Joakim
3506e55016
Major architectural change from rootless user services to system-level (rootful) containers to enable group-based Unix socket access for containerized applications. Infrastructure Changes: - PostgreSQL: Export postgres-clients group GID as Ansible fact - Valkey: Export valkey-clients group GID as Ansible fact - Valkey: Add socket-fix service to maintain correct socket group ownership - Both: Set socket directories to 770 with client group ownership Authentik Role Refactoring: - Remove rootless container configuration (subuid/subgid, lingering, user systemd) - Deploy Quadlet files to /etc/containers/systemd/ (system-level) - Use dynamic GID facts in container PodmanArgs (--group-add) - Simplify user creation to system user with infrastructure group membership - Update handlers for system scope service management - Remove unnecessary container security options (no user namespace isolation) Container Template Changes: - Pod: Remove --userns args, change WantedBy to multi-user.target - Containers: Replace Annotation with PodmanArgs using dynamic GIDs - Remove /dev/shm mounts and SecurityLabelDisable (not needed for rootful) - Change WantedBy to multi-user.target for system services Documentation Updates: - Add ADR-005: Rootful Containers with Infrastructure Fact Pattern - Update ADR-003: Podman + systemd for system-level deployment - Update authentik-deployment-guide.md for system scope commands - Update service-integration-guide.md with rootful pattern examples - Document discarded rootless approach and rationale Why Rootful Succeeds: - Direct UID/GID mapping preserves supplementary groups - Container process groups match host socket group ownership - No user namespace remapping breaking permissions Why Rootless Failed (Discarded): - User namespace UID/GID remapping broke group-based socket access - Supplementary groups remapped into subgid range didn't match socket ownership - Even with --userns=host and keep_original_groups, permissions failed Pattern Established: - Infrastructure roles create client groups and export GID facts - Application roles validate facts and consume in container templates - Rootful containers run as dedicated users with --group-add for socket access - System-level deployment provides standard systemd service management Deployment Validated: - Services in /system.slice/ ✓ - Process groups: 961 (valkey-clients), 962 (postgres-clients), 966 (authentik) ✓ - Socket permissions: 770 with client groups ✓ - HTTP endpoint responding ✓
109 lines
3.9 KiB
YAML
109 lines
3.9 KiB
YAML
---
|
|
# =================================================================
|
|
# Authentik Authentication Role - Default Variables
|
|
# =================================================================
|
|
# Self-contained Authentik deployment with Podman and Unix sockets
|
|
|
|
# =================================================================
|
|
# Service Configuration
|
|
# =================================================================
|
|
|
|
# Service user and directories
|
|
authentik_user: authentik
|
|
authentik_group: authentik
|
|
authentik_home: /opt/authentik
|
|
authentik_data_dir: "{{ authentik_home }}/data"
|
|
authentik_media_dir: "{{ authentik_home }}/media"
|
|
authentik_log_dir: "{{ authentik_home }}/logs"
|
|
|
|
# Container configuration
|
|
authentik_version: "2025.10"
|
|
authentik_image: "ghcr.io/goauthentik/server"
|
|
|
|
# Service management
|
|
authentik_service_enabled: true
|
|
authentik_service_state: "started"
|
|
|
|
# =================================================================
|
|
# Database Configuration (Self-managed)
|
|
# =================================================================
|
|
|
|
authentik_db_name: "authentik"
|
|
authentik_db_user: "authentik"
|
|
authentik_db_password: "{{ vault_authentik_db_password }}"
|
|
|
|
# =================================================================
|
|
# Cache Configuration (Self-managed)
|
|
# =================================================================
|
|
|
|
authentik_valkey_db: 1 # Use database 1 for Authentik
|
|
|
|
# =================================================================
|
|
# Network Configuration
|
|
# =================================================================
|
|
|
|
authentik_domain: "auth.jnss.me"
|
|
authentik_http_port: 9000
|
|
authentik_bind_address: "0.0.0.0"
|
|
|
|
# =================================================================
|
|
# Authentik Core Configuration
|
|
# =================================================================
|
|
|
|
authentik_secret_key: "{{ vault_authentik_secret_key }}"
|
|
authentik_log_level: "info"
|
|
authentik_error_reporting: false
|
|
|
|
# =================================================================
|
|
# Email Configuration (Optional)
|
|
# =================================================================
|
|
|
|
authentik_email_enabled: false
|
|
authentik_email_host: ""
|
|
authentik_email_port: 587
|
|
authentik_email_username: ""
|
|
authentik_email_password: "{{ vault_authentik_email_password | default('') }}"
|
|
authentik_email_tls: true
|
|
authentik_email_from: "authentik@{{ authentik_domain }}"
|
|
|
|
# =================================================================
|
|
# Security Configuration
|
|
# =================================================================
|
|
|
|
# Default admin user (created during deployment)
|
|
authentik_default_admin_email: "admin@{{ authentik_domain }}"
|
|
authentik_default_admin_password: "{{ vault_authentik_admin_password }}"
|
|
|
|
# =================================================================
|
|
# Podman Pod Configuration
|
|
# =================================================================
|
|
|
|
# Pod service name is simply "authentik" (generated from authentik.pod)
|
|
authentik_container_server_name: "authentik-server"
|
|
authentik_container_worker_name: "authentik-worker"
|
|
|
|
# User session variables (set dynamically during deployment)
|
|
authentik_uid: ""
|
|
|
|
# =================================================================
|
|
# Caddy Integration
|
|
# =================================================================
|
|
|
|
# Caddy configuration (assumes caddy role provides these variables)
|
|
caddy_sites_enabled_dir: "/etc/caddy/sites-enabled"
|
|
caddy_log_dir: "/var/log/caddy"
|
|
caddy_user: "caddy"
|
|
|
|
# =================================================================
|
|
# Infrastructure Dependencies (Read-only)
|
|
# =================================================================
|
|
|
|
# PostgreSQL socket configuration (managed by postgresql role)
|
|
postgresql_unix_socket_directories: "/var/run/postgresql"
|
|
postgresql_client_group: "postgres-clients"
|
|
|
|
# Valkey socket configuration (managed by valkey role)
|
|
valkey_unix_socket_path: "/var/run/valkey/valkey.sock"
|
|
valkey_password: "{{ vault_valkey_password }}"
|
|
valkey_client_group: "valkey-clients"
|