OOKNET                             [ /  search the index  ]  
──────────────────────────────────────────────────────────────────────────────────────
[ KB ]    [ GIT ]    [ PROJECTS ]    [ ABOUT ]                                      EN
══════════════════════════════════════════════════════════════════════════════════════
OOKNET   [ /  search  ]  
────────────────────────────────────────────────
[ KB ] [ GIT ] [ PROJECTS ] [ ABOUT ]
════════════════════════════════════════════════
 
HASH      03b109d4fad2
DATE      2025-10-24
SUBJECT   server: authentik module init
FILES     9 CHANGED
HASH      03b109d4fad2
DATE      2025-10-24
SUBJECT   server: authentik module init
FILES     9 CHANGED
 

diff --git a/modules/nixos/server/services/authentik/default.nix b/modules/nixos/s
erver/services/authentik/default.nix
new file mode 100644
index 0000000..e44a7dd
--- /dev/null
+++ b/modules/nixos/server/services/authentik/default.nix
@@ -0,0 +1,10 @@
+{
+  imports = [
+    ./options.nix
+    ./server.nix
+    ./worker.nix
+    ./postgres.nix
+    ./redis.nix
+    ./network.nix
+  ];
+}


diff --git a/modules/nixos/server/services/a
uthentik/default.nix b/modules/nixos/server/
services/authentik/default.nix
new file mode 100644
index 0000000..e44a7dd
--- /dev/null
+++ b/modules/nixos/server/services/authenti
k/default.nix
@@ -0,0 +1,10 @@
+{
+  imports = [
+    ./options.nix
+    ./server.nix
+    ./worker.nix
+    ./postgres.nix
+    ./redis.nix
+    ./network.nix
+  ];
+}

 

diff --git a/modules/nixos/server/services/authentik/network.nix b/modules/nixos/s
erver/services/authentik/network.nix
new file mode 100644
index 0000000..4acda0b
--- /dev/null
+++ b/modules/nixos/server/services/authentik/network.nix
@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf getExe elem;
+  inherit (config.ooknet.server) services;
+  inherit (config.virtualisation) podman;
+in {
+  config = mkIf (elem "authentik" services) {
+    systemd.services.podman-network-authentik = {
+      description = "Podman network authentik";
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = "${getExe podman.package} network create -d bridge authentik"
;
+        ExecStop = "${getExe podman.package} network rm -f authentik";
+      };
+      wantedBy = ["multi-user.target"];
+      before = [
+        "podman-authentik-server.service"
+        "podman-authentik-worker.service"
+        "podman-authentik-postgres.service"
+        "podman-authentik-redis.service"
+      ];
+    };
+
+    systemd.tmpfiles.settings.authentik = {
+      "${config.ooknet.server.authentik.stateDir}"."d" = {
+        mode = "0755";
+      };
+      "${config.ooknet.server.authentik.stateDir}/media"."d" = {
+        mode = "0755";
+      };
+      "${config.ooknet.server.authentik.stateDir}/certs"."d" = {
+        mode = "0755";
+      };
+      "${config.ooknet.server.authentik.stateDir}/custom-templates"."d" = {
+        mode = "0755";
+      };
+      "${config.ooknet.server.authentik.stateDir}/database"."d" = {
+        mode = "0755";
+      };
+      "${config.ooknet.server.authentik.stateDir}/redis"."d" = {
+        mode = "0755";
+      };
+    };
+  };
+}


