Frank
58184008dd
Container images re-resolved against their registries today; each pin is the manifest-list digest the tag answers now, so no container is served from a build that upstream has already replaced. Version-tag moves: authentik 2026.8.3 -> 2026.8.5 (server/worker/outpost and the ldap image, which now carries the tag instead of a bare digest so the pair can never drift apart), seerr v3.4.1 -> v3.5.1, calibre 9.15.0 -> 9.17.0, calibre-web 0.6.27-ls402 -> ls407, plex ls329 -> ls330, tautulli v2.18.1-ls245 -> v2.18.2-ls250. Digest-only moves inside the same stream: postgres 16-alpine, mariadb 11, redis 7-alpine, valkey 9-alpine, grafana, alertmanager, gluetun, searxng, open-webui, jellyfin, romm, chromedp/headless-shell, lightpanda/browser. Rollback is the previous digest on the same Image= line.
41 lines
1.6 KiB
INI
41 lines
1.6 KiB
INI
# Quadlet unit: Authentik LDAP outpost (rootless, boot-persistent).
|
|
#
|
|
# Install path on dankclaw: ~/.config/containers/systemd/authentik-outpost-ldap.container
|
|
# Unit name: authentik-outpost-ldap.service (podman 5.x drops the container- prefix)
|
|
#
|
|
# Serves the authentik LDAP provider ("Jellyfin LDAP", Base DN
|
|
# dc=franksdank,dc=cloud) so dankserver's Jellyfin can authenticate its users
|
|
# via the LDAP-Auth plugin. The type-specific ghcr.io/goauthentik/ldap image
|
|
# listens on 3389 (ldap) / 6636 (ldaps) inside the container; published to
|
|
# host 389/636 for cross-host binds from dankserver. The outpost token lives
|
|
# in the host .env (AUTHENTIK_LDAP_OUTPOST_TOKEN), never in this repo. The
|
|
# outpost dials core over websocket at AUTHENTIK_HOST; auth. is guard-chain
|
|
# exempt (IdP).
|
|
|
|
[Unit]
|
|
Description=Authentik LDAP outpost container
|
|
After=network.target authentik-server.service
|
|
Wants=authentik-server.service
|
|
|
|
[Container]
|
|
ContainerName=authentik-outpost-ldap
|
|
Network=dankclaw_default
|
|
# Image=ghcr.io/goauthentik/ldap:2026.8.3 (amd64 digest; podman 5.7.0 refuses
|
|
# the tag's nested manifest list, so pin the single-platform digest).
|
|
EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env
|
|
Image=ghcr.io/goauthentik/ldap:2026.8.5@sha256:4c75bd27918418d2d6fbbfe4581bbd5a199fe38942d24559c4483edd64a1ea87
|
|
Environment=AUTHENTIK_HOST=https://auth.franksdank.cloud
|
|
Environment=AUTHENTIK_INSECURE=false
|
|
Environment=AUTHENTIK_TOKEN=${AUTHENTIK_LDAP_OUTPOST_TOKEN}
|
|
PublishPort=389:3389
|
|
PublishPort=636:6636
|
|
User=0:0
|
|
|
|
[Service]
|
|
EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=default.target
|