Add comprehensive authentik documentation and improve role configuration
- Add authentik-deployment-guide.md: Complete step-by-step deployment guide - Add architecture-decisions.md: Document native DB vs containerized rationale - Add authentication-architecture.md: SSO strategy and integration patterns - Update deployment-guide.md: Integrate authentik deployment procedures - Update security-hardening.md: Add multi-layer security documentation - Update service-integration-guide.md: Add authentik integration examples - Update README.md: Professional project overview with architecture benefits - Update authentik role: Fix HTTP binding, add security configs, improve templates - Remove unused authentik task files: containers.yml, networking.yml Key improvements: * Document security benefits of native databases over containers * Document Unix socket IPC architecture advantages * Provide comprehensive troubleshooting and deployment procedures * Add forward auth integration patterns for services * Fix authentik HTTP binding from 127.0.0.1 to 0.0.0.0 * Add shared memory and IPC security configurations
This commit is contained in:
@@ -1,69 +0,0 @@
|
||||
---
|
||||
# Authentik Container Deployment - Podman Quadlets
|
||||
|
||||
- name: Deploy authentik environment file
|
||||
template:
|
||||
src: authentik.env.j2
|
||||
dest: "{{ authentik_home }}/.config/containers/authentik.env"
|
||||
owner: "{{ authentik_user }}"
|
||||
group: "{{ authentik_group }}"
|
||||
mode: '0600'
|
||||
notify: restart authentik pod
|
||||
|
||||
- name: Deploy authentik pod quadlet
|
||||
template:
|
||||
src: authentik.pod.j2
|
||||
dest: "{{ authentik_home }}/.config/containers/systemd/{{ authentik_pod_name }}.pod"
|
||||
owner: "{{ authentik_user }}"
|
||||
group: "{{ authentik_group }}"
|
||||
mode: '0644'
|
||||
notify:
|
||||
- reload user systemd for authentik
|
||||
- restart authentik pod
|
||||
|
||||
- name: Deploy authentik server container quadlet
|
||||
template:
|
||||
src: authentik-server.container.j2
|
||||
dest: "{{ authentik_home }}/.config/containers/systemd/authentik-server.container"
|
||||
owner: "{{ authentik_user }}"
|
||||
group: "{{ authentik_group }}"
|
||||
mode: '0644'
|
||||
notify:
|
||||
- reload user systemd for authentik
|
||||
- restart authentik pod
|
||||
|
||||
- name: Deploy authentik worker container quadlet
|
||||
template:
|
||||
src: authentik-worker.container.j2
|
||||
dest: "{{ authentik_home }}/.config/containers/systemd/authentik-worker.container"
|
||||
owner: "{{ authentik_user }}"
|
||||
group: "{{ authentik_group }}"
|
||||
mode: '0644'
|
||||
notify:
|
||||
- reload user systemd for authentik
|
||||
- restart authentik pod
|
||||
|
||||
- name: Reload user systemd to recognize quadlets
|
||||
systemd:
|
||||
daemon_reload: yes
|
||||
scope: user
|
||||
become: yes
|
||||
become_user: "{{ authentik_user }}"
|
||||
|
||||
- name: Enable and start authentik pod
|
||||
systemd:
|
||||
name: "{{ authentik_pod_name }}-pod"
|
||||
enabled: "{{ authentik_service_enabled }}"
|
||||
state: "{{ authentik_service_state }}"
|
||||
scope: user
|
||||
become: yes
|
||||
become_user: "{{ authentik_user }}"
|
||||
|
||||
- name: Wait for Authentik to be ready
|
||||
uri:
|
||||
url: "http://127.0.0.1:{{ authentik_http_port }}/if/flow/initial-setup/"
|
||||
method: GET
|
||||
status_code: [200, 302]
|
||||
retries: 30
|
||||
delay: 2
|
||||
when: authentik_service_state == "started"
|
||||
@@ -2,55 +2,9 @@
|
||||
# Authentik Authentication Role - Main Tasks
|
||||
# Self-contained deployment with Podman and Unix sockets
|
||||
|
||||
- name: Create authentik group
|
||||
group:
|
||||
name: "{{ authentik_group }}"
|
||||
system: true
|
||||
|
||||
- name: Create authentik system user
|
||||
user:
|
||||
name: "{{ authentik_user }}"
|
||||
system: true
|
||||
shell: /bin/bash
|
||||
home: "{{ authentik_home }}"
|
||||
create_home: true
|
||||
group: "{{ authentik_group }}"
|
||||
|
||||
- name: Create authentik directories
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: "{{ authentik_user }}"
|
||||
group: "{{ authentik_group }}"
|
||||
mode: '0755'
|
||||
loop:
|
||||
- "{{ authentik_home }}"
|
||||
- "{{ authentik_data_dir }}"
|
||||
- "{{ authentik_media_dir }}"
|
||||
- "{{ authentik_user_quadlet_dir }}"
|
||||
- "{{ authentik_log_dir }}"
|
||||
|
||||
|
||||
- name: Enable lingering for authentik user (services persist without login)
|
||||
command: loginctl enable-linger {{ authentik_user }}
|
||||
register: linger_result
|
||||
changed_when: linger_result.rc == 0
|
||||
|
||||
|
||||
|
||||
- name: Get authentik user UID and GID for container configuration
|
||||
shell: |
|
||||
echo "uid=$(id -u {{ authentik_user }})"
|
||||
echo "gid=$(id -g {{ authentik_user }})"
|
||||
register: authentik_user_info
|
||||
changed_when: false
|
||||
