ChristianLempa_Boilerplates/library/compose/authentik/compose.yaml.j2

services:
  {{ service_name }}:
    image: ghcr.io/goauthentik/server:2025.10.1
    {% if not swarm_enabled %}
    restart: {{ restart_policy }}
    container_name: {{ container_name }}
    {% endif %}
    hostname: {{ container_hostname }}
    command: server
    environment:
      - TZ={{ container_timezone }}
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
      - AUTHENTIK_ERROR_REPORTING__ENABLED={{ authentik_error_reporting }}
      - AUTHENTIK_REDIS__HOST={{ service_name }}-redis
      - AUTHENTIK_POSTGRESQL__HOST={{ service_name }}-postgres
      - AUTHENTIK_POSTGRESQL__USER={{ database_user }}
      - AUTHENTIK_POSTGRESQL__NAME={{ database_name }}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${DATABASE_PASSWORD}
      {% if email_enabled %}
      - AUTHENTIK_EMAIL__HOST={{ email_host }}
      - AUTHENTIK_EMAIL__PORT={{ email_port }}
      - AUTHENTIK_EMAIL__USERNAME={{ email_username }}
      - AUTHENTIK_EMAIL__PASSWORD=${EMAIL_PASSWORD}
      - AUTHENTIK_EMAIL__USE_TLS={{ email_use_tls }}
      - AUTHENTIK_EMAIL__USE_SSL={{ email_use_ssl }}
      - AUTHENTIK_EMAIL__FROM={{ email_from }}
      {% endif %}
    {% if network_mode == 'host' %}
    network_mode: host
    {% else %}
    networks:
      {% if traefik_enabled %}
      {{ traefik_network }}:
      {% endif %}
      {% if network_mode == 'macvlan' %}
      {{ network_name }}:
        ipv4_address: {{ network_macvlan_ipv4_address }}
      {% elif network_mode == 'bridge' %}
      {{ network_name }}:
      {% endif %}
    {% endif %}
    {% if not traefik_enabled and network_mode == 'bridge' %}
    ports:
      {% if swarm_enabled %}
      - target: 9000
        published: {{ ports_http }}
        protocol: tcp
        mode: host
      - target: 9443
        published: {{ ports_https }}
        protocol: tcp
        mode: host
      {% else %}
      - "{{ ports_http }}:9000"
      - "{{ ports_https }}:9443"
      {% endif %}
    {% endif %}
    volumes:
      {% if volume_mode == 'mount' %}
      - {{ volume_mount_path }}/media:/media
      - {{ volume_mount_path }}/templates:/templates
      {% elif volume_mode in ['local', 'nfs'] %}
      - {{ service_name }}-media:/media
      - {{ service_name }}-templates:/templates
      {% endif %}
    {% if traefik_enabled and not swarm_enabled %}
    labels:
      - traefik.enable=true
      - traefik.docker.network={{ traefik_network }}
      - traefik.http.services.{{ service_name }}-web.loadBalancer.server.port=9000
      - traefik.http.routers.{{ service_name }}-http.service={{ service_name }}-web
      - traefik.http.routers.{{ service_name }}-http.rule=Host(`{{ traefik_host }}.{{ traefik_domain }}`)
      - traefik.http.routers.{{ service_name }}-http.entrypoints={{ traefik_entrypoint }}
      {% if traefik_tls_enabled %}
      - traefik.http.routers.{{ service_name }}-https.service={{ service_name }}-web
      - traefik.http.routers.{{ service_name }}-https.rule=Host(`{{ traefik_host }}.{{ traefik_domain }}`)
      - traefik.http.routers.{{ service_name }}-https.entrypoints={{ traefik_tls_entrypoint }}
      - traefik.http.routers.{{ service_name }}-https.tls=true
      - traefik.http.routers.{{ service_name }}-https.tls.certresolver={{ traefik_tls_certresolver }}
      {% endif %}
    {% endif %}
    depends_on:
      - {{ service_name }}-postgres
      - {{ service_name }}-redis
    {% if swarm_enabled or resources_enabled %}
    deploy:
      {% if swarm_enabled %}
      mode: {{ swarm_placement_mode }}
      {% if swarm_placement_mode == 'replicated' %}
      replicas: {{ swarm_replicas }}
      {% endif %}
      {% if swarm_placement_host %}
      placement:
        constraints:
          - node.hostname == {{ swarm_placement_host }}
      {% endif %}
      restart_policy:
        condition: on-failure
      {% endif %}
      {% if resources_enabled %}
      resources:
        limits:
          cpus: '{{ resources_cpu_limit }}'
          memory: {{ resources_memory_limit }}
        {% if swarm_enabled %}
        reservations:
          cpus: '{{ resources_cpu_reservation }}'
          memory: {{ resources_memory_reservation }}
        {% endif %}
      {% endif %}
      {% if swarm_enabled and traefik_enabled %}
      labels:
        - traefik.enable=true
        - traefik.docker.network={{ traefik_network }}
        - traefik.http.services.{{ service_name }}-web.loadBalancer.server.port=9000
        - traefik.http.routers.{{ service_name }}-http.service={{ service_name }}-web
        - traefik.http.routers.{{ service_name }}-http.rule=Host(`{{ traefik_host }}.{{ traefik_domain }}`)
        - traefik.http.routers.{{ service_name }}-http.entrypoints={{ traefik_entrypoint }}
        {% if traefik_tls_enabled %}
        - traefik.http.routers.{{ service_name }}-https.service={{ service_name }}-web
        - traefik.http.routers.{{ service_name }}-https.rule=Host(`{{ traefik_host }}.{{ traefik_domain }}`)
        - traefik.http.routers.{{ service_name }}-https.entrypoints={{ traefik_tls_entrypoint }}
        - traefik.http.routers.{{ service_name }}-https.tls=true
        - traefik.http.routers.{{ service_name }}-https.tls.certresolver={{ traefik_tls_certresolver }}
        {% endif %}
      {% endif %}
    {% endif %}

