Frank
3cc99d81cc
Auth layer (Authentik 2026.8.0): - compose: 3-service stack (authentik-postgres, authentik-server, authentik-worker), postgres health-gated, bind mounts under /home/dank/authentik - Caddyfile: auth.franksdank.cloud vhost; forward_auth on the no-auth vhosts (homepage, SearXNG, Hermes, Prometheus, RomM, Copyparty); outpost path proxied first in a route block - .env.example: AUTHENTIK_PG_PASS + AUTHENTIK_SECRET_KEY - deploy.sh: render only CADDY_BASICAUTH_HASH (the homepage per-user hashes are retired; grafana + pihole keep basicauth) - tests/authentik.bats (new) + updated homepage/caddyfile/pihole seams - docs: Authentik.md + per-service pages; Caddy.md + Homepage.md updated Homepage (naked domain): - Caddyfile: dankclaw.franksdank.cloud -> franksdank.cloud www.franksdank.cloud; dankclaw + dankserver redirect to it; bare-IP catch-all updated - addn-hosts: A records for the naked domain, www, and auth (all -> 143) - tests/pihole.bats: vhost_names handles multi-address blocks; TLD check allows the naked domain All 146 tests pass.
15 lines
678 B
Markdown
15 lines
678 B
Markdown
# authentik-worker
|
|
|
|
The Authentik worker — background tasks: event processing, provider
|
|
synchronization, scheduled flows, and certificate renewal. It runs the same
|
|
image as the server; the `command: worker` selects the role.
|
|
|
|
- **Compose service:** `authentik-worker` (in `dankclaw/compose.yaml`)
|
|
- **Image:** `ghcr.io/goauthentik/server:2026.8.0` (command: `worker`)
|
|
- **Runs as:** `0:0` (rootless: container root maps to the host user that owns the data dir)
|
|
- **Data:** `/home/dank/authentik/data` (bind mount, shared with the server)
|
|
- **No port** — the worker has no HTTP endpoint.
|
|
|
|
See [Authentik.md](Authentik.md) for the full architecture, setup, and failure
|
|
modes.
|