tags: [setup]
|
||||
|
||||
- name: Set authentik UID/GID facts for container templates
|
||||
set_fact:
|
||||
authentik_uid: "{{ authentik_user_info.stdout_lines[0] | regex_replace('uid=', '') }}"
|
||||
authentik_gid: "{{ authentik_user_info.stdout_lines[1] | regex_replace('gid=', '') }}"
|
||||
tags: [setup]
|
||||
- name: Setup authentik user and container namespaces
|
||||
include_tasks: user.yml
|
||||
tags: [user, setup]
|
||||
|
||||
- name: Setup database access and permissions
|
||||
include_tasks: database.yml
|
||||
@@ -60,6 +14,26 @@
|
||||
include_tasks: cache.yml
|
||||
tags: [cache, setup]
|
||||
|
||||
- name: Pull authentik container image
|
||||
containers.podman.podman_image:
|
||||
name: "{{ authentik_image }}:{{ authentik_version }}"
|
||||
state: present
|
||||
become: true
|
||||
become_user: "{{ authentik_user }}"
|
||||
tags: [containers, image-pull]
|
||||
|
||||
- name: Create media directory structure
|
||||
file:
|
||||
path: "{{ authentik_media_dir }}/{{ item }}"
|
||||
state: directory
|
||||
owner: "{{ authentik_user }}"
|
||||
group: "{{ authentik_group }}"
|
||||
mode: '0755'
|
||||
loop:
|
||||
- public
|
||||
- private
|
||||
tags: [setup, media]
|
||||
|
||||
- name: Deploy environment configuration
|
||||
template:
|
||||
src: authentik.env.j2
|
||||
@@ -154,13 +128,12 @@
|
||||
|
||||
- name: Wait for Authentik to be ready
|
||||
uri:
|
||||
url: "https://{{ authentik_domain }}/if/health/live/"
|
||||
url: "http://127.0.0.1:{{ authentik_http_port }}/"
|
||||
method: GET
|
||||
status_code: [200]
|
||||
status_code: [200, 302]
|
||||
timeout: 30
|
||||
validate_certs: true
|
||||
retries: 10
|
||||
delay: 30
|
||||
delay: 15
|
||||
register: authentik_health_check
|
||||
tags: [verification, health-check]
|
||||
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
---
|
||||
# Authentik Container Networking - Bridge Network Setup
|
||||
|
||||
- name: Create authentik bridge network
|
||||
containers.podman.podman_network:
|
||||
name: "{{ authentik_network_name }}"
|
||||
driver: bridge
|
||||
internal: false
|
||||
state: present
|
||||
become: yes
|
||||
become_user: "{{ authentik_user }}"
|
||||
|
||||
- name: Check if authentik network exists
|
||||
command: podman network ls --format json
|
||||
become: yes
|
||||
become_user: "{{ authentik_user }}"
|
||||
register: network_list
|
||||
changed_when: false
|
||||
|
||||
- name: Ensure host gateway is available in network
|
||||
debug:
|
||||
msg: "Network {{ authentik_network_name }} configured for host.containers.internal access"
|
||||
when: authentik_enable_host_gateway | default(true)
|
||||
@@ -4,30 +4,30 @@
|
||||
- name: Create authentik group
|
||||
group:
|
||||
name: "{{ authentik_group }}"
|
||||
system: yes
|
||||
system: true
|
||||
|
||||
- name: Create authentik user
|
||||
user:
|
||||
name: "{{ authentik_user }}"
|
||||
group: "{{ authentik_group }}"
|
||||
system: yes
|
||||
system: true
|
||||
shell: /bin/bash
|
||||
home: "{{ authentik_home }}"
|
||||
create_home: yes
|
||||
create_home: true
|
||||
comment: "Authentik authentication service"
|
||||
|
||||
- name: Set up subuid for authentik user
|
||||
lineinfile:
|
||||
path: /etc/subuid
|
||||
line: "{{ authentik_user }}:{{ authentik_subuid_start }}:{{ authentik_subuid_size }}"
|
||||
create: yes
|
||||
create: true
|
||||
mode: '0644'
|
||||
|
||||
- name: Set up subgid for authentik user
|
||||
lineinfile:
|
||||
path: /etc/subgid
|
||||
line: "{{ authentik_user }}:{{ authentik_subgid_start }}:{{ authentik_subgid_size }}"
|
||||
create: yes
|
||||
create: true
|
||||
mode: '0644'
|
||||
|
||||
- name: Create authentik directories
|
||||
@@ -46,6 +46,7 @@
|
||||
- "{{ authentik_home }}/.config/containers/systemd"
|
||||
- "{{ authentik_home }}/data"
|
||||
- "{{ authentik_home }}/media"
|
||||
- "{{ authentik_home }}/logs"
|
||||
|
||||
- name: Enable lingering for authentik user
|
||||
command: loginctl enable-linger {{ authentik_user }}
|
||||
@@ -54,7 +55,19 @@
|
||||
|
||||
- name: Initialize user systemd for authentik
|
||||
systemd:
|
||||
daemon_reload: yes
|
||||
daemon_reload: true
|
||||
scope: user
|
||||
become: yes
|
||||
become_user: "{{ authentik_user }}"
|
||||
become: true
|
||||
become_user: "{{ authentik_user }}"
|
||||
|
||||
- name: Get authentik user UID and GID for container configuration
|
||||
shell: |
|
||||
echo "uid=$(id -u {{ authentik_user }})"
|
||||
echo "gid=$(id -g {{ authentik_user }})"
|
||||
register: authentik_user_info
|
||||
changed_when: false
|
||||
|
||||
- name: Set authentik UID/GID facts for container templates
|
||||
set_fact:
|
||||
authentik_uid: "{{ authentik_user_info.stdout_lines[0] | regex_replace('uid=', '') }}"
|
||||
authentik_gid: "{{ authentik_user_info.stdout_lines[1] | regex_replace('gid=', '') }}"
|
||||
Reference in New Issue
Block a user