services:
  postgresql:
    image: ${AUTHENTIK_POSTGRES_IMAGE:-postgres:16-alpine}
    restart: ${AUTHENTIK_RESTART:-unless-stopped}
    volumes:
      - ${VOL_PATH:-/data}/authentik/db:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=${PG_DB:-authentik}
      - POSTGRES_PASSWORD=${PG_PASS:?database password required}
      - POSTGRES_USER=${PG_USER:-authentik}
    networks:
      - internal

  server:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.1}
    restart: ${AUTHENTIK_RESTART:-unless-stopped}
    volumes:
      - ${VOL_PATH:-/data}/authentik/media:/media
      - ${VOL_PATH:-/data}/authentik/custom-templates:/templates
    environment:
      - AUTHENTIK_POSTGRESQL__HOST=postgresql
      - AUTHENTIK_POSTGRESQL__NAME=${PG_DB:-authentik}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${PG_PASS}
      - AUTHENTIK_POSTGRESQL__USER=${PG_USER:-authentik}
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY:?secret key required}
    ports:
      - "${AUTHENTIK_PORT_HTTP:-9000}:9000"
      - "${AUTHENTIK_PORT_HTTPS:-9443}:9443"
    networks:
      - proxy
      - internal
    depends_on:
      - postgresql
    command: server

  worker:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.1}
    restart: ${AUTHENTIK_RESTART:-unless-stopped}
    volumes:
      - ${VOL_PATH:-/data}/authentik/media:/media
      - ${VOL_PATH:-/data}/authentik/certs:/certs
      - ${VOL_PATH:-/data}/authentik/custom-templates:/templates
    environment:
      - AUTHENTIK_POSTGRESQL__HOST=postgresql
      - AUTHENTIK_POSTGRESQL__NAME=${PG_DB:-authentik}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${PG_PASS}
      - AUTHENTIK_POSTGRESQL__USER=${PG_USER:-authentik}
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY:?secret key required}
    networks:
      - internal
    depends_on:
      - postgresql
    command: worker

networks:
  proxy:
    external: true
  internal: