services:
  postgresql:
    image: docker.io/library/postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${PG_DB:-authentik}
      POSTGRES_USER: ${PG_USER:-authentik}
      POSTGRES_PASSWORD: ${PG_PASS:-authentik}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s
    volumes:
      - database:/var/lib/postgresql/data

  redis:
    image: docker.io/library/redis:7-alpine
    restart: unless-stopped
    command: redis-server --save "" --appendonly no
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      interval: 10s
      timeout: 3s
      retries: 12
      start_period: 10s

  authentik:
    image: ${AUTHENTIK_IMAGE:-docker.io/authentik/server}:${AUTHENTIK_TAG:-2026.2.2}
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:-authentik}
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_BOOTSTRAP_EMAIL: ${AUTHENTIK_BOOTSTRAP_EMAIL}
      AUTHENTIK_BOOTSTRAP_PASSWORD: ${AUTHENTIK_BOOTSTRAP_PASSWORD}
      AUTHENTIK_BOOTSTRAP_TOKEN: ${AUTHENTIK_BOOTSTRAP_TOKEN}
      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
      AUTHENTIK_LOG_LEVEL: info
    ports:
      - "127.0.0.1:9000:9000"
    depends_on:
      postgresql:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - ./authentik-data:/data
      - ./custom-templates:/templates
      - ./authentik/blueprints:/blueprints/custom

  authentik-worker:
    image: ${AUTHENTIK_IMAGE:-docker.io/authentik/server}:${AUTHENTIK_TAG:-2026.2.2}
    restart: unless-stopped
    command: worker
    user: root
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:-authentik}
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_BOOTSTRAP_EMAIL: ${AUTHENTIK_BOOTSTRAP_EMAIL}
      AUTHENTIK_BOOTSTRAP_PASSWORD: ${AUTHENTIK_BOOTSTRAP_PASSWORD}
      AUTHENTIK_BOOTSTRAP_TOKEN: ${AUTHENTIK_BOOTSTRAP_TOKEN}
      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
      AUTHENTIK_LOG_LEVEL: info
    depends_on:
      postgresql:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./authentik-data:/data
      - ./custom-templates:/templates
      - ./authentik/blueprints:/blueprints/custom

  frontend:
    build: ./frontend
    restart: unless-stopped
    environment:
      APP_URL: ${APP_URL}
      SESSION_SECRET: ${SESSION_SECRET}
      AUTHENTIK_PUBLIC_URL: ${AUTHENTIK_PUBLIC_URL}
      AUTHENTIK_INTERNAL_URL: ${AUTHENTIK_INTERNAL_URL}
      AUTHENTIK_API_TOKEN: ${AUTHENTIK_API_TOKEN}
      AUTHENTIK_LOGIN_FLOW: ${AUTHENTIK_LOGIN_FLOW}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
      OIDC_ISSUER: ${OIDC_ISSUER}
      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI}
      AUTH_DEBUG: ${AUTH_DEBUG}
    ports:
      - "127.0.0.1:3000:3000"
    depends_on:
      authentik:
        condition: service_started
      authentik-worker:
        condition: service_started
    extra_hosts:
      - "host.docker.internal:host-gateway"

volumes:
  database: