Ryan Malloy
21175c5b7a
- src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a
short-lived signed JWT, store in an httpOnly cookie. Replaces the
process-local Map that broke under multi-worker deployments where
/api/auth/login and /api/auth/callback would land on different workers.
- src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the
Map-based state-store calls; use oidc-state for set/get/clear.
- src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts:
small adjustments to fit the new state surface.
- src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro:
trim a lot of layout boilerplate (~125 lines each).
- astro.config.mjs, docker-compose.local.yml: minor cleanup.
- authentik-blueprints/heady-oidc.yaml (new): declarative provider +
application blueprint to ship alongside Heady deployments.
100 lines
3.2 KiB
YAML
100 lines
3.2 KiB
YAML
# Minimal Authentik stack for local Heady auth testing.
|
|
# Heady itself runs natively via `npm run dev`; this stack only provides
|
|
# the OIDC provider it talks to.
|
|
|
|
services:
|
|
heady-postgres:
|
|
image: docker.io/library/postgres:15-alpine
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ['CMD-SHELL', 'pg_isready -d authentik -U authentik']
|
|
start_period: 20s
|
|
interval: 30s
|
|
retries: 5
|
|
timeout: 5s
|
|
volumes:
|
|
- heady_postgres_data:/var/lib/postgresql/data
|
|
environment:
|
|
POSTGRES_PASSWORD: authentik-local-pw
|
|
POSTGRES_USER: authentik
|
|
POSTGRES_DB: authentik
|
|
networks: [authentik-internal]
|
|
|
|
heady-redis:
|
|
image: docker.io/library/redis:alpine
|
|
command: --save 60 1 --loglevel warning
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ['CMD-SHELL', 'redis-cli ping | grep PONG']
|
|
start_period: 20s
|
|
interval: 30s
|
|
retries: 5
|
|
timeout: 3s
|
|
volumes:
|
|
- heady_redis_data:/data
|
|
networks: [authentik-internal]
|
|
|
|
heady-authentik-server:
|
|
image: ghcr.io/goauthentik/server:2024.12
|
|
restart: unless-stopped
|
|
command: server
|
|
environment:
|
|
AUTHENTIK_REDIS__HOST: heady-redis
|
|
AUTHENTIK_POSTGRESQL__HOST: heady-postgres
|
|
AUTHENTIK_POSTGRESQL__USER: authentik
|
|
AUTHENTIK_POSTGRESQL__NAME: authentik
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: authentik-local-pw
|
|
AUTHENTIK_SECRET_KEY: heady-local-authentik-secret-key-2026
|
|
AUTHENTIK_ERROR_REPORTING__ENABLED: 'false'
|
|
AUTHENTIK_DISABLE_UPDATE_CHECK: 'true'
|
|
AUTHENTIK_DISABLE_STARTUP_ANALYTICS: 'true'
|
|
AUTHENTIK_AVATARS: initials
|
|
volumes:
|
|
- heady_authentik_media:/media
|
|
- heady_authentik_templates:/templates
|
|
# Auto-load custom blueprints (Heady OIDC provider + application).
|
|
# Anything in /blueprints/* is reconciled on startup.
|
|
- ./authentik-blueprints:/blueprints/heady:ro
|
|
depends_on: [heady-postgres, heady-redis]
|
|
networks: [caddy, authentik-internal]
|
|
labels:
|
|
caddy: heady-auth.l.supported.systems
|
|
caddy.reverse_proxy: '{{upstreams 9000}}'
|
|
|
|
heady-authentik-worker:
|
|
image: ghcr.io/goauthentik/server:2024.12
|
|
restart: unless-stopped
|
|
command: worker
|
|
environment:
|
|
AUTHENTIK_REDIS__HOST: heady-redis
|
|
AUTHENTIK_POSTGRESQL__HOST: heady-postgres
|
|
AUTHENTIK_POSTGRESQL__USER: authentik
|
|
AUTHENTIK_POSTGRESQL__NAME: authentik
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: authentik-local-pw
|
|
AUTHENTIK_SECRET_KEY: heady-local-authentik-secret-key-2026
|
|
AUTHENTIK_ERROR_REPORTING__ENABLED: 'false'
|
|
AUTHENTIK_DISABLE_UPDATE_CHECK: 'true'
|
|
AUTHENTIK_DISABLE_STARTUP_ANALYTICS: 'true'
|
|
user: root
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- heady_authentik_media:/media
|
|
- heady_authentik_certs:/certs
|
|
- heady_authentik_templates:/templates
|
|
- ./authentik-blueprints:/blueprints/heady:ro
|
|
depends_on: [heady-postgres, heady-redis]
|
|
networks: [authentik-internal]
|
|
|
|
volumes:
|
|
heady_postgres_data:
|
|
heady_redis_data:
|
|
heady_authentik_media:
|
|
heady_authentik_certs:
|
|
heady_authentik_templates:
|
|
|
|
networks:
|
|
caddy:
|
|
external: true
|
|
authentik-internal:
|
|
driver: bridge
|