services:
  postgresql:
    image: {{ authentik_postgres_image }}
    restart: unless-stopped
    environment:
      POSTGRES_DB: authentik
      POSTGRES_USER: authentik
      POSTGRES_PASSWORD: ${PG_PASS}
    volumes:
      - ./postgresql:/var/lib/postgresql/data
  redis:
    image: {{ authentik_redis_image }}
    restart: unless-stopped
  server:
    image: {{ authentik_image }}
    restart: unless-stopped
    command: server
    env_file: .env
{% if authentik_routing_mode == "host" %}
    ports:
      - "{{ authentik_http_port }}:9000"
      - "{{ authentik_https_port }}:9443"
{% endif %}
{% if authentik_routing_mode == "traefik" %}
    # internal HTTP service port: 9000; not published on the Docker host
    labels:
      - traefik.enable=true
      - traefik.http.routers.authentik.rule=Host(`{{ authentik_domain }}`)
      - traefik.http.routers.authentik.entrypoints={{ authentik_traefik_entrypoint }}
      - traefik.http.routers.authentik.tls={{ authentik_traefik_tls | bool | ternary('true', 'false') }}
      - traefik.http.services.authentik.loadbalancer.server.port=9000
    networks:
      - default
      - {{ authentik_traefik_network }}
{% endif %}
    depends_on:
      - postgresql
      - redis
  worker:
    image: {{ authentik_image }}
    restart: unless-stopped
    command: worker
    env_file: .env
    depends_on:
      - postgresql
      - redis
{% if authentik_routing_mode == "traefik" %}
networks:
  {{ authentik_traefik_network }}:
    external: true
{% endif %}