diff --git a/modules/nixos/server/services/a
uthentik/network.nix b/modules/nixos/server/
services/authentik/network.nix
new file mode 100644
index 0000000..4acda0b
--- /dev/null
+++ b/modules/nixos/server/services/authenti
k/network.nix
@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf getExe elem;
+  inherit (config.ooknet.server) services;
+  inherit (config.virtualisation) podman;
+in {
+  config = mkIf (elem "authentik" services)
 {
+    systemd.services.podman-network-authent
ik = {
+      description = "Podman network authent
ik";
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = "${getExe podman.packag
e} network create -d bridge authentik";
+        ExecStop = "${getExe podman.package
} network rm -f authentik";
+      };
+      wantedBy = ["multi-user.target"];
+      before = [
+        "podman-authentik-server.service"
+        "podman-authentik-worker.service"
+        "podman-authentik-postgres.service"
+        "podman-authentik-redis.service"
+      ];
+    };
+
+    systemd.tmpfiles.settings.authentik = {
+      "${config.ooknet.server.authentik.sta
teDir}"."d" = {
+        mode = "0755";
+      };
+      "${config.ooknet.server.authentik.sta
teDir}/media"."d" = {
+        mode = "0755";
+      };
+      "${config.ooknet.server.authentik.sta
teDir}/certs"."d" = {
+        mode = "0755";
+      };
+      "${config.ooknet.server.authentik.sta
teDir}/custom-templates"."d" = {
+        mode = "0755";
+      };
+      "${config.ooknet.server.authentik.sta
teDir}/database"."d" = {
+        mode = "0755";
+      };
+      "${config.ooknet.server.authentik.sta
teDir}/redis"."d" = {
+        mode = "0755";
+      };
+    };
+  };
+}

 

diff --git a/modules/nixos/server/services/authentik/options.nix b/modules/nixos/s
erver/services/authentik/options.nix
new file mode 100644
index 0000000..fd4c43f
--- /dev/null
+++ b/modules/nixos/server/services/authentik/options.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkOption mkEnableOption elem types;
+  inherit (config.ooknet.server) services domain;
+  authentikEnabled = elem "authentik" services;
+in {
+  options.ooknet.server.authentik = {
+    enable = mkEnableOption "Authentik SSO" // {default = authentikEnabled;};
+
+    domain = mkOption {
+      type = types.str;
+      default = "auth.${domain}";
+      description = "Domain for Authentik portal";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 9000;
+      description = "Port for Authentik server";
+    };
+
+    stateDir = mkOption {
+      type = types.path;
+      default = "/var/lib/authentik";
+      description = "State directory for Authentik";
+    };
+
+    postgres = {
+      port = mkOption {
+        type = types.port;
+        default = 5432;
+        description = "PostgreSQL port";
+      };
+
+      database = mkOption {
+        type = types.str;
+        default = "authentik";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "authentik";
+      };
+    };
+
+    redis = {
+      port = mkOption {
+        type = types.port;
+        default = 6380;
+        description = "Redis port for Authentik";
+      };
+    };
+  };
+}


diff --git a/modules/nixos/server/services/a
uthentik/options.nix b/modules/nixos/server/
services/authentik/options.nix
new file mode 100644
index 0000000..fd4c43f
--- /dev/null
+++ b/modules/nixos/server/services/authenti
k/options.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkOption mkEnableOption ele
m types;
+  inherit (config.ooknet.server) services d
omain;
+  authentikEnabled = elem "authentik" servi
ces;
+in {
+  options.ooknet.server.authentik = {
+    enable = mkEnableOption "Authentik SSO"
 // {default = authentikEnabled;};
+
+    domain = mkOption {
+      type = types.str;
+      default = "auth.${domain}";
+      description = "Domain for Authentik p
ortal";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 9000;
+      description = "Port for Authentik ser
ver";
+    };
+
+    stateDir = mkOption {
+      type = types.path;
+      default = "/var/lib/authentik";
+      description = "State directory for Au
thentik";
+    };
+
+    postgres = {
+      port = mkOption {
+        type = types.port;
+        default = 5432;
+        description = "PostgreSQL port";
+      };
+
+      database = mkOption {
+        type = types.str;
+        default = "authentik";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "authentik";
+      };
+    };
+
+    redis = {
+      port = mkOption {
+        type = types.port;
+        default = 6380;
+        description = "Redis port for Authe
ntik";
+      };
+    };
+  };
+}

 

diff --git a/modules/nixos/server/services/authentik/postgres.nix b/modules/nixos/
server/services/authentik/postgres.nix
new file mode 100644
index 0000000..bb8023d
--- /dev/null
+++ b/modules/nixos/server/services/authentik/postgres.nix
@@ -0,0 +1,39 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+  inherit (config.ooknet.server.authentik) stateDir postgres;
+in {
+  config = mkIf (elem "authentik" services) {
+    virtualisation.oci-containers.containers = {
+      authentik-postgres = {
+        image = "docker.io/library/postgres:16-alpine";
+        autoStart = true;
+        hostname = "authentik-postgres";
+        volumes = [
+          "${stateDir}/database:/var/lib/postgresql/data"
+        ];
+        environment = {
+          POSTGRES_DB = postgres.database;
+          POSTGRES_USER = postgres.user;
+        };
+        environmentFiles = [
+          config.age.secrets.authentik-env.path
+        ];
+        networks = [
+          "authentik"
+        ];
+        extraOptions = [
+          "--health-cmd=pg_isready -d ${postgres.database} -U ${postgres.user}"
+          "--health-interval=30s"
+          "--health-timeout=5s"
+          "--health-retries=5"
+          "--health-start-period=20s"
+        ];
+      };
+    };
+  };
+}


diff --git a/modules/nixos/server/services/a
uthentik/postgres.nix b/modules/nixos/server
/services/authentik/postgres.nix
new file mode 100644
index 0000000..bb8023d
--- /dev/null
+++ b/modules/nixos/server/services/authenti
k/postgres.nix
@@ -0,0 +1,39 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+  inherit (config.ooknet.server.authentik) 
stateDir postgres;
+in {
+  config = mkIf (elem "authentik" services)
 {
+    virtualisation.oci-containers.container
s = {
+      authentik-postgres = {
+        image = "docker.io/library/postgres
:16-alpine";
+        autoStart = true;
+        hostname = "authentik-postgres";
+        volumes = [
+          "${stateDir}/database:/var/lib/po
stgresql/data"
+        ];
+        environment = {
+          POSTGRES_DB = postgres.database;
+          POSTGRES_USER = postgres.user;
+        };
+        environmentFiles = [
+          config.age.secrets.authentik-env.
path
+        ];
+        networks = [
+          "authentik"
+        ];
+        extraOptions = [
+          "--health-cmd=pg_isready -d ${pos
tgres.database} -U ${postgres.user}"
+          "--health-interval=30s"
+          "--health-timeout=5s"
+          "--health-retries=5"
+          "--health-start-period=20s"
+        ];
+      };
+    };
+  };
+}

 

diff --git a/modules/nixos/server/services/authentik/redis.nix b/modules/nixos/ser
ver/services/authentik/redis.nix
new file mode 100644
index 0000000..3cb7c79
--- /dev/null
+++ b/modules/nixos/server/services/authentik/redis.nix
@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+in {
+  config = mkIf (elem "authentik" services) {
+    virtualisation.oci-containers.containers = {
+      authentik-redis = {
+        image = "docker.io/library/redis:alpine";
+        autoStart = true;
+        hostname = "authentik-redis";
+        volumes = [
+          "${config.ooknet.server.authentik.stateDir}/redis:/data"
+        ];
+        cmd = ["--save" "60" "1" "--loglevel" "warning"];
+        networks = [
+          "authentik"
+        ];
+        extraOptions = [
+          "--health-cmd=redis-cli ping | grep PONG"
+          "--health-interval=30s"
+          "--health-timeout=3s"
+          "--health-retries=5"
+          "--health-start-period=20s"
+        ];
+      };
+    };
+  };
+}


diff --git a/modules/nixos/server/services/a
uthentik/redis.nix b/modules/nixos/server/se
rvices/authentik/redis.nix
new file mode 100644
index 0000000..3cb7c79
--- /dev/null
+++ b/modules/nixos/server/services/authenti
k/redis.nix
@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+in {
+  config = mkIf (elem "authentik" services)
 {
+    virtualisation.oci-containers.container
s = {
+      authentik-redis = {
+        image = "docker.io/library/redis:al
pine";
+        autoStart = true;
+        hostname = "authentik-redis";
+        volumes = [
+          "${config.ooknet.server.authentik
.stateDir}/redis:/data"
+        ];
+        cmd = ["--save" "60" "1" "--logleve
l" "warning"];
+        networks = [
+          "authentik"
+        ];
+        extraOptions = [
+          "--health-cmd=redis-cli ping | gr
ep PONG"
+          "--health-interval=30s"
+          "--health-timeout=3s"
+          "--health-retries=5"
+          "--health-start-period=20s"
+        ];
+      };
+    };
+  };
+}

