Frank
58952bd820
ghcr.io/goauthentik/ldap digest fa33bc8f -> 2e7b259e (2026.8.3 amd64 single-platform digest; podman 5.7.0 rejects the tag's manifest list).
41 lines
1.6 KiB
INI
41 lines
1.6 KiB
INI
# Quadlet unit: Authentik LDAP outpost (rootless, boot-persistent).
|
|
#
|
|
# Install path on dankclaw: ~/.config/containers/systemd/authentik-outpost-ldap.container
|
|
# Unit name: authentik-outpost-ldap.service (podman 5.x drops the container- prefix)
|
|
#
|
|
# Serves the authentik LDAP provider ("Jellyfin LDAP", Base DN
|
|
# dc=franksdank,dc=cloud) so dankserver's Jellyfin can authenticate its users
|
|
# via the LDAP-Auth plugin. The type-specific ghcr.io/goauthentik/ldap image
|
|
# listens on 3389 (ldap) / 6636 (ldaps) inside the container; published to
|
|
# host 389/636 for cross-host binds from dankserver. The outpost token lives
|
|
# in the host .env (AUTHENTIK_LDAP_OUTPOST_TOKEN), never in this repo. The
|
|
# outpost dials core over websocket at AUTHENTIK_HOST; auth. is guard-chain
|
|
# exempt (IdP).
|
|
|
|
[Unit]
|
|
Description=Authentik LDAP outpost container
|
|
After=network.target authentik-server.service
|
|
Wants=authentik-server.service
|
|
|
|
[Container]
|
|
ContainerName=authentik-outpost-ldap
|
|
Network=dankclaw_default
|
|
# Image=ghcr.io/goauthentik/ldap:2026.8.3 (amd64 digest; podman 5.7.0 refuses
|
|
# the tag's nested manifest list, so pin the single-platform digest).
|
|
EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env
|
|
Image=ghcr.io/goauthentik/ldap@sha256:2e7b259eb8c37faac916946ddf48ec681ee9d3a9f724fe8521bf161973f13cf9
|
|
Environment=AUTHENTIK_HOST=https://auth.franksdank.cloud
|
|
Environment=AUTHENTIK_INSECURE=false
|
|
Environment=AUTHENTIK_TOKEN=${AUTHENTIK_LDAP_OUTPOST_TOKEN}
|
|
PublishPort=389:3389
|
|
PublishPort=636:6636
|
|
User=0:0
|
|
|
|
[Service]
|
|
EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=default.target
|