.gitignore

@@ -1,4 +0,0 @@
-core/certs/*.key
-core/certs/*.crt
-
-domains/stvnliu.me/vault/data

core/certs/alphamill.gr.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDEzCCAfugAwIBAgIUUW/xlTVdPARWwtiddkINl6HE4jcwDQYJKoZIhvcNAQEL
+BQAwGTEXMBUGA1UEAwwOKi5hbHBoYW1pbGwuZ3IwHhcNMjYxMDE4MTUyNjI3WhcN
+MjcxMDE4MTUyNjI3WjAZMRcwFQYDVQQDDA4qLmFscGhhbWlsbC5ncjCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBANZ3yCtprx4AsOsvpOPq/kK39sLo6oO/
+Fi+Bv/iOSKt03+xKzBhEnjubGMx6qy0jeCpEEfW2jyjXUywG8szzRcp/NbHewthn
+58dU4ca3hwXvEvW0iErxawlt7MXcFI5biDaoycbNfL7ovxxvLGeKsL60ND15uSyx
+ugfnlQx+c+YfMVh0PKHZ/8LTz/hTMklJc87yT/BH1V/Vs7xjUORbDPfurC2JqeG6
+QZAKk/ew8JrSwJkzHGh5BHnzT8ZjePXUzvD2allWYA5bn3+v/UYc3rvo1WnnmZWz
+V7XddJ49mTepVjc5YaL1OW15aMMV8fCYVh4mSiu8/MxzrMHU6Ff/nckCAwEAAaNT
+MFEwHQYDVR0OBBYEFOkzSEYt2sC2zm7EqiADyzm48qkuMB8GA1UdIwQYMBaAFOkz
+SEYt2sC2zm7EqiADyzm48qkuMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
+BQADggEBAA7IZIgYAFoA2ynG5zd+kqUSxvkzZNeYNZQYQ6JbiraylfPLOa04BKKO
+05dV+k3YXe1GoXuI9/23SWfFTrtGWxBfvKxhv2CsUHBf3AEYfI9x2pYg1uuutM/5
+o4HTfbej6Pd4CGdGBtSc4BDf7sz4UVNL+nBi6AUts+Ft0fsBPyvbThAC/H7VHIKk
+9ibhh4kOmsj3+yZ+GlAGoM/blSXz84nmXGVGAnG4K57PyHhswMrT/sxgAwnAgYVW
+R59eUBDnITNB5QHYuX2vsVMlue5UU5Dzi0/crGnKTFTBHOZOjb2cdUN4oibgv+oH
+r/5MxWtX0dqXJMam6bhjIVmqDSk3B3E=
+-----END CERTIFICATE-----

