Olympus/system-config/services/containers/authentik-nix/docker-compose.nix

# Auto-generated using compose2nix v0.3.2-pre.
{ pkgs, lib, ... }:

{
  # Runtime
  virtualisation.docker = {
    enable = true;
    autoPrune.enable = true;
  };
  virtualisation.oci-containers.backend = "docker";

  # Containers
  virtualisation.oci-containers.containers."authentik-postgresql" = {
    image = "docker.io/library/postgres:16-alpine";
   
    environmentFiles = [ "/ssd1/Authentik/.env" ];
    volumes = [
      "authentik_database:/var/lib/postgresql/data:rw"
    ];
    log-driver = "journald";
    extraOptions = [
      "--health-cmd=pg_isready -d \${POSTGRES_DB} -U \${POSTGRES_USER}"
      "--health-interval=30s"
      "--health-retries=5"
      "--health-start-period=20s"
      "--health-timeout=5s"
      "--network-alias=postgresql"
      "--network=authentik_backend"
    ];
  };
  systemd.services."docker-authentik-postgresql" = {
    serviceConfig = {
      Restart = lib.mkOverride 90 "always";
      RestartMaxDelaySec = lib.mkOverride 90 "1m";
      RestartSec = lib.mkOverride 90 "100ms";
      RestartSteps = lib.mkOverride 90 9;
    };
    after = [
      "docker-network-authentik_backend.service"
      "docker-volume-authentik_database.service"
    ];
    requires = [
      "docker-network-authentik_backend.service"
      "docker-volume-authentik_database.service"
    ];
    partOf = [
      "docker-compose-authentik-root.target"
    ];
    wantedBy = [
      "docker-compose-authentik-root.target"
    ];
  };
  virtualisation.oci-containers.containers."authentik-redis" = {
    image = "docker.io/library/redis:alpine";
    volumes = [
      "authentik_redis:/data:rw"
    ];
    cmd = [ "--save" "60" "1" "--loglevel" "warning" ];
    log-driver = "journald";
    extraOptions = [
      "--health-cmd=redis-cli ping | grep PONG"
      "--health-interval=30s"
      "--health-retries=5"
      "--health-start-period=20s"
      "--health-timeout=3s"
      "--network-alias=redis"
      "--network=authentik_backend"
    ];
  };
  systemd.services."docker-authentik-redis" = {
    serviceConfig = {
      Restart = lib.mkOverride 90 "always";
      RestartMaxDelaySec = lib.mkOverride 90 "1m";
      RestartSec = lib.mkOverride 90 "100ms";
      RestartSteps = lib.mkOverride 90 9;
    };
    after = [
      "docker-network-authentik_backend.service"
      "docker-volume-authentik_redis.service"
    ];
    requires = [
      "docker-network-authentik_backend.service"
      "docker-volume-authentik_redis.service"
    ];
    partOf = [
      "docker-compose-authentik-root.target"
    ];
    wantedBy = [
      "docker-compose-authentik-root.target"
    ];
  };
  virtualisation.oci-containers.containers."authentik-server" = {
    image = "ghcr.io/goauthentik/server:2024.10.4";
    environment = {
      "AUTHENTIK_ERROR_REPORTING__ENABLED" = "true";
      "AUTHENTIK_REDIS__HOST" = "redis";
    };
    environmentFiles = [ "/ssd1/Authentik/.env" ];
    volumes = [
      "/ssd1/Authentik/custom-templates:/templates:rw"
      "/ssd1/Authentik/media:/media:rw"
    ];
    ports = [
      "9000:9000/tcp"
      "9443:9443/tcp"
    ];
    cmd = [ "server" ];
    dependsOn = [
      "authentik-postgresql"
      "authentik-redis"
    ];
    log-driver = "journald";
    extraOptions = [
      "--network-alias=server"
      "--network=authentik_backend"
    ];
  };
  systemd.services."docker-authentik-server" = {
    serviceConfig = {
      Restart = lib.mkOverride 90 "always";
      RestartMaxDelaySec = lib.mkOverride 90 "1m";
      RestartSec = lib.mkOverride 90 "100ms";
      RestartSteps = lib.mkOverride 90 9;
    };
    after = [
      "docker-network-authentik_backend.service"
    ];
    requires = [
      "docker-network-authentik_backend.service"
    ];
    partOf = [
      "docker-compose-authentik-root.target"
    ];
    wantedBy = [
      "docker-compose-authentik-root.target"
    ];
  };
  virtualisation.oci-containers.containers."authentik-worker" = {
    image = "ghcr.io/goauthentik/server:2024.10.4";
    environment = {
      "AUTHENTIK_ERROR_REPORTING__ENABLED" = "true";
      "AUTHENTIK_POSTGRESQL__HOST" = "postgresql";
      "AUTHENTIK_REDIS__HOST" = "redis";
    };
    environmentFiles = [ "/ssd1/Authentik/.env" ];
    volumes = [
      "/ssd1/Authentik/certs:/certs:rw"
      "/ssd1/Authentik/custom-templates:/templates:rw"
      "/ssd1/Authentik/media:/media:rw"
      "/var/run/podman/podman.sock:/var/run/docker.sock:rw"
    ];
    cmd = [ "worker" ];
    dependsOn = [
      "authentik-postgresql"
      "authentik-redis"
    ];
    user = "root";
    log-driver = "journald";
    extraOptions = [
      "--network-alias=worker"
      "--network=authentik_backend"
    ];
  };
  systemd.services."docker-authentik-worker" = {
    serviceConfig = {
      Restart = lib.mkOverride 90 "always";
      RestartMaxDelaySec = lib.mkOverride 90 "1m";
      RestartSec = lib.mkOverride 90 "100ms";
      RestartSteps = lib.mkOverride 90 9;
    };
    after = [
      "docker-network-authentik_backend.service"
    ];
    requires = [
      "docker-network-authentik_backend.service"
    ];
    partOf = [
      "docker-compose-authentik-root.target"
    ];
    wantedBy = [
      "docker-compose-authentik-root.target"
    ];
  };

  # Networks
  systemd.services."docker-network-authentik_backend" = {
    path = [ pkgs.docker ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      ExecStop = "docker network rm -f authentik_backend";
    };
    script = ''
      docker network inspect authentik_backend || docker network create authentik_backend
    '';
    partOf = [ "docker-compose-authentik-root.target" ];
    wantedBy = [ "docker-compose-authentik-root.target" ];
  };

  # Volumes
  systemd.services."docker-volume-authentik_database" = {
    path = [ pkgs.docker ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
    };
    script = ''
      docker volume inspect authentik_database || docker volume create authentik_database --driver=local
    '';
    partOf = [ "docker-compose-authentik-root.target" ];
    wantedBy = [ "docker-compose-authentik-root.target" ];
  };
  systemd.services."docker-volume-authentik_redis" = {
    path = [ pkgs.docker ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
    };
    script = ''
      docker volume inspect authentik_redis || docker volume create authentik_redis --driver=local
    '';
    partOf = [ "docker-compose-authentik-root.target" ];
    wantedBy = [ "docker-compose-authentik-root.target" ];
  };

  # Root service
  # When started, this will automatically create all resources and start
  # the containers. When stopped, this will teardown all resources.
  systemd.targets."docker-compose-authentik-root" = {
    unitConfig = {
      Description = "Root target generated by compose2nix.";
    };
    wantedBy = [ "multi-user.target" ];
  };
}