Joakim
9e570ac2a3
- Add authentik-deployment-guide.md: Complete step-by-step deployment guide - Add architecture-decisions.md: Document native DB vs containerized rationale - Add authentication-architecture.md: SSO strategy and integration patterns - Update deployment-guide.md: Integrate authentik deployment procedures - Update security-hardening.md: Add multi-layer security documentation - Update service-integration-guide.md: Add authentik integration examples - Update README.md: Professional project overview with architecture benefits - Update authentik role: Fix HTTP binding, add security configs, improve templates - Remove unused authentik task files: containers.yml, networking.yml Key improvements: * Document security benefits of native databases over containers * Document Unix socket IPC architecture advantages * Provide comprehensive troubleshooting and deployment procedures * Add forward auth integration patterns for services * Fix authentik HTTP binding from 127.0.0.1 to 0.0.0.0 * Add shared memory and IPC security configurations
38 lines
1.0 KiB
Plaintext
38 lines
1.0 KiB
Plaintext
[Unit]
|
|
Description=Authentik Worker Container
|
|
After=authentik-pod.service
|
|
Requires=authentik-pod.service
|
|
|
|
[Container]
|
|
ContainerName={{ authentik_container_worker_name }}
|
|
Image={{ authentik_image }}:{{ authentik_version }}
|
|
Pod=authentik.pod
|
|
EnvironmentFile={{ authentik_home }}/.env
|
|
User={{ authentik_uid }}:{{ authentik_gid }}
|
|
Annotation=run.oci.keep_original_groups=1
|
|
|
|
# Security configuration for shared memory and IPC
|
|
Volume=/dev/shm:/dev/shm:rw
|
|
SecurityLabelDisable=true
|
|
AddCapability=IPC_OWNER
|
|
|
|
# Logging configuration
|
|
LogDriver=k8s-file
|
|
LogOpt=path={{ authentik_home }}/logs/worker.log
|
|
Volume={{ authentik_home }}/logs:{{ authentik_home }}/logs
|
|
|
|
# Volume mounts for data and sockets
|
|
Volume={{ authentik_media_dir }}:/media
|
|
Volume={{ authentik_data_dir }}:/data
|
|
Volume={{ postgresql_unix_socket_directories }}:{{ postgresql_unix_socket_directories }}:Z
|
|
Volume={{ valkey_unix_socket_path | dirname }}:{{ valkey_unix_socket_path | dirname }}:Z
|
|
|
|
Exec=worker
|
|
|
|
[Service]
|
|
Restart=always
|
|
TimeoutStartSec=300
|
|
|
|
[Install]
|
|
WantedBy=default.target
|