core/certs/alphamill.gr.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDWd8graa8eALDr
+L6Tj6v5Ct/bC6OqDvxYvgb/4jkirdN/sSswYRJ47mxjMeqstI3gqRBH1to8o11Ms
+BvLM80XKfzWx3sLYZ+fHVOHGt4cF7xL1tIhK8WsJbezF3BSOW4g2qMnGzXy+6L8c
+byxnirC+tDQ9ebkssboH55UMfnPmHzFYdDyh2f/C08/4UzJJSXPO8k/wR9Vf1bO8
+Y1DkWwz37qwtianhukGQCpP3sPCa0sCZMxxoeQR580/GY3j11M7w9mpZVmAOW59/
+r/1GHN676NVp55mVs1e13XSePZk3qVY3OWGi9TlteWjDFfHwmFYeJkorvPzMc6zB
+1OhX/53JAgMBAAECggEAZ06WiLblKBYcIoW2LyVkaZ30ysloIaMbnDGrV56uCY0I
+Selzq2LuN3cLuH+EUf9qZC2a2xmflwQ1p5kHPssWPKcPJclQYO6YGo/cG50O+MBD
+CUD3f+YPcaDWMy7CZhpYIEAoxc74vnsdh6RTpuKLJalnGo+2L33Cxwj55mVJDbjp
+/QnW4o33ncVX2MItZ2FuuNdTz1L7klOAd8bsxpNm0sytyGxoYw1UBOw6tCNyhuvl
+cgFL856AAdcUVFvJ1pRr9t3W7cfL0ZevuXstCyMpLnZURR15mRKSNqftigJ19F21
+fsjx3Cyy4nc6o0MsA4I84hsUIikw5orn37MZuG/ciwKBgQDwKnRaJlEl5S/X111J
+Bqadzk8H21cCYm4xmoNcOlzwCxF18ZDrrbactkSnbtFuzpIvRUM8mbOuChyHdGSr
+ltNPxFC9uUVQ2JodTmoRvzq4azrA1GbKHOCYV2VmDXOLK0hl69peE40McYRyScKZ
+svXuoRFVFyRAFIdTrWiANBl5nwKBgQDkm5hBhVw5UapUgGQnBD57XsRF8qPNa5f0
+i3zhGrHm8qJGx9LuPT63RvKCFZTLU46tktO9PPxD6poHqbWKcAeBZN7xt0gpYTfI
+7+Rt4dP+AbLreFT0DpGxJ9GkstL/8YwsvdbTBlaS6tp039qGepL5GOhKAwRZBjZk
+HJgGCX1/lwKBgA3vuL6+eHkFeqhAxBYHv8VqgmWHUd4+jfxs5fCFJn17dvDsKqey
+deVUIlnA8YBHlm4Ny+AJX0bbKVqm42ydnPeFAdZwmNgfKZpHwZn0CdlHx6oG6UwT
+LulIMQciArFxuorHi+1nnwi40aG8LAG1Q9YsHJBefmkFh/DQID9IRq4rAoGACC0o
+fO9wJPyuwub0rhCQy4jQLFBJW4eFn9F9Xe++fSwgcbej67F1FMkM02pCMCOE7uBZ
+gmM0ApnZeHyxaYooOpCJCMwtYI2BmUY7PVLeai9VXuam4zPCMjviW6mpsk3JXbBM
+hq+rWQXdWmDHSBgKOa6SYFNLTIPUXjBHn6+nNXECgYA2jpehlffbCsaYJogtX9Sd
+8iK/OhB2En9a4BucNhJOnRLNsu3UPz6EzqneUmsWXKntEyCQL4Yrj9NqEb2M04hg
+pZAj+yftI/roW5zLJHs0AaGI5Fhpk5ntYmX46/WVJFyT+oCHsEIfeV7Q+CqMGoAb
+SDR+QrzdJmpTZyaBsVDykw==
+-----END PRIVATE KEY-----

core/certs/stvnliu.me.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDEzCCAfugAwIBAgIUZYEMkLS+uh5XVPt7P36SR0W12aowDQYJKoZIhvcNAQEL
+BQAwGTEXMBUGA1UEAwwOKi5hbHBoYW1pbGwuZ3IwHhcNMjYxMDE4MTUyNjM5WhcN
+MjcxMDE4MTUyNjM5WjAZMRcwFQYDVQQDDA4qLmFscGhhbWlsbC5ncjCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBALz/WA6xxxJlZO3ohLhrTXC40BGvl/vv
+YKw3CO8kMRFLOgNaFsNq9O6J1E3ZRz6TnGOt/ueoDqFuWhggw0cbmLYlTonCznv+
+vYoLY5oV2ydyH0gqtrSl4aGWGdqmybp2GpK6rk07OR2coUw02H71pyNLwW9u6Axr
+Dk3eEiRB76BCsxkolF/sebPen2GXavtp4WI2YOc6ULLzxfVjCOkQUP1/ibh548MT
+gQcj9KAxEhzBe5qYAuCpBpQOkgy3htxCO+rYNN175D5nOKnK4Adr+HbA+trK/42v
+Rs2/PsWx1ekvrhwroMRWy0slqJu7Nb0eBnV7WE7aMD6x/pmFn4FQkUcCAwEAAaNT
+MFEwHQYDVR0OBBYEFGY6PsNoWnm2v9Lb4dmo9Nbxf88AMB8GA1UdIwQYMBaAFGY6
+PsNoWnm2v9Lb4dmo9Nbxf88AMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
+BQADggEBAK1ENKIODGfo+igRm64wzisSW9hw3qG/mTMI7N2kMeKRsGz0K7e/Onal
+NXeW7NC3bZMHm6I5DfXHaILUSB+VZ2EuiD6R4kZ4dUANVZ1CTYpij46J/HdbSNoa
+YFoJKizIr2W80KHEYRd4z6OCkvBH3seT1Brvko1Vq6v2xJHPnXDHhqgsgtPJ/luv
+gCfSo8CXdtzGhTDORJnC5eT+fHSRed+1a0Q3QwArQ2rx3VSmIr3plyG+LTn78mKR
+oAkUfZnc7+MWCPioFqLIuYqj/I84MKkFKbIu/Xo/bxQ7iy+eRqE17UDJEnA1BFkb
+azwwLE3fNCu7wnwBXJPQ5k91MCkvHdQ=
+-----END CERTIFICATE-----

