From 7ccff906fd8cb84164728152de72b0c11b08b93c Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Sat, 25 Jul 2026 22:19:24 -0700
Subject: [PATCH] feat(auth): migrate to folder-based stack layout

---
 auth/auth.yaml | 123 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 123 insertions(+)
 create mode 100644 auth/auth.yaml

diff --git a/auth/auth.yaml b/auth/auth.yaml
new file mode 100644
index 0000000..52fdbbd
--- /dev/null
+++ b/auth/auth.yaml
@@ -0,0 +1,123 @@
+services:
+  authentik-server:
+    image: ghcr.io/goauthentik/server:2026.5
+    command: server
+    hostname: authentik-server
+    stop_grace_period: 30s
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__USER: PGadmin
+      AUTHENTIK_POSTGRESQL__NAME: authentik
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTH_PG_PASSWORD}
+      AUTHENTIK_POSTGRESQL__CONN_MAX_AGE: 0
+      AUTHENTIK_POSTGRESQL__DEFAULT_SCHEMA: public
+      AUTHENTIK_SECRET_KEY: ${AUTH_SECRET_KEY}
+      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
+      AUTHENTIK_DISABLE_UPDATE_CHECK: "false"
+      AUTHENTIK_LOG_LEVEL: "info"
+    volumes:
+      - /volume1/docker/authentik/data:/data
+      - /volume1/docker/authentik/media:/media
+      - /volume1/docker/authentik/templates:/templates
+      - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      - authentik_backend
+      - traefik_backend
+    healthcheck:
+      test: ["CMD-SHELL", "ak healthcheck"]
+      start_period: 90s
+      interval: 30s
+      timeout: 10s
+    deploy:
+      replicas: 1
+      placement:
+        max_replicas_per_node: 1
+      update_config:
+        parallelism: 1
+        delay: 30s
+        failure_action: rollback
+      resources:
+        limits:
+          memory: 1G
+        reservations:
+          memory: 512M
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.authentik.rule=Host(`auth.${DOMAIN}`)
+        - traefik.http.routers.authentik.tls=true
+        - traefik.http.routers.authentik.tls.certresolver=letsencrypt
+        - traefik.http.routers.authentik.entrypoints=websecure
+        - traefik.http.services.authentik.loadbalancer.server.port=9443
+        - traefik.http.services.authentik.loadbalancer.server.scheme=https
+        - traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
+        - traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version
+        - traefik.http.services.authentik.loadBalancer.sticky.cookie=true
+        - traefik.http.services.authentik.loadBalancer.sticky.cookie.name=authentik-server-sticky-session
+        - traefik.swarm.network=traefik_backend
+        - traefik.http.routers.authentik.middlewares=crowdsec@file
+        - traefik.http.routers.authentik-forward.rule=Host(`auth.${DOMAIN}`) && PathPrefix(`/outpost.goauthentik.io/`)
+        - traefik.http.routers.authentik-forward.entrypoints=websecure
+        - traefik.http.routers.authentik-forward.tls=true
+        - traefik.http.routers.authentik-forward.tls.certresolver=letsencrypt
+        - traefik.http.routers.authentik-forward.service=authentik
+        - traefik.http.middlewares.authentik.forwardauth.address=https://auth.${DOMAIN}/outpost.goauthentik.io/auth/traefik
+
+  authentik-worker:
+    image: ghcr.io/goauthentik/server:2026.5
+    command: worker
+    hostname: authentik-worker
+    stop_grace_period: 30s
+    user: root
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__USER: PGadmin
+      AUTHENTIK_POSTGRESQL__NAME: authentik
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTH_PG_PASSWORD}
+      AUTHENTIK_POSTGRESQL__CONN_MAX_AGE: 0
+      AUTHENTIK_POSTGRESQL__DEFAULT_SCHEMA: public
+      AUTHENTIK_SECRET_KEY: ${AUTH_SECRET_KEY}
+      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
+      AUTHENTIK_DISABLE_UPDATE_CHECK: "false"
+      AUTHENTIK_LOG_LEVEL: "info"
+    volumes:
+      - /volume1/docker/authentik/data:/data
+      - /volume1/docker/authentik/media:/media
+      - /volume1/docker/authentik/templates:/templates
+      - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      - authentik_backend
+      - traefik_backend
+    healthcheck:
+      test: ["CMD-SHELL", "ak healthcheck"]
+      start_period: 120s
+      interval: 60s
+      timeout: 15s
+    deploy:
+      replicas: 1
+      placement:
+        max_replicas_per_node: 1
+      restart_policy:
+        condition: on-failure
+        delay: 15s
+        window: 120s
+      update_config:
+        parallelism: 1
+        delay: 30s
+        failure_action: rollback
+      resources:
+        limits:
+          memory: 2G
+        reservations:
+          memory: 512M
+
+networks:
+  authentik_backend:
+    driver: overlay
+    driver_opts:
+      com.docker.network.driver.mtu: "9000"
+    attachable: true
+    name: authentik_backend
+  postgresql_db-backend:
+    external: true
+  traefik_backend:
+    external: true