caddy.skip: "true"
        gremlin.homepage.skip: "true"
        gremlin.monitor.skip: "true"
        gremlin.network.skip: "true"

  authentik:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.2}
    user: "1964:1964"
    command: server
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: F@lcon13
      AUTHENTIK_SECRET_KEY: g8JIvopgkcpIeRUKgfT5KwHFUwGNBFobwhHMHx08wPTJTtAlmqllAwmr6u4jk+ng8O1gbV/gwZnYylMn
      TZ: America/Chicago
    volumes:
      - /DockerVol/Authentik/media:/media
      - /DockerVol/Authentik/custom-templates:/templates
    networks:
      - netgrimoire
      - authentik
    ports:
      - "9080:9000"
      - "9443:9443"
    deploy:
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 3
        window: 120s
      placement:
        constraints:
          - node.platform.arch != arm
          - node.platform.arch != aarch64
          - node.hostname == znas
      labels:
        caddy: auth.netgrimoire.com
        caddy.reverse_proxy: authentik:9000
        caddy.import_1: crowdsec
        caddy.import_2: authentik

        homepage.group: Management
        homepage.name: Authentik
        homepage.icon: authentik.png
        homepage.href: https://auth.netgrimoire.com
        homepage.description: Account Manager
        diun.enable: "true"

        monitor.name: Authentik
        monitor.url: https://auth.netgrimoire.com

     
        gremlin.uid.exempt: "true"
        gremlin.uid.reason: "Authentik server runs as 1964:1964 via user: directive"
        gremlin.context: "docker.sock on worker is required for Authentik outpost management"

  worker:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.2}
    user: "1964:1964"
    command: worker
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: F@lcon13
      AUTHENTIK_SECRET_KEY: g8JIvopgkcpIeRUKgfT5KwHFUwGNBFobwhHMHx08wPTJTtAlmqllAwmr6u4jk+ng8O1gbV/gwZnYylMn
      TZ: America/Chicago
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /DockerVol/Authentik/media:/media
      - /DockerVol/Authentik/certs:/certs
      - /DockerVol/Authentik/custom-templates:/templates
    networks:
      - authentik
    deploy:
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 3
        window: 120s
      placement:
        constraints:
          - node.platform.arch != arm
          - node.platform.arch != aarch64
          - node.hostname == znas
      labels:
        diun.enable: "true"
        gremlin.uid.exempt: "true"
        gremlin.uid.reason: "Authentik worker runs as 1964:1964 via user: directive"
        gremlin.caddy.skip: "true"
        gremlin.homepage.skip: "true"
        gremlin.monitor.skip: "true"
        gremlin.network.skip: "true"
        gremlin.context: "docker.sock mount is required for Authentik outpost management"

networks:
  netgrimoire:
    external: true
  authentik:
    external: true