Initialise repository structure and placeholder files. Generic functionality works i guess, need to come up with a better solution for compose templates

roles/authentik/README.md

@@ -0,0 +1,7 @@
+# authentik
+
+Deploys authentik with PostgreSQL and Redis. Override secret values from Vault,
+SOPS, or Ansible Vault before production use.
+
+Tags: `authentik`, `config`, `compose`, `firewall`.
+

roles/authentik/defaults/main.yml

@@ -0,0 +1,24 @@
+---
+authentik_dir: /srv/docker/authentik
+authentik_image: ghcr.io/goauthentik/server:2025.6
+authentik_postgres_image: docker.io/library/postgres:16-alpine
+authentik_redis_image: docker.io/library/redis:7-alpine
+authentik_http_port: 9000
+authentik_https_port: 9443
+authentik_domain: auth.example.invalid
+authentik_routing_mode: "{{ nbops_service_routing_mode }}"
+authentik_traefik_network: "{{ nbops_proxy_network }}"
+authentik_traefik_entrypoint: "{{ nbops_traefik_entrypoint }}"
+authentik_traefik_tls: "{{ nbops_traefik_tls }}"
+authentik_secret_key: "{{ vault_authentik_secret_key | default('CHANGE_ME_IN_VAULT') }}"
+authentik_postgres_password: "{{ vault_authentik_postgres_password | default('CHANGE_ME_IN_VAULT') }}"
+authentik_env:
+  AUTHENTIK_SECRET_KEY: "{{ authentik_secret_key }}"
+  AUTHENTIK_POSTGRESQL__HOST: postgresql
+  AUTHENTIK_POSTGRESQL__USER: authentik
+  AUTHENTIK_POSTGRESQL__NAME: authentik
+  AUTHENTIK_POSTGRESQL__PASSWORD: "{{ authentik_postgres_password }}"
+  AUTHENTIK_REDIS__HOST: redis
+authentik_tcp_ports:
+  - "{{ authentik_http_port }}"
+  - "{{ authentik_https_port }}"

roles/authentik/files/.gitkeep

@@ -0,0 +1 @@
+

roles/authentik/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: restart authentik
+  community.docker.docker_compose_v2:
+    project_src: "{{ authentik_dir }}"
+    state: restarted
+

roles/authentik/tasks/main.yml

@@ -0,0 +1,51 @@
+---
+- name: Create authentik directory
+  ansible.builtin.file:
+    path: "{{ authentik_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  tags: [authentik]
+
+- name: Render authentik environment
+  ansible.builtin.template:
+    src: env.j2
+    dest: "{{ authentik_dir }}/.env"
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+  tags: [authentik, config]
+
+- name: Ensure authentik proxy network exists
+  community.docker.docker_network:
+    name: "{{ authentik_traefik_network }}"
+    state: present
+  when: authentik_routing_mode == "traefik"
+  tags: [authentik, docker]
+
+- name: Render authentik Compose file
+  ansible.builtin.template:
+    src: compose.yaml.j2
+    dest: "{{ authentik_dir }}/compose.yaml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart authentik
+  tags: [authentik, compose]
+
+- name: Allow authentik ports
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop: "{{ authentik_tcp_ports }}"
+  when: authentik_routing_mode == "host"
+  tags: [authentik, firewall]
+
+- name: Start authentik
+  community.docker.docker_compose_v2:
+    project_src: "{{ authentik_dir }}"
+    state: present
+  tags: [authentik, compose]

roles/authentik/templates/compose.yaml.j2

@@ -0,0 +1,51 @@
+services:
+  postgresql:
+    image: {{ authentik_postgres_image }}
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: authentik
+      POSTGRES_USER: authentik
+      POSTGRES_PASSWORD: ${PG_PASS}
+    volumes:
+      - ./postgresql:/var/lib/postgresql/data
+  redis:
+    image: {{ authentik_redis_image }}
+    restart: unless-stopped
+  server:
+    image: {{ authentik_image }}
+    restart: unless-stopped
+    command: server
+    env_file: .env
+{% if authentik_routing_mode == "host" %}
+    ports:
+      - "{{ authentik_http_port }}:9000"
+      - "{{ authentik_https_port }}:9443"
+{% endif %}
+{% if authentik_routing_mode == "traefik" %}
+    # internal HTTP service port: 9000; not published on the Docker host
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.authentik.rule=Host(`{{ authentik_domain }}`)
+      - traefik.http.routers.authentik.entrypoints={{ authentik_traefik_entrypoint }}
+      - traefik.http.routers.authentik.tls={{ authentik_traefik_tls | bool | ternary('true', 'false') }}
+      - traefik.http.services.authentik.loadbalancer.server.port=9000
+    networks:
+      - default
+      - {{ authentik_traefik_network }}
+{% endif %}
+    depends_on:
+      - postgresql
+      - redis
+  worker:
+    image: {{ authentik_image }}
+    restart: unless-stopped
+    command: worker
+    env_file: .env
+    depends_on:
+      - postgresql
+      - redis
+{% if authentik_routing_mode == "traefik" %}
+networks:
+  {{ authentik_traefik_network }}:
+    external: true
+{% endif %}

roles/authentik/templates/env.j2

@@ -0,0 +1,5 @@
+PG_PASS={{ authentik_postgres_password }}
+{% for key, value in authentik_env.items() %}
+{{ key }}={{ value }}
+{% endfor %}
+