wulf-ansible/playbooks/authentik.yml

- name: Deploy Authentik Stack
  hosts: authentik
  become: yes
  vars:
    stack_dir: /opt/stacks/authentik
    authentik_tag: "2025.8.1"
  tasks:
    - name: Check if .env already exists
      ansible.builtin.stat:
        path: "{{ stack_dir }}/.env"
      register: env_file

    - name: Generate passwords (only if .env doesn't exist)
      ansible.builtin.set_fact:
        pg_pass: "{{ lookup('ansible.builtin.password', '/dev/null', length=32, chars=['ascii_letters', 'digits']) }}"
        authentik_secret_key: "{{ lookup('ansible.builtin.password', '/dev/null', length=50, chars=['ascii_letters', 'digits']) }}"
      when: not env_file.stat.exists

    - name: Create stack directory
      ansible.builtin.file:
        path: "{{ stack_dir }}"
        state: directory
        mode: '0755'
        recurse: yes

    - name: Write .env file (only if it didn't exist)
      ansible.builtin.copy:
        dest: "{{ stack_dir }}/.env"
        mode: '0600'
        content: |
          # =========================
          # Postgres Configuration
          # =========================
          PG_USER=authentik
          PG_PASS={{ pg_pass }}
          PG_DB=authentik

          # =========================
          # Authentik Configuration
          # =========================
          AUTHENTIK_SECRET_KEY={{ authentik_secret_key }}
          AUTHENTIK_TAG={{ authentik_tag }}
      when: not env_file.stat.exists

    - name: Ensure pangolin network exists
      community.docker.docker_network:
        name: pangolin
        state: present

    - name: Deploy compose.yml
      ansible.builtin.copy:
        dest: "{{ stack_dir }}/compose.yml"
        content: |
          services:
            authentik-db:
              container_name: authentik-db
              image: docker.io/library/postgres:16-alpine
              restart: unless-stopped
              healthcheck:
                test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
                start_period: 20s
                interval: 30s
                retries: 5
                timeout: 5s
              volumes:
                - authentik-db-data:/var/lib/postgresql/data
              environment:
                POSTGRES_PASSWORD: ${PG_PASS}
                POSTGRES_USER: ${PG_USER:-authentik}
                POSTGRES_DB: ${PG_DB:-authentik}
              env_file:
                - .env
              networks:
                - backend

            authentik-redis:
              container_name: authentik-redis
              image: docker.io/library/redis:alpine
              command: --save 60 1 --loglevel warning
              restart: unless-stopped
              healthcheck:
                test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
                start_period: 20s
                interval: 30s
                retries: 5
                timeout: 3s
              volumes:
                - authentik-redis-data:/data
              networks:
                - backend

            authentik:
              container_name: authentik
              image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2025.8.1}
              restart: unless-stopped
              command: server
              environment:
                AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
                AUTHENTIK_REDIS__HOST: authentik-redis
                AUTHENTIK_POSTGRESQL__HOST: authentik-db
                AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
                AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
                AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
              volumes:
                - authentik-media:/media
                - authentik-templates:/templates
              env_file:
                - .env
              depends_on:
                authentik-db:
                  condition: service_healthy
                authentik-redis:
                  condition: service_healthy
              networks:
                - backend
                - pangolin
              expose:
                - "9000"

            authentik-worker:
              container_name: authentik-worker
              image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2025.8.1}
              restart: unless-stopped
              command: worker
              user: root
              environment:
                AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
                AUTHENTIK_REDIS__HOST: authentik-redis
                AUTHENTIK_POSTGRESQL__HOST: authentik-db
                AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
                AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
                AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
              volumes:
                - /var/run/docker.sock:/var/run/docker.sock
                - authentik-media:/media
                - authentik-certs:/certs
                - authentik-templates:/templates
              env_file:
                - .env
              depends_on:
                authentik-db:
                  condition: service_healthy
                authentik-redis:
                  condition: service_healthy
              networks:
                - backend

          volumes:
            authentik-db-data:
            authentik-redis-data:
            authentik-media:
            authentik-certs:
            authentik-templates:

          networks:
            backend:
              driver: bridge
            pangolin:
              external: true

    - name: Pull images
      community.docker.docker_compose_v2_pull:
        project_src: "{{ stack_dir }}"

    - name: Deploy stack
      community.docker.docker_compose_v2:
        project_src: "{{ stack_dir }}"
        state: present