Joakim
b42ee2a22b
Resolves authentik deployment issues by implementing proper Podman Quadlet configuration and fixing networking for external access through Caddy. Core Fixes: • Add missing [Install] sections to container Quadlet files for systemd service generation • Fix pod references from 'systemd-authentik' to 'authentik.pod' for proper Quadlet linking • Remove problematic --userns=host to use proper rootless user namespaces • Configure subuid/subgid ranges for authentik user (200000:65536) • Update networking to bind 0.0.0.0:9000 only (remove unnecessary HTTPS port 9443) • Add AUTHENTIK_LISTEN__HTTP=0.0.0.0:9000 environment configuration • Fix Caddy reverse proxy to use HTTP backend instead of HTTPS Infrastructure Updates: • Enhance PostgreSQL role with Unix socket configuration and user management • Improve Valkey role with proper systemd integration and socket permissions • Add comprehensive service integration documentation • Update deployment playbooks with backup and restore capabilities Security Improvements: • Secure network isolation with Caddy SSL termination • Reduced attack surface by removing direct HTTPS container exposure • Proper rootless container configuration with user namespace mapping Result: authentik now fully operational with external HTTPS access via auth.jnss.me All systemd services (authentik-pod, authentik-server, authentik-worker) running correctly.
33 lines
911 B
Plaintext
33 lines
911 B
Plaintext
[Unit]
|
|
Description=Authentik Server Container
|
|
After=authentik-pod.service
|
|
Requires=authentik-pod.service
|
|
|
|
[Container]
|
|
ContainerName={{ authentik_container_server_name }}
|
|
Image={{ authentik_image }}:{{ authentik_version }}
|
|
Pod=authentik.pod
|
|
EnvironmentFile={{ authentik_home }}/.env
|
|
User={{ authentik_uid }}:{{ authentik_gid }}
|
|
Annotation=run.oci.keep_original_groups=1
|
|
|
|
# Logging configuration
|
|
LogDriver=k8s-file
|
|
LogOpt=path={{ authentik_home }}/logs/server.log
|
|
Volume={{ authentik_home }}/logs:{{ authentik_home }}/logs
|
|
|
|
# Volume mounts for data and sockets
|
|
Volume={{ authentik_media_dir }}:/media
|
|
Volume={{ authentik_data_dir }}:/data
|
|
Volume={{ postgresql_unix_socket_directories }}:{{ postgresql_unix_socket_directories }}:Z
|
|
Volume={{ valkey_unix_socket_path | dirname }}:{{ valkey_unix_socket_path | dirname }}:Z
|
|
|
|
Exec=server
|
|
|
|
[Service]
|
|
Restart=always
|
|
TimeoutStartSec=300
|
|
|
|
[Install]
|
|
WantedBy=default.target
|