From 1d1179c00937ee981aa2cc6f1a400b0f516588fe Mon Sep 17 00:00:00 2001
From: lorentz <lorentz@wulfconsulting.com>
Date: Sun, 8 Mar 2026 20:36:14 -0400
Subject: [PATCH] Add playbooks/authentik.yml

---
 playbooks/authentik.yml | 168 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 168 insertions(+)
 create mode 100644 playbooks/authentik.yml

diff --git a/playbooks/authentik.yml b/playbooks/authentik.yml
new file mode 100644
index 0000000..4376463
--- /dev/null
+++ b/playbooks/authentik.yml
@@ -0,0 +1,168 @@
+- name: Deploy Authentik Stack
+  hosts: authentik
+  become: yes
+  vars:
+    stack_dir: /opt/stacks/authentik
+    authentik_tag: "2025.8.1"
+  tasks:
+    - name: Check if .env already exists
+      ansible.builtin.stat:
+        path: "{{ stack_dir }}/.env"
+      register: env_file
+
+    - name: Generate passwords (only if .env doesn't exist)
+      ansible.builtin.set_fact:
+        pg_pass: "{{ lookup('ansible.builtin.password', '/dev/null', length=32, chars=['ascii_letters', 'digits']) }}"
+        authentik_secret_key: "{{ lookup('ansible.builtin.password', '/dev/null', length=50, chars=['ascii_letters', 'digits']) }}"
+      when: not env_file.stat.exists
+
+    - name: Create stack directory
+      ansible.builtin.file:
+        path: "{{ stack_dir }}"
+        state: directory
+        mode: '0755'
+        recurse: yes
+
+    - name: Write .env file (only if it didn't exist)
+      ansible.builtin.copy:
+        dest: "{{ stack_dir }}/.env"
+        mode: '0600'
+        content: |
+          # =========================
+          # Postgres Configuration
+          # =========================
+          PG_USER=authentik
+          PG_PASS={{ pg_pass }}
+          PG_DB=authentik
+
+          # =========================
+          # Authentik Configuration
+          # =========================
+          AUTHENTIK_SECRET_KEY={{ authentik_secret_key }}
+          AUTHENTIK_TAG={{ authentik_tag }}
+      when: not env_file.stat.exists
+
+    - name: Ensure pangolin network exists
+      community.docker.docker_network:
+        name: pangolin
+        state: present
+
+    - name: Deploy compose.yml
+      ansible.builtin.copy:
+        dest: "{{ stack_dir }}/compose.yml"
+        content: |
+          services:
+            authentik-db:
+              container_name: authentik-db
+              image: docker.io/library/postgres:16-alpine
+              restart: unless-stopped
+              healthcheck:
+                test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
+                start_period: 20s
+                interval: 30s
+                retries: 5
+                timeout: 5s
+              volumes:
+                - authentik-db-data:/var/lib/postgresql/data
+              environment:
+                POSTGRES_PASSWORD: ${PG_PASS}
+                POSTGRES_USER: ${PG_USER:-authentik}
+                POSTGRES_DB: ${PG_DB:-authentik}
+              env_file:
+                - .env
+              networks:
+                - backend
+
+            authentik-redis:
+              container_name: authentik-redis
+              image: docker.io/library/redis:alpine
+              command: --save 60 1 --loglevel warning
+              restart: unless-stopped
+              healthcheck:
+                test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
+                start_period: 20s
+                interval: 30s
+                retries: 5
+                timeout: 3s
+              volumes:
+                - authentik-redis-data:/data
+              networks:
+                - backend
+
+            authentik:
+              container_name: authentik
+              image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2025.8.1}
+              restart: unless-stopped
+              command: server
+              environment:
+                AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
+                AUTHENTIK_REDIS__HOST: authentik-redis
+                AUTHENTIK_POSTGRESQL__HOST: authentik-db
+                AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+                AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+                AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+              volumes:
+                - authentik-media:/media
+                - authentik-templates:/templates
+              env_file:
+                - .env
+              depends_on:
+                authentik-db:
+                  condition: service_healthy
+                authentik-redis:
+                  condition: service_healthy
+              networks:
+                - backend
+                - pangolin
+              expose:
+                - "9000"
+
+            authentik-worker:
+              container_name: authentik-worker
+              image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2025.8.1}
+              restart: unless-stopped
+              command: worker
+              user: root
+              environment:
+                AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
+                AUTHENTIK_REDIS__HOST: authentik-redis
+                AUTHENTIK_POSTGRESQL__HOST: authentik-db
+                AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+                AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+                AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+              volumes:
+                - /var/run/docker.sock:/var/run/docker.sock
+                - authentik-media:/media
+                - authentik-certs:/certs
+                - authentik-templates:/templates
+              env_file:
+                - .env
+              depends_on:
+                authentik-db:
+                  condition: service_healthy
+                authentik-redis:
+                  condition: service_healthy
+              networks:
+                - backend
+
+          volumes:
+            authentik-db-data:
+            authentik-redis-data:
+            authentik-media:
+            authentik-certs:
+            authentik-templates:
+
+          networks:
+            backend:
+              driver: bridge
+            pangolin:
+              external: true
+
+    - name: Pull images
+      community.docker.docker_compose_v2_pull:
+        project_src: "{{ stack_dir }}"
+
+    - name: Deploy stack
+      community.docker.docker_compose_v2:
+        project_src: "{{ stack_dir }}"
+        state: present
\ No newline at end of file