deployment mc & drasl

.gitignore

@@ -0,0 +1,4 @@
+core/certs/*.key
+core/certs/*.crt
+
+domains/stvnliu.me/vault/data

core/certs/alphamill.gr.crt

@@ -1,19 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDEzCCAfugAwIBAgIUUW/xlTVdPARWwtiddkINl6HE4jcwDQYJKoZIhvcNAQEL
-BQAwGTEXMBUGA1UEAwwOKi5hbHBoYW1pbGwuZ3IwHhcNMjYxMDE4MTUyNjI3WhcN
-MjcxMDE4MTUyNjI3WjAZMRcwFQYDVQQDDA4qLmFscGhhbWlsbC5ncjCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBANZ3yCtprx4AsOsvpOPq/kK39sLo6oO/
-Fi+Bv/iOSKt03+xKzBhEnjubGMx6qy0jeCpEEfW2jyjXUywG8szzRcp/NbHewthn
-58dU4ca3hwXvEvW0iErxawlt7MXcFI5biDaoycbNfL7ovxxvLGeKsL60ND15uSyx
-ugfnlQx+c+YfMVh0PKHZ/8LTz/hTMklJc87yT/BH1V/Vs7xjUORbDPfurC2JqeG6
-QZAKk/ew8JrSwJkzHGh5BHnzT8ZjePXUzvD2allWYA5bn3+v/UYc3rvo1WnnmZWz
-V7XddJ49mTepVjc5YaL1OW15aMMV8fCYVh4mSiu8/MxzrMHU6Ff/nckCAwEAAaNT
-MFEwHQYDVR0OBBYEFOkzSEYt2sC2zm7EqiADyzm48qkuMB8GA1UdIwQYMBaAFOkz
-SEYt2sC2zm7EqiADyzm48qkuMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
-BQADggEBAA7IZIgYAFoA2ynG5zd+kqUSxvkzZNeYNZQYQ6JbiraylfPLOa04BKKO
-05dV+k3YXe1GoXuI9/23SWfFTrtGWxBfvKxhv2CsUHBf3AEYfI9x2pYg1uuutM/5
-o4HTfbej6Pd4CGdGBtSc4BDf7sz4UVNL+nBi6AUts+Ft0fsBPyvbThAC/H7VHIKk
-9ibhh4kOmsj3+yZ+GlAGoM/blSXz84nmXGVGAnG4K57PyHhswMrT/sxgAwnAgYVW
-R59eUBDnITNB5QHYuX2vsVMlue5UU5Dzi0/crGnKTFTBHOZOjb2cdUN4oibgv+oH
-r/5MxWtX0dqXJMam6bhjIVmqDSk3B3E=
------END CERTIFICATE-----

core/certs/alphamill.gr.key

@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDWd8graa8eALDr
-L6Tj6v5Ct/bC6OqDvxYvgb/4jkirdN/sSswYRJ47mxjMeqstI3gqRBH1to8o11Ms
-BvLM80XKfzWx3sLYZ+fHVOHGt4cF7xL1tIhK8WsJbezF3BSOW4g2qMnGzXy+6L8c
-byxnirC+tDQ9ebkssboH55UMfnPmHzFYdDyh2f/C08/4UzJJSXPO8k/wR9Vf1bO8
-Y1DkWwz37qwtianhukGQCpP3sPCa0sCZMxxoeQR580/GY3j11M7w9mpZVmAOW59/
-r/1GHN676NVp55mVs1e13XSePZk3qVY3OWGi9TlteWjDFfHwmFYeJkorvPzMc6zB
-1OhX/53JAgMBAAECggEAZ06WiLblKBYcIoW2LyVkaZ30ysloIaMbnDGrV56uCY0I
-Selzq2LuN3cLuH+EUf9qZC2a2xmflwQ1p5kHPssWPKcPJclQYO6YGo/cG50O+MBD
-CUD3f+YPcaDWMy7CZhpYIEAoxc74vnsdh6RTpuKLJalnGo+2L33Cxwj55mVJDbjp
-/QnW4o33ncVX2MItZ2FuuNdTz1L7klOAd8bsxpNm0sytyGxoYw1UBOw6tCNyhuvl
-cgFL856AAdcUVFvJ1pRr9t3W7cfL0ZevuXstCyMpLnZURR15mRKSNqftigJ19F21
-fsjx3Cyy4nc6o0MsA4I84hsUIikw5orn37MZuG/ciwKBgQDwKnRaJlEl5S/X111J
-Bqadzk8H21cCYm4xmoNcOlzwCxF18ZDrrbactkSnbtFuzpIvRUM8mbOuChyHdGSr
-ltNPxFC9uUVQ2JodTmoRvzq4azrA1GbKHOCYV2VmDXOLK0hl69peE40McYRyScKZ
-svXuoRFVFyRAFIdTrWiANBl5nwKBgQDkm5hBhVw5UapUgGQnBD57XsRF8qPNa5f0
-i3zhGrHm8qJGx9LuPT63RvKCFZTLU46tktO9PPxD6poHqbWKcAeBZN7xt0gpYTfI
-7+Rt4dP+AbLreFT0DpGxJ9GkstL/8YwsvdbTBlaS6tp039qGepL5GOhKAwRZBjZk
-HJgGCX1/lwKBgA3vuL6+eHkFeqhAxBYHv8VqgmWHUd4+jfxs5fCFJn17dvDsKqey
-deVUIlnA8YBHlm4Ny+AJX0bbKVqm42ydnPeFAdZwmNgfKZpHwZn0CdlHx6oG6UwT
-LulIMQciArFxuorHi+1nnwi40aG8LAG1Q9YsHJBefmkFh/DQID9IRq4rAoGACC0o
-fO9wJPyuwub0rhCQy4jQLFBJW4eFn9F9Xe++fSwgcbej67F1FMkM02pCMCOE7uBZ
-gmM0ApnZeHyxaYooOpCJCMwtYI2BmUY7PVLeai9VXuam4zPCMjviW6mpsk3JXbBM
-hq+rWQXdWmDHSBgKOa6SYFNLTIPUXjBHn6+nNXECgYA2jpehlffbCsaYJogtX9Sd
-8iK/OhB2En9a4BucNhJOnRLNsu3UPz6EzqneUmsWXKntEyCQL4Yrj9NqEb2M04hg
-pZAj+yftI/roW5zLJHs0AaGI5Fhpk5ntYmX46/WVJFyT+oCHsEIfeV7Q+CqMGoAb
-SDR+QrzdJmpTZyaBsVDykw==
------END PRIVATE KEY-----

core/certs/stvnliu.me.crt

@@ -1,19 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDEzCCAfugAwIBAgIUZYEMkLS+uh5XVPt7P36SR0W12aowDQYJKoZIhvcNAQEL
-BQAwGTEXMBUGA1UEAwwOKi5hbHBoYW1pbGwuZ3IwHhcNMjYxMDE4MTUyNjM5WhcN
-MjcxMDE4MTUyNjM5WjAZMRcwFQYDVQQDDA4qLmFscGhhbWlsbC5ncjCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBALz/WA6xxxJlZO3ohLhrTXC40BGvl/vv
-YKw3CO8kMRFLOgNaFsNq9O6J1E3ZRz6TnGOt/ueoDqFuWhggw0cbmLYlTonCznv+
-vYoLY5oV2ydyH0gqtrSl4aGWGdqmybp2GpK6rk07OR2coUw02H71pyNLwW9u6Axr
-Dk3eEiRB76BCsxkolF/sebPen2GXavtp4WI2YOc6ULLzxfVjCOkQUP1/ibh548MT
-gQcj9KAxEhzBe5qYAuCpBpQOkgy3htxCO+rYNN175D5nOKnK4Adr+HbA+trK/42v
-Rs2/PsWx1ekvrhwroMRWy0slqJu7Nb0eBnV7WE7aMD6x/pmFn4FQkUcCAwEAAaNT
-MFEwHQYDVR0OBBYEFGY6PsNoWnm2v9Lb4dmo9Nbxf88AMB8GA1UdIwQYMBaAFGY6
-PsNoWnm2v9Lb4dmo9Nbxf88AMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
-BQADggEBAK1ENKIODGfo+igRm64wzisSW9hw3qG/mTMI7N2kMeKRsGz0K7e/Onal
-NXeW7NC3bZMHm6I5DfXHaILUSB+VZ2EuiD6R4kZ4dUANVZ1CTYpij46J/HdbSNoa
-YFoJKizIr2W80KHEYRd4z6OCkvBH3seT1Brvko1Vq6v2xJHPnXDHhqgsgtPJ/luv
-gCfSo8CXdtzGhTDORJnC5eT+fHSRed+1a0Q3QwArQ2rx3VSmIr3plyG+LTn78mKR
-oAkUfZnc7+MWCPioFqLIuYqj/I84MKkFKbIu/Xo/bxQ7iy+eRqE17UDJEnA1BFkb
-azwwLE3fNCu7wnwBXJPQ5k91MCkvHdQ=
------END CERTIFICATE-----

core/certs/stvnliu.me.key

@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC8/1gOsccSZWTt
-6IS4a01wuNARr5f772CsNwjvJDERSzoDWhbDavTuidRN2Uc+k5xjrf7nqA6hbloY
-IMNHG5i2JU6Jws57/r2KC2OaFdsnch9IKra0peGhlhnapsm6dhqSuq5NOzkdnKFM
-NNh+9acjS8FvbugMaw5N3hIkQe+gQrMZKJRf7Hmz3p9hl2r7aeFiNmDnOlCy88X1
-YwjpEFD9f4m4eePDE4EHI/SgMRIcwXuamALgqQaUDpIMt4bcQjvq2DTde+Q+Zzip
-yuAHa/h2wPrayv+Nr0bNvz7FsdXpL64cK6DEVstLJaibuzW9HgZ1e1hO2jA+sf6Z
-hZ+BUJFHAgMBAAECggEACpVqAvilozwWWNRKimFH5uYSkMr6gds32K0ETRADx2ol
-B4cF+0+EA8+oGevu92wgt9xIiAR7PUMGvI8pIFRFSv3v1fsYwQzU5GQa4cgTi7Py
-WII71QXtCrVzITFx3oU6m7jkheKpIiVhSvkynnl3MJzPakQVroxYMrga3/jpSFob
-H1cVlQ4KHeK6epEFNbMnXQFn5GHF5tyCc3br7quwGuGWlsZ/TfpLvqnqQQcdRkdT
-FbdSdjTQnITaE0Uryo/9N04+lq7qmbBqjAokiMME7uGQQRrtBm5HGmmIuQesr0UX
-aIdamc3be0/PDS9rDn5Jh+gUGV0uiJFRkHV1hl3/gQKBgQDvuu4fsvgDUcQ79wBD
-8HNIYlWwzUoXnxRiy9aqvm2sg3BMo+o+mPnugY+5auzft10S5VcSD9E55KzPUM4K
-j5uDZYioxztqJAlLZqTDmW43OnujuVgG3bD6kWySJi9WK7bXeb9RwHimBsJPAwV3
-O1JkGD1JSOqIetoLqV1PqpHl4QKBgQDJ0vvAa2lt4Nu5H9kn+BqoDjGKctRNH2xX
-BtqsvSWWfHPcp2ON+QU5KzNY/1H8uiwXcN2Y9Sp4vy8Tx9Kr5AjPuoBiB6NMuFw8
-eM/aqFZdWoKBfrLbkynbdrulVElR6kUsLiiRV0MzRqtzedh3FZTx3wN222+XvShM
-Gajw2FAMJwKBgDwDGZVJ4hhCodM5FBHt4Y4fP8BQw9mB80KAMK7xmNb02Gn3Jq6g
-8QAp4ubRw5aFeoE+dDuLRh8uBayoV8wBAzczdbB6n38EomcDvP9SK2sb8tOblFOz
-r5gqS3mSoYr6ynzKd4BppEo7quzInteoPAnen4j2/e9IgckljrxgwMFBAoGBAIFj
-4kLamhz3q+ZjpLUbOvvDHb/FHpbTLoIcwtU77n0sDJvKNOkwXUjpiWHlTorYUKw2
-j9sgUrpW17e2xDmvWHbU+rnea7Mj/v5F9fwZMEVpYYHj2IctMgihdmvoPZlmuDI6
-5YdIiqy1AfZmh4DRNUxbzbzFsiV1///J86V1CNzBAoGBAKUDJVMbiVqCb7U5Petv
-PaSCm93hGB5yJz92szi+cpY9ro2/j4lnT2KZT7bYpHwr7Q9Us9X4cQJvwV3WVCtW
-PYgAf67ydaF0o8SJTk0fomMlTEKW/qW/NmicJFAnwtzd/EaO8KRB7yTE46rK0Dbn
-NgSSDbNgg56z0/Vibeq1jSyb
------END PRIVATE KEY-----

