Ryan Malloy
09b1bae157
Rewrite the dashboard, machines, users, dns, and settings pages as thin
Astro shells that mount a matching React island (Dashboard, MachinesPage,
UsersPage, DnsPage, SettingsPage) built on the shadcn-ui component
library. Alpine.js templates in those pages are replaced wholesale;
Alpine still ships as the runtime for the ACL editor's dependencies.
- src/components/ui/*: shadcn primitives (button, card, tabs, select,
dropdown-menu, avatar, badge, input, switch, separator)
- src/components/{dashboard,dns,machines,settings,users}/*: page-level
React shells that consume server props from the Astro parent
- src/components/shell/AppShell.tsx: shared chrome (nav, user menu)
- src/lib/utils.ts: shadcn's cn() helper
- src/lib/auth/session-manager.ts: pluggable SessionStore interface with
Redis (via REDIS_URL) or in-memory backends; both honor absolute
expiration via TTL. In-memory logs a warning that sessions vanish on
restart.
- src/lib/auth/oidc-client.ts, oidc-state.ts: shrink OIDC handlers now
that PKCE + nonce state travels in a signed JWT cookie
- src/pages/api/auth/*: match the simplified handlers
- src/styles/global.css, tailwind.config.mjs, tsconfig.json: shadcn
design tokens and the '@/*' path alias
- docker-compose.local.yml: local dev tweaks
- package.json, pnpm-lock.yaml: shadcn + Radix + ioredis + zod
104 lines
3.3 KiB
YAML
104 lines
3.3 KiB
YAML
# Minimal Authentik stack for local Heady auth testing.
|
|
# Heady itself runs natively via `npm run dev`; this stack only provides
|
|
# the OIDC provider it talks to.
|
|
|
|
services:
|
|
heady-postgres:
|
|
image: docker.io/library/postgres:15-alpine
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ['CMD-SHELL', 'pg_isready -d authentik -U authentik']
|
|
start_period: 20s
|
|
interval: 30s
|
|
retries: 5
|
|
timeout: 5s
|
|
volumes:
|
|
- heady_postgres_data:/var/lib/postgresql/data
|
|
environment:
|
|
POSTGRES_PASSWORD: authentik-local-pw
|
|
POSTGRES_USER: authentik
|
|
POSTGRES_DB: authentik
|
|
networks: [authentik-internal]
|
|
|
|
heady-redis:
|
|
image: docker.io/library/redis:alpine
|
|
command: --save 60 1 --loglevel warning
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ['CMD-SHELL', 'redis-cli ping | grep PONG']
|
|
start_period: 20s
|
|
interval: 30s
|
|
retries: 5
|
|
timeout: 3s
|
|
volumes:
|
|
- heady_redis_data:/data
|
|
# Expose to localhost so the Heady dev server (running on the host) can
|
|
# use the same Redis instance Authentik uses for its session store.
|
|
ports:
|
|
- '127.0.0.1:6389:6379'
|
|
networks: [authentik-internal]
|
|
|
|
heady-authentik-server:
|
|
image: ghcr.io/goauthentik/server:2024.12
|
|
restart: unless-stopped
|
|
command: server
|
|
environment:
|
|
AUTHENTIK_REDIS__HOST: heady-redis
|
|
AUTHENTIK_POSTGRESQL__HOST: heady-postgres
|
|
AUTHENTIK_POSTGRESQL__USER: authentik
|
|
AUTHENTIK_POSTGRESQL__NAME: authentik
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: authentik-local-pw
|
|
AUTHENTIK_SECRET_KEY: heady-local-authentik-secret-key-2026
|
|
AUTHENTIK_ERROR_REPORTING__ENABLED: 'false'
|
|
AUTHENTIK_DISABLE_UPDATE_CHECK: 'true'
|
|
AUTHENTIK_DISABLE_STARTUP_ANALYTICS: 'true'
|
|
AUTHENTIK_AVATARS: initials
|
|
volumes:
|
|
- heady_authentik_media:/media
|
|
- heady_authentik_templates:/templates
|
|
# Auto-load custom blueprints (Heady OIDC provider + application).
|
|
# Anything in /blueprints/* is reconciled on startup.
|
|
- ./authentik-blueprints:/blueprints/heady:ro
|
|
depends_on: [heady-postgres, heady-redis]
|
|
networks: [caddy, authentik-internal]
|
|
labels:
|
|
caddy: heady-auth.l.supported.systems
|
|
caddy.reverse_proxy: '{{upstreams 9000}}'
|
|
|
|
heady-authentik-worker:
|
|
image: ghcr.io/goauthentik/server:2024.12
|
|
restart: unless-stopped
|
|
command: worker
|
|
environment:
|
|
AUTHENTIK_REDIS__HOST: heady-redis
|
|
AUTHENTIK_POSTGRESQL__HOST: heady-postgres
|
|
AUTHENTIK_POSTGRESQL__USER: authentik
|
|
AUTHENTIK_POSTGRESQL__NAME: authentik
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: authentik-local-pw
|
|
AUTHENTIK_SECRET_KEY: heady-local-authentik-secret-key-2026
|
|
AUTHENTIK_ERROR_REPORTING__ENABLED: 'false'
|
|
AUTHENTIK_DISABLE_UPDATE_CHECK: 'true'
|
|
AUTHENTIK_DISABLE_STARTUP_ANALYTICS: 'true'
|
|
user: root
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- heady_authentik_media:/media
|
|
- heady_authentik_certs:/certs
|
|
- heady_authentik_templates:/templates
|
|
- ./authentik-blueprints:/blueprints/heady:ro
|
|
depends_on: [heady-postgres, heady-redis]
|
|
networks: [authentik-internal]
|
|
|
|
volumes:
|
|
heady_postgres_data:
|
|
heady_redis_data:
|
|
heady_authentik_media:
|
|
heady_authentik_certs:
|
|
heady_authentik_templates:
|
|
|
|
networks:
|
|
caddy:
|
|
external: true
|
|
authentik-internal:
|
|
driver: bridge
|