auto backup 2026-03-25_13:03:04

03_auth/.env

@@ -0,0 +1,17 @@
+DENACCESS_POSTGRES_DB=authentik-luckyden-db
+DENACCESS_POSTGRES_USER=authentik-luckyden-admin
+DENACCESS_POSTGRES_PASSWORD=6OCBfxO4mL!8
+DENACCESS_AUTHENTIK_SECRET_KEY=qliGSpJEuJgEFSszeQgUVaEhVqISKbVZyWzmFzpmHGqWX0A1GkrBoL4ttkmRQ
+DENACCESS_AUTHENTIK_HOST=https://access.luckyden.org/
+
+AUTHENTIK_EMAIL__HOST=smtp.gmail.com
+AUTHENTIK_EMAIL__PORT=465
+AUTHENTIK_EMAIL__USERNAME=[email protected]
+AUTHENTIK_EMAIL__PASSWORD=hlbf dfyx geny iqjb
+AUTHENTIK_EMAIL__USE_TLS=false
+AUTHENTIK_EMAIL__USE_SSL=true
+AUTHENTIK_EMAIL__TIMEOUT=10
+AUTHENTIK_EMAIL__FROM=[email protected]
+
+AUTHENTIK_TOKEN=dUrxclY2eIQ5s93GhajjLpsnzgSj96Bz97eAuCTuitzDvHS1aCFUTkC1aUsf
+AUTHENTIK_HOST_BROWSER=https://access.luckyden.org

03_auth/docker-compose.yml

@@ -1,8 +1,8 @@
 services:
+
   postgresql:
     image: docker.io/library/postgres:16-alpine
     restart: unless-stopped
-
     healthcheck:
       test:
         - CMD-SHELL
@@ -11,28 +11,22 @@ services:
       interval: 30s
       retries: 5
       timeout: 5s
-
     volumes:
       - /home/docker/DenAccess/database:/var/lib/postgresql/data
-
     environment:
       - POSTGRES_PASSWORD=${DENACCESS_POSTGRES_PASSWORD}
       - POSTGRES_USER=${DENACCESS_POSTGRES_USER}
       - POSTGRES_DB=${DENACCESS_POSTGRES_DB}
-
     env_file:
       - .env
-
     networks:
       tan-network:
         ipv4_address: 10.10.0.30
 
-
   redis:
     image: docker.io/library/redis:alpine
     command: --save 60 1 --loglevel warning
     restart: unless-stopped
-
     healthcheck:
       test:
         - CMD-SHELL
@@ -41,15 +35,12 @@ services:
       interval: 30s
       retries: 5
       timeout: 3s
-
     volumes:
       - /home/docker/DenAccess/redis:/data
-
     networks:
       tan-network:
         ipv4_address: 10.10.0.31
 
-
   server:
     image: ghcr.io/goauthentik/server:2025.10.2
     restart: unless-stopped
@@ -68,37 +59,29 @@ services:
       - AUTHENTIK_COOKIE__SECURE=true
       - AUTHENTIK_SESSION__COOKIE_SECURE=true
       - TRUSTED_PROXIES=10.10.0.20
-
     volumes:
       - /home/docker/DenAccess/media:/media
       - /home/docker/DenAccess/custom-templates:/templates
-
     env_file:
       - .env
-
     depends_on:
       - postgresql
       - redis
-
     networks:
       tan-network:
         ipv4_address: 10.10.0.32
-
     labels:
       - traefik.enable=true
-
       # ROUTER
-      - traefik.http.routers.authentik.rule=Host(`access.luckyden.org`)
-      - traefik.http.routers.authentik.entrypoints=websecure
-      - traefik.http.routers.authentik.tls=true
-
+      - traefik.http.routers.authentik-server.rule=Host(`access.luckyden.org`)
+      - traefik.http.routers.authentik-server.entrypoints=websecure
+      - traefik.http.routers.authentik-server.tls=true
+      - traefik.http.routers.authentik-server.priority=10
       # SERVICE (HTTP interne uniquement !)
-      - traefik.http.services.authentik.loadbalancer.server.port=9000
-
+      - traefik.http.services.authentik-server.loadbalancer.server.port=9000
       # HEADERS IMPORTANT (auth flows)
       - traefik.http.middlewares.authentik-headers.headers.customrequestheaders.X-Forwarded-Proto=https
-      - traefik.http.routers.authentik.middlewares=authentik-headers
-
+      - traefik.http.routers.authentik-server.middlewares=authentik-headers
 
   worker:
     image: ghcr.io/goauthentik/server:2025.10.2
@@ -130,11 +113,44 @@ services:
     depends_on:
       - postgresql
       - redis
+      - server
 
     networks:
       tan-network:
         ipv4_address: 10.10.0.33
 
+  authentik-proxy:
+    image: ghcr.io/goauthentik/proxy:2025.10.2
+    restart: unless-stopped
+    expose:
+      - 9000
+    environment:
+      AUTHENTIK_PROXY_SESSION_STORAGE: filesystem
+      AUTHENTIK_PROXY_SESSION_STORAGE_FILESYSTEM_PATH: /sessions
+      AUTHENTIK_HOST: http://server:9000
+      AUTHENTIK_INSECURE: "false"
+      AUTHENTIK_TOKEN: "${AUTHENTIK_TOKEN}"
+      AUTHENTIK_HOST_BROWSER: ${AUTHENTIK_HOST_BROWSER}
+    labels:
+      - traefik.enable=true
+      # ROUTE OUTPOST ✅
+      - traefik.http.routers.authentik-outpost.rule=Host(`access.luckyden.org`) && PathPrefix(`/outpost.goauthentik.io`)
+      - traefik.http.routers.authentik-outpost.entrypoints=websecure
+      - traefik.http.routers.authentik-outpost.tls=true
+      - traefik.http.services.authentik-outpost.loadbalancer.server.port=9000
+      - traefik.http.routers.authentik-outpost.priority=100
+      # ✅ LE MIDDLEWARE
+      - traefik.http.middlewares.authentik.forwardauth.address=http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik
+      - traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
+      - traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid
+    volumes:
+      - /home/docker/DenAccess/proxy/sessions:/sessions
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.34
+    shm_size: 512m
+    depends_on:
+      - server
 
 networks:
   tan-network: