Joakim
b42ee2a22b
Resolves authentik deployment issues by implementing proper Podman Quadlet configuration and fixing networking for external access through Caddy. Core Fixes: • Add missing [Install] sections to container Quadlet files for systemd service generation • Fix pod references from 'systemd-authentik' to 'authentik.pod' for proper Quadlet linking • Remove problematic --userns=host to use proper rootless user namespaces • Configure subuid/subgid ranges for authentik user (200000:65536) • Update networking to bind 0.0.0.0:9000 only (remove unnecessary HTTPS port 9443) • Add AUTHENTIK_LISTEN__HTTP=0.0.0.0:9000 environment configuration • Fix Caddy reverse proxy to use HTTP backend instead of HTTPS Infrastructure Updates: • Enhance PostgreSQL role with Unix socket configuration and user management • Improve Valkey role with proper systemd integration and socket permissions • Add comprehensive service integration documentation • Update deployment playbooks with backup and restore capabilities Security Improvements: • Secure network isolation with Caddy SSL termination • Reduced attack surface by removing direct HTTPS container exposure • Proper rootless container configuration with user namespace mapping Result: authentik now fully operational with external HTTPS access via auth.jnss.me All systemd services (authentik-pod, authentik-server, authentik-worker) running correctly.
28 lines
790 B
YAML
28 lines
790 B
YAML
---
|
|
# Security hardening establishes secure foundation before web services
|
|
# - import_playbook: playbooks/security.yml
|
|
|
|
- name: Deploy Core Infrastructure
|
|
hosts: arch-vps
|
|
become: true
|
|
gather_facts: true
|
|
|
|
roles:
|
|
# Infrastructure services
|
|
# - role: postgresql
|
|
# tags: ['postgresql', 'infrastructure', 'database']
|
|
# - role: valkey
|
|
# tags: ['valkey', 'redis', 'infrastructure', 'cache']
|
|
# - role: podman
|
|
# tags: ['podman', 'containers', 'infrastructure']
|
|
# - role: caddy
|
|
# tags: ['caddy', 'infrastructure', 'web']
|
|
|
|
# Application services
|
|
- role: authentik
|
|
tags: ['authentik']
|
|
# - role: gitea
|
|
# tags: ['gitea', 'git', 'development']
|
|
# - role: sigvild-gallery
|
|
# tags: ['sigvild', 'gallery', 'wedding']
|