Frank
3cc99d81cc
Auth layer (Authentik 2026.8.0): - compose: 3-service stack (authentik-postgres, authentik-server, authentik-worker), postgres health-gated, bind mounts under /home/dank/authentik - Caddyfile: auth.franksdank.cloud vhost; forward_auth on the no-auth vhosts (homepage, SearXNG, Hermes, Prometheus, RomM, Copyparty); outpost path proxied first in a route block - .env.example: AUTHENTIK_PG_PASS + AUTHENTIK_SECRET_KEY - deploy.sh: render only CADDY_BASICAUTH_HASH (the homepage per-user hashes are retired; grafana + pihole keep basicauth) - tests/authentik.bats (new) + updated homepage/caddyfile/pihole seams - docs: Authentik.md + per-service pages; Caddy.md + Homepage.md updated Homepage (naked domain): - Caddyfile: dankclaw.franksdank.cloud -> franksdank.cloud www.franksdank.cloud; dankclaw + dankserver redirect to it; bare-IP catch-all updated - addn-hosts: A records for the naked domain, www, and auth (all -> 143) - tests/pihole.bats: vhost_names handles multi-address blocks; TLD check allows the naked domain All 146 tests pass.
15 lines
633 B
Markdown
15 lines
633 B
Markdown
# authentik-postgres
|
|
|
|
The PostgreSQL 16 database for [Authentik](Authentik.md) — the homelab's SSO /
|
|
OIDC provider. It is the only stateful store in the stack (users, flows,
|
|
sessions, events). Redis was removed in Authentik 2025.10; sessions and caching
|
|
now live here.
|
|
|
|
- **Compose service:** `authentik-postgres` (in `dankclaw/compose.yaml`)
|
|
- **Image:** `docker.io/library/postgres:16-alpine`
|
|
- **Data:** `/home/dank/authentik/postgres` (bind mount; no named volumes)
|
|
- **Health:** `pg_isready -d authentik -U authentik`
|
|
|
|
See [Authentik.md](Authentik.md) for the full architecture, setup, backups
|
|
(`pg_dump`), and failure modes.
|