core/certs/stvnliu.me.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC8/1gOsccSZWTt
+6IS4a01wuNARr5f772CsNwjvJDERSzoDWhbDavTuidRN2Uc+k5xjrf7nqA6hbloY
+IMNHG5i2JU6Jws57/r2KC2OaFdsnch9IKra0peGhlhnapsm6dhqSuq5NOzkdnKFM
+NNh+9acjS8FvbugMaw5N3hIkQe+gQrMZKJRf7Hmz3p9hl2r7aeFiNmDnOlCy88X1
+YwjpEFD9f4m4eePDE4EHI/SgMRIcwXuamALgqQaUDpIMt4bcQjvq2DTde+Q+Zzip
+yuAHa/h2wPrayv+Nr0bNvz7FsdXpL64cK6DEVstLJaibuzW9HgZ1e1hO2jA+sf6Z
+hZ+BUJFHAgMBAAECggEACpVqAvilozwWWNRKimFH5uYSkMr6gds32K0ETRADx2ol
+B4cF+0+EA8+oGevu92wgt9xIiAR7PUMGvI8pIFRFSv3v1fsYwQzU5GQa4cgTi7Py
+WII71QXtCrVzITFx3oU6m7jkheKpIiVhSvkynnl3MJzPakQVroxYMrga3/jpSFob
+H1cVlQ4KHeK6epEFNbMnXQFn5GHF5tyCc3br7quwGuGWlsZ/TfpLvqnqQQcdRkdT
+FbdSdjTQnITaE0Uryo/9N04+lq7qmbBqjAokiMME7uGQQRrtBm5HGmmIuQesr0UX
+aIdamc3be0/PDS9rDn5Jh+gUGV0uiJFRkHV1hl3/gQKBgQDvuu4fsvgDUcQ79wBD
+8HNIYlWwzUoXnxRiy9aqvm2sg3BMo+o+mPnugY+5auzft10S5VcSD9E55KzPUM4K
+j5uDZYioxztqJAlLZqTDmW43OnujuVgG3bD6kWySJi9WK7bXeb9RwHimBsJPAwV3
+O1JkGD1JSOqIetoLqV1PqpHl4QKBgQDJ0vvAa2lt4Nu5H9kn+BqoDjGKctRNH2xX
+BtqsvSWWfHPcp2ON+QU5KzNY/1H8uiwXcN2Y9Sp4vy8Tx9Kr5AjPuoBiB6NMuFw8
+eM/aqFZdWoKBfrLbkynbdrulVElR6kUsLiiRV0MzRqtzedh3FZTx3wN222+XvShM
+Gajw2FAMJwKBgDwDGZVJ4hhCodM5FBHt4Y4fP8BQw9mB80KAMK7xmNb02Gn3Jq6g
+8QAp4ubRw5aFeoE+dDuLRh8uBayoV8wBAzczdbB6n38EomcDvP9SK2sb8tOblFOz
+r5gqS3mSoYr6ynzKd4BppEo7quzInteoPAnen4j2/e9IgckljrxgwMFBAoGBAIFj
+4kLamhz3q+ZjpLUbOvvDHb/FHpbTLoIcwtU77n0sDJvKNOkwXUjpiWHlTorYUKw2
+j9sgUrpW17e2xDmvWHbU+rnea7Mj/v5F9fwZMEVpYYHj2IctMgihdmvoPZlmuDI6
+5YdIiqy1AfZmh4DRNUxbzbzFsiV1///J86V1CNzBAoGBAKUDJVMbiVqCb7U5Petv
+PaSCm93hGB5yJz92szi+cpY9ro2/j4lnT2KZT7bYpHwr7Q9Us9X4cQJvwV3WVCtW
+PYgAf67ydaF0o8SJTk0fomMlTEKW/qW/NmicJFAnwtzd/EaO8KRB7yTE46rK0Dbn
+NgSSDbNgg56z0/Vibeq1jSyb
+-----END PRIVATE KEY-----

core/docker-compose.yml

@@ -4,24 +4,18 @@ services:
     container_name: traefik
     image: traefik:v3.7
     command:
-      - "--api=true"
+      - "--api.insecure=true"
-      - "--tracing=true"
       - "--providers.docker=true"
-      - "--providers.docker.exposedByDefault=false"
+      - "--providers.file.directory=/etc/traefik/apps"
-      - "--providers.file.directory=/etc/traefik/dynamic"
+      - "--providers.file.watch=true"
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--entrypoints.minecraft.address=:25565/tcp"
       - "--entrypoints.websecure.http.tls=true"
-      - "--log.level=INFO"
+      - "--log.level=DEBUG"
       - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
       - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
       - "--entrypoints.web.http.redirections.entrypoint.permanent=true"
-      - "--entrypoints.websecure.asDefault=true"
-      - "--entrypoints.websecure.http.tls.domains[0].main=alphamill.gr"
-      - "--entrypoints.websecure.http.tls.domains[0].sans=*.alphamill.gr"
-      - "--entrypoints.websecure.http.tls.domains[1].main=stvnliu.me"
-      - "--entrypoints.websecure.http.tls.domains[1].sans=*.stvnliu.me"
     security_opt:
       - no-new-privileges:true
     ports:
@@ -32,12 +26,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./certs:/certs:ro
       - ./dynamic:/etc/traefik/dynamic:ro
-    labels:
+      - /srv/docker:/etc/traefik/apps:ro
-      - "traefik.enable=true"
-      - "traefik.http.routers.dashboard.rule=Host(`traefik.stvnliu.me`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
-      - "traefik.http.routers.dashboard.service=api@internal"
-      - "traefik.http.routers.dashboard.middlewares=auth"
-      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$UTCvF4Ic$$.S6iKW534mXL70ndt3L/P1"
     networks:
       - proxy_net
 

core/dynamic/tls.yml

@@ -1,6 +1,6 @@
 tls:
   certificates:
-    - certFile: /certs/alphamill.gr.crt
+    - certFile: /certs/alphamill.gr.cert
+      keyFile: /certs/alphamill.gr.key
+    - certFile: /certs/stvnliu.me.cert
       keyFile: /certs/alphamill.gr.key
-    - certFile: /certs/stvnliu.me.crt
-      keyFile: /certs/stvnliu.me.key

docker-compose.yml

@@ -3,7 +3,7 @@ include:
   - ./core/docker-compose.yml
   
   # stvnliu.me project compose file
-  - ./domains/stvnliu.me/docker-compose.yml
+  # - ./domains/stvnliu.me/docker-compose.yml
   
   # alphamill.gr project compose file
   - ./domains/alphamill.gr/docker-compose.yml

domains/alphamill.gr/mail/docker-compose.yml

@@ -27,6 +27,4 @@ services:
       - ROUNDCUBEMAIL_PLUGINS=carddav, globaladdressbook
     labels:
       - traefik.enable=true
-      - traefik.http.routers.webmail.tls=true
-      - traefik.http.routers.webmail.entrypoints=websecure
       - traefik.http.routers.webmail.rule=Host(`webmail.alphamill.gr`)

domains/alphamill.gr/site/docker-compose.yml

@@ -12,7 +12,6 @@ services:
     networks:
       - proxy_net
     labels:
-      - traefik.enable=true
       - traefik.http.routers.alphamill-site-container.rule=Host(`alphamill.gr`)
       - traefik.http.services.alphamill-site-service.loadbalancer.server.port=3000
       # ports:

domains/stvnliu.me/caldav/.gitignore

@@ -1,2 +0,0 @@
-config/
-data/

domains/stvnliu.me/caldav/docker-compose.yml

@@ -1,37 +0,0 @@
-networks:
-  proxy_net:
-    name: "proxy-net"
-    external: true
-services:
-  caldav:
-    image: tomsquest/docker-radicale
-    container_name: caldav-stvnliu-me
-    networks:
-      - proxy_net
-    init: true
-    read_only: false
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
-    cap_add:
-      - SETUID
-      - SETGID
-      - CHOWN
-      - KILL
-    deploy:
-      resources:
-        limits:
-          memory: 256M
-          pids: 50
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.radicale.rule=Host(`cal.stvnliu.me`) && PathPrefix(`/radicale/`)"
-      - "traefik.http.routers.radicale.entrypoints=websecure"
-      - "traefik.http.services.radicale.loadbalancer.server.port=5232"
-      - "traefik.http.middlewares.radicale-scriptname.headers.customrequestheaders.X-Script-Name=/radicale"
-      - "traefik.http.routers.radicale.middlewares=radicale-scriptname"
-    restart: unless-stopped
-    volumes:
-      - ./data:/data
-      - ./config:/config:ro

domains/stvnliu.me/docker-compose.yml

@@ -1,6 +0,0 @@
-include:
-  - path: ./vault/docker-compose.yml
-  - path: ./git/docker-compose.yml
-  - path: ./sso/docker-compose.yml
-  - path: ./caldav/docker-compose.yml
-  - path: ./mc/docker-compose.yml

domains/stvnliu.me/git/.gitignore

@@ -1,3 +0,0 @@
-git
-gitea
-ssh

domains/stvnliu.me/git/docker-compose.yml

@@ -1,27 +0,0 @@
-networks:
-  proxy_net:
-    external: true
-services:
-  forgejo-server:
-    image: codeberg.org/forgejo/forgejo:17
-    container_name: forgejo
-    environment:
-      - USER_UID=1000
-      - USER_GID=1000
-    restart: always
-    networks:
-      - proxy_net
-    volumes:
-      - .:/data
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-    ports:
-      - '2222:22'
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.git-stvnliu-me.tls=true
-      - traefik.http.routers.git-stvnliu-me.entrypoints=websecure
-      - traefik.http.routers.git-stvnliu-me.rule=Host(`stvnliu.me`) && PathPrefix(`/git`)
-      - "traefik.http.middlewares.forgejo-strip.stripprefix.prefixes=/git"
-      - "traefik.http.routers.git-stvnliu-me.middlewares=forgejo-strip"
-      - traefik.http.services.git-stvnliu-me.loadbalancer.server.port=3000

domains/stvnliu.me/mc/.gitignore

@@ -1,3 +0,0 @@
-data/
-drasl/data/
-drasl/config/

domains/stvnliu.me/mc/docker-compose.yml

@@ -1,8 +1,4 @@
-networks:
+includes:
-  proxy_net:
-    name: "proxy-net"
-    external: true
-include:
   - path: ./drasl/docker-compose.yml
 services:
   minecraft:
@@ -11,16 +7,12 @@ services:
     tty: true
     stdin_open: true
     networks:
-      - proxy_net
+      - minecraft
+      - proxy
     environment:
       EULA: "TRUE"
       VERSION: 26.3
       TYPE: PAPER
       JVM_OPTS: "-Dminecraft.api.env=custom -Dminecraft.api.auth.host=https://drasl.stvnliu.me/auth -Dminecraft.api.account.host=https://drasl.stvnliu.me/account -Dminecraft.api.profiles.host=https://drasl.stvnliu.me/account -Dminecraft.api.session.host=https://drasl.stvnliu.me/session -Dminecraft.api.services.host=https://drasl.stvnliu.me/services -Dminecraft.api.discovery.host=https://drasl.stvnliu.me/discovery/minecraft/client"
-    volumes:
+      volumes:
         - ./data:/data
-    labels:
-      - traefik.enable=true
-      - traefik.tcp.routers.mc.rule=HostSNI(`*`)
-      - traefik.tcp.routers.mc.entrypoints=minecraft
-      - traefik.tcp.services.mc.loadbalancer.server.port=25565

domains/stvnliu.me/mc/drasl/docker-compose.yml

@@ -1,18 +1,14 @@
 networks:
-  proxy_net:
+  default_net:
-    name: "proxy-net"
+    - external: true
-    external: true
+  minecraft_net:
+    - external: true
 services:
   drasl:
     image: unmojang/drasl
     networks:
-      - proxy_net
+      - default_net
+      - minecraft_net
     volumes:
       - ./config:/etc/drasl
-      - ./data:/var/lib/drasl
+      - ./data: /var/lib/drasl
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.drasl-stvnliu-me.tls=true
-      - traefik.http.routers.drasl-stvnliu-me.entrypoints=websecure
-      - traefik.http.routers.drasl-stvnliu-me.rule=Host(`drasl.stvnliu.me`)
-      - traefik.http.services.drasl-stvnliu-me.loadbalancer.server.port=25585

domains/stvnliu.me/sso/.gitignore

@@ -1 +0,0 @@
-.env

domains/stvnliu.me/sso/docker-compose.yml

@@ -1,91 +0,0 @@
-services:
-  authentik-postgresql:
-    container_name: authentik_pgsql
-    env_file:
-    - .env
-    environment:
-      POSTGRES_DB: ${PG_DB:-authentik}
-      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
-      POSTGRES_USER: ${PG_USER:-authentik}
-    networks:
-      - authentik_net
-    healthcheck:
-      interval: 30s
-      retries: 5
-      start_period: 20s
-      test:
-      - CMD-SHELL
-      - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
-      timeout: 5s
-    image: docker.io/library/postgres:16-alpine
-    restart: unless-stopped
-    volumes:
-    - database:/var/lib/postgresql/data
-  authentik-server:
-    container_name: authentik_server
-    command: server
-    depends_on:
-      authentik-postgresql:
-        condition: service_healthy
-    env_file:
-    - .env
-    environment:
-      AUTHENTIK_POSTGRESQL__HOST: authentik-postgresql
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.8.4}
-    networks:
-      - authentik_net
-      - proxy_net
-      # ports:
-      # - ${COMPOSE_PORT_HTTP:-9000}:9000
-      # - ${COMPOSE_PORT_HTTPS:-9443}:9443
-    restart: unless-stopped
-    shm_size: 512mb
-    labels:
-      - traefik.enable=true
-      - traefik.docker.network=proxy-net
-      - traefik.http.routers.authentik-stvnliu-me.tls=true
-      - traefik.http.routers.authentik-stvnliu-me.entrypoints=websecure
-      - traefik.http.routers.authentik-stvnliu-me.rule=Host(`sso.stvnliu.me`)
-      - traefik.http.services.authentik-stvnliu-me.loadbalancer.server.port=9000
-    volumes:
-    - ./data:/data
-    - ./custom-templates:/templates
-  authentik-worker:
-    container_name: authentik_worker
-    command: worker
-    depends_on:
-      authentik-postgresql:
-        condition: service_healthy
-    env_file:
-      - .env
-    networks:
-      - authentik_net
-    environment:
-      AUTHENTIK_POSTGRESQL__HOST: authentik-postgresql
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.8.4}
-    restart: unless-stopped
-    shm_size: 512mb
-    user: root
-    volumes:
-    - /var/run/docker.sock:/var/run/docker.sock
-    - ./data:/data
-    - ./certs:/certs
-    - ./custom-templates:/templates
-volumes:
-  database:
-    driver: local
-networks:
-  authentik_net:
-    external: false
-    driver: bridge
-  proxy_net:
-    name: "proxy-net"
-    external: true