Files

T

Frank 3cc99d81cc Authentik SSO + homepage naked domain

Auth layer (Authentik 2026.8.0):
- compose: 3-service stack (authentik-postgres, authentik-server, authentik-worker),
  postgres health-gated, bind mounts under /home/dank/authentik
- Caddyfile: auth.franksdank.cloud vhost; forward_auth on the no-auth vhosts
  (homepage, SearXNG, Hermes, Prometheus, RomM, Copyparty); outpost path
  proxied first in a route block
- .env.example: AUTHENTIK_PG_PASS + AUTHENTIK_SECRET_KEY
- deploy.sh: render only CADDY_BASICAUTH_HASH (the homepage per-user hashes
  are retired; grafana + pihole keep basicauth)
- tests/authentik.bats (new) + updated homepage/caddyfile/pihole seams
- docs: Authentik.md + per-service pages; Caddy.md + Homepage.md updated

Homepage (naked domain):
- Caddyfile: dankclaw.franksdank.cloud -> franksdank.cloud www.franksdank.cloud;
  dankclaw + dankserver redirect to it; bare-IP catch-all updated
- addn-hosts: A records for the naked domain, www, and auth (all -> 143)
- tests/pihole.bats: vhost_names handles multi-address blocks; TLD check
  allows the naked domain

All 146 tests pass.

2026-08-24 23:48:27 -07:00

728 B

Raw Blame History

authentik-server

The Authentik server — the core, the admin API, and the embedded Caddy outpost. This is the service the Caddy forward_auth vhosts proxy to (authentik-server:9000). It also serves the login page at https://auth.franksdank.cloud.

Compose service: authentik-server (in dankclaw/compose.yaml)
Image: ghcr.io/goauthentik/server:2026.8.0 (command: server)
Port: 9000 (published; the outpost + admin + login all live here)
Data: /home/dank/authentik/data (bind mount, shared with the worker)
Health: http://localhost:9000/-/health/

See Authentik.md for the full architecture, the Caddy forward_auth pattern, first-time setup, and failure modes.

728 B Raw Blame History

authentik-server

728 B

Raw Blame History