core/docker-compose.yml

@@ -4,18 +4,24 @@ services:
     container_name: traefik
     image: traefik:v3.7
     command:
-      - "--api.insecure=true"
+      - "--api=true"
+      - "--tracing=true"
       - "--providers.docker=true"
-      - "--providers.file.directory=/etc/traefik/apps"
-      - "--providers.file.watch=true"
+      - "--providers.docker.exposedByDefault=false"
+      - "--providers.file.directory=/etc/traefik/dynamic"
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--entrypoints.minecraft.address=:25565/tcp"
       - "--entrypoints.websecure.http.tls=true"
-      - "--log.level=DEBUG"
+      - "--log.level=INFO"
       - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
       - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
       - "--entrypoints.web.http.redirections.entrypoint.permanent=true"
+      - "--entrypoints.websecure.asDefault=true"
+      - "--entrypoints.websecure.http.tls.domains[0].main=alphamill.gr"
+      - "--entrypoints.websecure.http.tls.domains[0].sans=*.alphamill.gr"
+      - "--entrypoints.websecure.http.tls.domains[1].main=stvnliu.me"
+      - "--entrypoints.websecure.http.tls.domains[1].sans=*.stvnliu.me"
     security_opt:
       - no-new-privileges:true
     ports:
@@ -26,7 +32,12 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./certs:/certs:ro
       - ./dynamic:/etc/traefik/dynamic:ro
-      - /srv/docker:/etc/traefik/apps:ro
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.dashboard.rule=Host(`traefik.stvnliu.me`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
+      - "traefik.http.routers.dashboard.service=api@internal"
+      - "traefik.http.routers.dashboard.middlewares=auth"
+      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$UTCvF4Ic$$.S6iKW534mXL70ndt3L/P1"
     networks:
       - proxy_net
 

core/dynamic/tls.yml

@@ -1,6 +1,6 @@
 tls:
   certificates:
-    - certFile: /certs/alphamill.gr.cert
-      keyFile: /certs/alphamill.gr.key
-    - certFile: /certs/stvnliu.me.cert
+    - certFile: /certs/alphamill.gr.crt
       keyFile: /certs/alphamill.gr.key
+    - certFile: /certs/stvnliu.me.crt
+      keyFile: /certs/stvnliu.me.key

docker-compose.yml

@@ -3,7 +3,7 @@ include:
   - ./core/docker-compose.yml
   
   # stvnliu.me project compose file
-  # - ./domains/stvnliu.me/docker-compose.yml
+  - ./domains/stvnliu.me/docker-compose.yml
   
   # alphamill.gr project compose file
   - ./domains/alphamill.gr/docker-compose.yml

domains/alphamill.gr/mail/docker-compose.yml

@@ -27,4 +27,6 @@ services:
       - ROUNDCUBEMAIL_PLUGINS=carddav, globaladdressbook
     labels:
       - traefik.enable=true
+      - traefik.http.routers.webmail.tls=true
+      - traefik.http.routers.webmail.entrypoints=websecure
       - traefik.http.routers.webmail.rule=Host(`webmail.alphamill.gr`)

domains/alphamill.gr/site/docker-compose.yml

@@ -12,6 +12,7 @@ services:
     networks:
       - proxy_net
     labels:
+      - traefik.enable=true
       - traefik.http.routers.alphamill-site-container.rule=Host(`alphamill.gr`)
       - traefik.http.services.alphamill-site-service.loadbalancer.server.port=3000
       # ports:

domains/stvnliu.me/caldav/.gitignore

@@ -0,0 +1,2 @@
+config/
+data/

domains/stvnliu.me/caldav/docker-compose.yml

@@ -0,0 +1,37 @@
+networks:
+  proxy_net:
+    name: "proxy-net"
+    external: true
+services:
+  caldav:
+    image: tomsquest/docker-radicale
+    container_name: caldav-stvnliu-me
+    networks:
+      - proxy_net
+    init: true
+    read_only: false
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - SETUID
+      - SETGID
+      - CHOWN
+      - KILL
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+          pids: 50
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.radicale.rule=Host(`cal.stvnliu.me`) && PathPrefix(`/radicale/`)"
+      - "traefik.http.routers.radicale.entrypoints=websecure"
+      - "traefik.http.services.radicale.loadbalancer.server.port=5232"
+      - "traefik.http.middlewares.radicale-scriptname.headers.customrequestheaders.X-Script-Name=/radicale"
+      - "traefik.http.routers.radicale.middlewares=radicale-scriptname"
+    restart: unless-stopped
+    volumes:
+      - ./data:/data
+      - ./config:/config:ro

domains/stvnliu.me/docker-compose.yml

@@ -0,0 +1,6 @@
+include:
+  - path: ./vault/docker-compose.yml
+  - path: ./git/docker-compose.yml
+  - path: ./sso/docker-compose.yml
+  - path: ./caldav/docker-compose.yml
+  - path: ./mc/docker-compose.yml

domains/stvnliu.me/git/.gitignore

@@ -0,0 +1,3 @@
+git
+gitea
+ssh

domains/stvnliu.me/git/docker-compose.yml

@@ -0,0 +1,27 @@
+networks:
+  proxy_net:
+    external: true
+services:
+  forgejo-server:
+    image: codeberg.org/forgejo/forgejo:17
+    container_name: forgejo
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+    restart: always
+    networks:
+      - proxy_net
+    volumes:
+      - .:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - '2222:22'
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.git-stvnliu-me.tls=true
+      - traefik.http.routers.git-stvnliu-me.entrypoints=websecure
+      - traefik.http.routers.git-stvnliu-me.rule=Host(`stvnliu.me`) && PathPrefix(`/git`)
+      - "traefik.http.middlewares.forgejo-strip.stripprefix.prefixes=/git"
+      - "traefik.http.routers.git-stvnliu-me.middlewares=forgejo-strip"
+      - traefik.http.services.git-stvnliu-me.loadbalancer.server.port=3000

