# Minimal Authentik stack for local Heady auth testing.
# Heady itself runs natively via `npm run dev`; this stack only provides
# the OIDC provider it talks to.

services:
  heady-postgres:
    image: docker.io/library/postgres:15-alpine
    restart: unless-stopped
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -d authentik -U authentik']
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    volumes:
      - heady_postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: authentik-local-pw
      POSTGRES_USER: authentik
      POSTGRES_DB: authentik
    networks: [authentik-internal]

  heady-redis:
    image: docker.io/library/redis:alpine
    command: --save 60 1 --loglevel warning
    restart: unless-stopped
    healthcheck:
      test: ['CMD-SHELL', 'redis-cli ping | grep PONG']
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    volumes:
      - heady_redis_data:/data
    networks: [authentik-internal]

  heady-authentik-server:
    image: ghcr.io/goauthentik/server:2024.12
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_REDIS__HOST: heady-redis
      AUTHENTIK_POSTGRESQL__HOST: heady-postgres
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: authentik-local-pw
      AUTHENTIK_SECRET_KEY: heady-local-authentik-secret-key-2026
      AUTHENTIK_ERROR_REPORTING__ENABLED: 'false'
      AUTHENTIK_DISABLE_UPDATE_CHECK: 'true'
      AUTHENTIK_DISABLE_STARTUP_ANALYTICS: 'true'
      AUTHENTIK_AVATARS: initials
    volumes:
      - heady_authentik_media:/media
      - heady_authentik_templates:/templates
      # Auto-load custom blueprints (Heady OIDC provider + application).
      # Anything in /blueprints/* is reconciled on startup.
      - ./authentik-blueprints:/blueprints/heady:ro
    depends_on: [heady-postgres, heady-redis]
    networks: [caddy, authentik-internal]
    labels:
      caddy: heady-auth.l.supported.systems
      caddy.reverse_proxy: '{{upstreams 9000}}'

  heady-authentik-worker:
    image: ghcr.io/goauthentik/server:2024.12
    restart: unless-stopped
    command: worker
    environment:
      AUTHENTIK_REDIS__HOST: heady-redis
      AUTHENTIK_POSTGRESQL__HOST: heady-postgres
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: authentik-local-pw
      AUTHENTIK_SECRET_KEY: heady-local-authentik-secret-key-2026
      AUTHENTIK_ERROR_REPORTING__ENABLED: 'false'
      AUTHENTIK_DISABLE_UPDATE_CHECK: 'true'
      AUTHENTIK_DISABLE_STARTUP_ANALYTICS: 'true'
    user: root
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - heady_authentik_media:/media
      - heady_authentik_certs:/certs
      - heady_authentik_templates:/templates
      - ./authentik-blueprints:/blueprints/heady:ro
    depends_on: [heady-postgres, heady-redis]
    networks: [authentik-internal]

volumes:
  heady_postgres_data:
  heady_redis_data:
  heady_authentik_media:
  heady_authentik_certs:
  heady_authentik_templates:

networks:
  caddy:
    external: true
  authentik-internal:
    driver: bridge