  {{ service_name }}-worker:
    image: ghcr.io/goauthentik/server:2025.10.1
    {% if not swarm_enabled %}
    restart: {{ restart_policy }}
    container_name: {{ service_name }}-worker
    {% endif %}
    command: worker
    environment:
      - TZ={{ container_timezone }}
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
      - AUTHENTIK_ERROR_REPORTING__ENABLED={{ authentik_error_reporting }}
      - AUTHENTIK_REDIS__HOST={{ service_name }}-redis
      - AUTHENTIK_POSTGRESQL__HOST={{ service_name }}-postgres
      - AUTHENTIK_POSTGRESQL__USER={{ database_user }}
      - AUTHENTIK_POSTGRESQL__NAME={{ database_name }}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${DATABASE_PASSWORD}
      {% if email_enabled %}
      - AUTHENTIK_EMAIL__HOST={{ email_host }}
      - AUTHENTIK_EMAIL__PORT={{ email_port }}
      - AUTHENTIK_EMAIL__USERNAME={{ email_username }}
      - AUTHENTIK_EMAIL__PASSWORD=${EMAIL_PASSWORD}
      - AUTHENTIK_EMAIL__USE_TLS={{ email_use_tls }}
      - AUTHENTIK_EMAIL__USE_SSL={{ email_use_ssl }}
      - AUTHENTIK_EMAIL__FROM={{ email_from }}
      {% endif %}
    user: root
    {% if network_mode == 'host' %}
    network_mode: host
    {% else %}
    networks:
      {% if traefik_enabled %}
      {{ traefik_network }}:
      {% endif %}
      {% if network_mode == 'macvlan' %}
      {{ network_name }}:
        ipv4_address: {{ network_macvlan_ipv4_address }}
      {% elif network_mode == 'bridge' %}
      {{ network_name }}:
      {% endif %}
    {% endif %}
    volumes:
      - /run/docker.sock:/run/docker.sock
      {% if volume_mode == 'mount' %}
      - {{ volume_mount_path }}/media:/media
      - {{ volume_mount_path }}/certs:/certs
      - {{ volume_mount_path }}/templates:/templates
      {% elif volume_mode in ['local', 'nfs'] %}
      - {{ service_name }}-media:/media
      - {{ service_name }}-certs:/certs
      - {{ service_name }}-templates:/templates
      {% endif %}
    depends_on:
      - {{ service_name }}-postgres
      - {{ service_name }}-redis

