implemented compose by url, parse, local yaml.

roles/authentik/handlers/.gitkeep

@@ -0,0 +1 @@
+

roles/authentik/handlers/main.yml

@@ -1,6 +0,0 @@
----
-- name: restart authentik
-  community.docker.docker_compose_v2:
-    project_src: "{{ authentik_dir }}"
-    state: restarted
-

roles/authentik/tasks/main.yml

@@ -8,44 +8,18 @@
     mode: "0755"
   tags: [authentik]
 
-- name: Render authentik environment
-  ansible.builtin.template:
-    src: env.j2
-    dest: "{{ authentik_dir }}/.env"
-    owner: root
-    group: root
-    mode: "0600"
-  no_log: true
-  tags: [authentik, config]
-
-- name: Ensure authentik proxy network exists
-  community.docker.docker_network:
-    name: "{{ authentik_traefik_network }}"
-    state: present
-  when: authentik_routing_mode == "traefik"
-  tags: [authentik, docker]
-
-- name: Render authentik Compose file
-  ansible.builtin.template:
-    src: compose.yaml.j2
-    dest: "{{ authentik_dir }}/compose.yaml"
-    owner: root
-    group: root
-    mode: "0644"
-  notify: restart authentik
-  tags: [authentik, compose]
-
-- name: Allow authentik ports
-  community.general.ufw:
-    rule: allow
-    port: "{{ item }}"
-    proto: tcp
-  loop: "{{ authentik_tcp_ports }}"
-  when: authentik_routing_mode == "host"
-  tags: [authentik, firewall]
-
-- name: Start authentik
-  community.docker.docker_compose_v2:
-    project_src: "{{ authentik_dir }}"
-    state: present
-  tags: [authentik, compose]
+- name: Deploy authentik Compose project
+  ansible.builtin.include_role:
+    name: compose_project
+  vars:
+    compose_project_dir: "{{ authentik_dir }}"
+    compose_project_directories:
+      - "{{ authentik_dir }}"
+    compose_project_env_template_src: "{{ playbook_dir }}/../roles/authentik/templates/env.j2"
+    compose_project_compose_template_src: "{{ playbook_dir }}/../roles/authentik/templates/compose.yaml.j2"
+    compose_project_override_template_src: "{{ playbook_dir }}/../roles/authentik/templates/compose.override.yaml.j2"
+    compose_project_create_proxy_network: "{{ authentik_routing_mode == 'traefik' }}"
+    compose_project_proxy_network: "{{ authentik_traefik_network }}"
+    compose_project_firewall_ports: "{{ authentik_tcp_ports }}"
+    compose_project_firewall_enabled: "{{ authentik_routing_mode in ['host', 'traefik_file'] }}"
+  tags: [authentik]

roles/authentik/templates/compose.override.yaml.j2

@@ -0,0 +1,6 @@
+services:
+  postgresql: {}
+  redis: {}
+  server: {}
+  worker: {}
+

roles/authentik/templates/compose.yaml.j2

@@ -16,10 +16,10 @@ services:
     restart: unless-stopped
     command: server
     env_file: .env
-{% if authentik_routing_mode == "host" %}
+{% if authentik_routing_mode in ["host", "traefik_file"] %}
     ports:
-      - "{{ authentik_http_port }}:9000"
-      - "{{ authentik_https_port }}:9443"
+      - "{{ nbops_traefik_file_bind_address if authentik_routing_mode == 'traefik_file' else '0.0.0.0' }}:{{ authentik_http_port }}:9000"
+      - "{{ nbops_traefik_file_bind_address if authentik_routing_mode == 'traefik_file' else '0.0.0.0' }}:{{ authentik_https_port }}:9443"
 {% endif %}
 {% if authentik_routing_mode == "traefik" %}
     # internal HTTP service port: 9000; not published on the Docker host

roles/authentik/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `authentik` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.