domains/stvnliu.me/mc/.gitignore

@@ -0,0 +1,3 @@
+data/
+drasl/data/
+drasl/config/

domains/stvnliu.me/mc/docker-compose.yml

@@ -1,4 +1,8 @@
-includes:
+networks:
+  proxy_net:
+    name: "proxy-net"
+    external: true
+include:
   - path: ./drasl/docker-compose.yml
 services:
   minecraft:
@@ -7,8 +11,7 @@ services:
     tty: true
     stdin_open: true
     networks:
-      - minecraft
-      - proxy
+      - proxy_net
     environment:
       EULA: "TRUE"
       VERSION: 26.3
@@ -16,3 +19,8 @@ services:
       JVM_OPTS: "-Dminecraft.api.env=custom -Dminecraft.api.auth.host=https://drasl.stvnliu.me/auth -Dminecraft.api.account.host=https://drasl.stvnliu.me/account -Dminecraft.api.profiles.host=https://drasl.stvnliu.me/account -Dminecraft.api.session.host=https://drasl.stvnliu.me/session -Dminecraft.api.services.host=https://drasl.stvnliu.me/services -Dminecraft.api.discovery.host=https://drasl.stvnliu.me/discovery/minecraft/client"
     volumes:
         - ./data:/data
+    labels:
+      - traefik.enable=true
+      - traefik.tcp.routers.mc.rule=HostSNI(`*`)
+      - traefik.tcp.routers.mc.entrypoints=minecraft
+      - traefik.tcp.services.mc.loadbalancer.server.port=25565

domains/stvnliu.me/mc/drasl/docker-compose.yml

@@ -1,14 +1,18 @@
 networks:
-  default_net:
-    - external: true
-  minecraft_net:
-    - external: true
+  proxy_net:
+    name: "proxy-net"
+    external: true
 services:
   drasl:
     image: unmojang/drasl
     networks:
-      - default_net
-      - minecraft_net
+      - proxy_net
     volumes:
       - ./config:/etc/drasl
-      - ./data: /var/lib/drasl
+      - ./data:/var/lib/drasl
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.drasl-stvnliu-me.tls=true
+      - traefik.http.routers.drasl-stvnliu-me.entrypoints=websecure
+      - traefik.http.routers.drasl-stvnliu-me.rule=Host(`drasl.stvnliu.me`)
+      - traefik.http.services.drasl-stvnliu-me.loadbalancer.server.port=25585

domains/stvnliu.me/sso/.gitignore

@@ -0,0 +1 @@
+.env

domains/stvnliu.me/sso/docker-compose.yml

@@ -0,0 +1,91 @@
+services:
+  authentik-postgresql:
+    container_name: authentik_pgsql
+    env_file:
+    - .env
+    environment:
+      POSTGRES_DB: ${PG_DB:-authentik}
+      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
+      POSTGRES_USER: ${PG_USER:-authentik}
+    networks:
+      - authentik_net
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+      - CMD-SHELL
+      - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 5s
+    image: docker.io/library/postgres:16-alpine
+    restart: unless-stopped
+    volumes:
+    - database:/var/lib/postgresql/data
+  authentik-server:
+    container_name: authentik_server
+    command: server
+    depends_on:
+      authentik-postgresql:
+        condition: service_healthy
+    env_file:
+    - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: authentik-postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.8.4}
+    networks:
+      - authentik_net
+      - proxy_net
+      # ports:
+      # - ${COMPOSE_PORT_HTTP:-9000}:9000
+      # - ${COMPOSE_PORT_HTTPS:-9443}:9443
+    restart: unless-stopped
+    shm_size: 512mb
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=proxy-net
+      - traefik.http.routers.authentik-stvnliu-me.tls=true
+      - traefik.http.routers.authentik-stvnliu-me.entrypoints=websecure
+      - traefik.http.routers.authentik-stvnliu-me.rule=Host(`sso.stvnliu.me`)
+      - traefik.http.services.authentik-stvnliu-me.loadbalancer.server.port=9000
+    volumes:
+    - ./data:/data
+    - ./custom-templates:/templates
+  authentik-worker:
+    container_name: authentik_worker
+    command: worker
+    depends_on:
+      authentik-postgresql:
+        condition: service_healthy
+    env_file:
+      - .env
+    networks:
+      - authentik_net
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: authentik-postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.8.4}
+    restart: unless-stopped
+    shm_size: 512mb
+    user: root
+    volumes:
+    - /var/run/docker.sock:/var/run/docker.sock
+    - ./data:/data
+    - ./certs:/certs
+    - ./custom-templates:/templates
+volumes:
+  database:
+    driver: local
+networks:
+  authentik_net:
+    external: false
+    driver: bridge
+  proxy_net:
+    name: "proxy-net"
+    external: true