  {{ service_name }}-redis:
    image: docker.io/library/redis:8.2.3
    {% if not swarm_enabled %}
    restart: {{ restart_policy }}
    container_name: {{ service_name }}-redis
    {% endif %}
    command: --save 60 1 --loglevel warning
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    {% if network_mode == 'host' %}
    network_mode: host
    {% else %}
    networks:
      {% if traefik_enabled %}
      {{ traefik_network }}:
      {% endif %}
      {% if network_mode == 'macvlan' %}
      {{ network_name }}:
        ipv4_address: {{ network_macvlan_ipv4_address }}
      {% elif network_mode == 'bridge' %}
      {{ network_name }}:
      {% endif %}
    {% endif %}
    volumes:
      {% if volume_mode == 'mount' %}
      - {{ volume_mount_path }}/redis:/data
      {% elif volume_mode in ['local', 'nfs'] %}
      - {{ service_name }}-redis:/data
      {% endif %}

  {% if not database_external %}
  {{ service_name }}-postgres:
    image: docker.io/library/postgres:17.6
    {% if not swarm_enabled %}
    restart: {{ restart_policy }}
    container_name: {{ service_name }}-db
    {% endif %}
    environment:
      - TZ={{ container_timezone }}
      - POSTGRES_USER={{ database_user }}
      - POSTGRES_PASSWORD=${DATABASE_PASSWORD}
      - POSTGRES_DB={{ database_name }}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U {{ database_user }}"]
      start_period: 30s
      interval: 10s
      timeout: 10s
      retries: 5
    {% if network_mode == 'host' %}
    network_mode: host
    {% else %}
    networks:
      {% if traefik_enabled %}
      {{ traefik_network }}:
      {% endif %}
      {% if network_mode == 'macvlan' %}
      {{ network_name }}:
        ipv4_address: {{ network_macvlan_ipv4_address }}
      {% elif network_mode == 'bridge' %}
      {{ network_name }}:
      {% endif %}
    {% endif %}
    volumes:
      {% if volume_mode == 'mount' %}
      - {{ volume_mount_path }}/postgres:/var/lib/postgresql/data
      {% elif volume_mode in ['local', 'nfs'] %}
      - {{ service_name }}-postgres:/var/lib/postgresql/data
      {% endif %}
  {% endif %}

{% if volume_mode == 'local' %}
volumes:
  {% if not database_external %}
  {{ service_name }}-postgres:
    driver: local
  {% endif %}
  {{ service_name }}-redis:
    driver: local
{% elif volume_mode == 'nfs' %}
volumes:
  {{ service_name }}-postgres:
    driver: local
    driver_opts:
      type: nfs
      o: addr={{ volume_nfs_server }},{{ volume_nfs_options }}
      device: ":{{ volume_nfs_path }}/postgres"
  {{ service_name }}-redis:
    driver: local
    driver_opts:
      type: nfs
      o: addr={{ volume_nfs_server }},{{ volume_nfs_options }}
      device: ":{{ volume_nfs_path }}/redis"
{% endif %}

{% if network_mode != 'host' %}
networks:
  {{ network_name }}:
    {% if network_external %}
    external: true
    {% else %}
    {% if network_mode == 'macvlan' %}
    driver: macvlan
    driver_opts:
      parent: {{ network_macvlan_parent_interface }}
    ipam:
      config:
        - subnet: {{ network_macvlan_subnet }}
          gateway: {{ network_macvlan_gateway }}
    name: {{ network_name }}
    {% elif swarm_enabled %}
    driver: overlay
    attachable: true
    {% else %}
    driver: bridge
    {% endif %}
    {% endif %}
  {% if traefik_enabled %}
  {{ traefik_network }}:
    external: true
  {% endif %}
{% endif %}