docker-compose.yml

# Installation: https://hub.docker.com/r/beryju/authentik

services:
  server:
    image: beryju/authentik:2024.12
    container_name: authentik
    restart: unless-stopped
    command: server
    user: root
    environment:
      - AUTHENTIK_REDIS__HOST=${AUTHENTIK_REDIS__HOST}
      - AUTHENTIK_POSTGRESQL__HOST=${AUTHENTIK_POSTGRESQL__HOST}
      - AUTHENTIK_POSTGRESQL__USER=${AUTHENTIK_POSTGRESQL__USER}
      - AUTHENTIK_POSTGRESQL__NAME=${AUTHENTIK_POSTGRESQL__NAME}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_POSTGRESQL__PASSWORD}
      - AUTHENTIK_ERROR_REPORTING__ENABLED=${AUTHENTIK_ERROR_REPORTING__ENABLED}
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
    volumes:
      - /opt/appdata/authentik/media:/media
      - /opt/appdata/authentik/custom-templates:/templates
    ports:
      - 9815:9000
      - 9816:9443
    depends_on:
      - postgresql-authentik
      - redis-authentik
    networks:
      - proxy

  worker:
    image: beryju/authentik:2024.12
    container_name: authentik_worker
    restart: unless-stopped
    command: worker
    environment:
      - AUTHENTIK_REDIS__HOST=${AUTHENTIK_REDIS__HOST}
      - AUTHENTIK_POSTGRESQL__HOST=${AUTHENTIK_POSTGRESQL__HOST}
      - AUTHENTIK_POSTGRESQL__USER=${AUTHENTIK_POSTGRESQL__USER}
      - AUTHENTIK_POSTGRESQL__NAME=${AUTHENTIK_POSTGRESQL__NAME}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_POSTGRESQL__PASSWORD}
      - AUTHENTIK_ERROR_REPORTING__ENABLED=${AUTHENTIK_ERROR_REPORTING__ENABLED}
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
    # `user: root` and the docker socket volume are optional.
    # See more for the docker socket integration here:
    # https://goauthentik.io/docs/outposts/integrations/docker
    # Removing `user: root` also prevents the worker from fixing the permissions
    # on the mounted folders, so when removing this make sure the folders have the correct UID/GID
    # (1000:1000 by default)
    user: root
    volumes:
      - /opt/appdata/authentik/media:/media
      - /opt/appdata/authentik/certs:/certs
      - /var/run/docker.sock:/var/run/docker.sock
      - /opt/appdata/authentik/custom-templates:/templates
    depends_on:
      - postgresql-authentik
      - redis-authentik
    networks:
      - proxy

  postgresql-authentik:
    image: postgres:17-alpine3.19
    container_name: postgresql-authentik
    restart: unless-stopped
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}']
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    environment:
      - POSTGRES_USER=${AUTHENTIK_POSTGRESQL__USER}
      - POSTGRES_DB=${AUTHENTIK_POSTGRESQL__NAME}
      - POSTGRES_PASSWORD=${AUTHENTIK_POSTGRESQL__PASSWORD:?database password required}
    volumes:
      - authentik-postgresql-volume:/var/lib/postgresql/data
    ports:
      - 5432:8080
    networks:
      - proxy

  redis-authentik:
    image: redis:alpine3.19
    container_name: redis-authentik
    restart: unless-stopped
    healthcheck:
      test: ['CMD-SHELL', 'redis-cli ping | grep PONG']
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    volumes:
      - authentik-redis-volume:/data
    ports:
      - 6379:6379
    networks:
      - proxy

volumes:
  authentik-postgresql-volume: {}
  authentik-redis-volume: {}

networks:
  proxy:
    driver: bridge
    external: true