 

diff --git a/modules/nixos/server/services/authentik/server.nix b/modules/nixos/se
rver/services/authentik/server.nix
new file mode 100644
index 0000000..a01b72b
--- /dev/null
+++ b/modules/nixos/server/services/authentik/server.nix
@@ -0,0 +1,54 @@
+{
+  config,
+  lib,
+  ook,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (ook.lib.container) mkContainerLabel;
+  inherit (config.ooknet.server) services;
+  inherit (config.ooknet.server.authentik) domain port stateDir postgres;
+in {
+  config = mkIf (elem "authentik" services) {
+    virtualisation.oci-containers.containers = {
+      authentik-server = {
+        image = "ghcr.io/goauthentik/server:2025.8.4";
+        autoStart = true;
+        hostname = "authentik-server";
+        cmd = ["server"];
+        ports = [
+          "${toString port}:9000"
+          "9443:9443"
+        ];
+        volumes = [
+          "${stateDir}/media:/media"
+          "${stateDir}/custom-templates:/templates"
+        ];
+        labels = mkContainerLabel {
+          name = "auth";
+          inherit domain port;
+          homepage = {
+            group = "infrastructure";
+            description = "SSO & Identity Provider";
+          };
+        };
+        environment = {
+          AUTHENTIK_REDIS__HOST = "authentik-redis";
+          AUTHENTIK_POSTGRESQL__HOST = "authentik-postgres";
+          AUTHENTIK_POSTGRESQL__NAME = postgres.database;
+          AUTHENTIK_POSTGRESQL__USER = postgres.user;
+        };
+        environmentFiles = [
+          config.age.secrets.authentik-env.path
+        ];
+        dependsOn = ["authentik-postgres" "authentik-redis"];
+        networks = ["authentik"];
+      };
+    };
+    users.users.authentik = {
+      isSystemUser = true;
+      group = "authentik";
+    };
+    users.groups.authentik = {};
+  };
+}


diff --git a/modules/nixos/server/services/a
uthentik/server.nix b/modules/nixos/server/s
ervices/authentik/server.nix
new file mode 100644
index 0000000..a01b72b
--- /dev/null
+++ b/modules/nixos/server/services/authenti
k/server.nix
@@ -0,0 +1,54 @@
+{
+  config,
+  lib,
+  ook,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (ook.lib.container) mkContainerLa
bel;
+  inherit (config.ooknet.server) services;
+  inherit (config.ooknet.server.authentik) 
domain port stateDir postgres;
+in {
+  config = mkIf (elem "authentik" services)
 {
+    virtualisation.oci-containers.container
s = {
+      authentik-server = {
+        image = "ghcr.io/goauthentik/server
:2025.8.4";
+        autoStart = true;
+        hostname = "authentik-server";
+        cmd = ["server"];
+        ports = [
+          "${toString port}:9000"
+          "9443:9443"
+        ];
+        volumes = [
+          "${stateDir}/media:/media"
+          "${stateDir}/custom-templates:/te
mplates"
+        ];
+        labels = mkContainerLabel {
+          name = "auth";
+          inherit domain port;
+          homepage = {
+            group = "infrastructure";
+            description = "SSO & Identity P
rovider";
+          };
+        };
+        environment = {
+          AUTHENTIK_REDIS__HOST = "authenti
k-redis";
+          AUTHENTIK_POSTGRESQL__HOST = "aut
hentik-postgres";
+          AUTHENTIK_POSTGRESQL__NAME = post
gres.database;
+          AUTHENTIK_POSTGRESQL__USER = post
gres.user;
+        };
+        environmentFiles = [
+          config.age.secrets.authentik-env.
path
+        ];
+        dependsOn = ["authentik-postgres" "
authentik-redis"];
+        networks = ["authentik"];
+      };
+    };
+    users.users.authentik = {
+      isSystemUser = true;
+      group = "authentik";
+    };
+    users.groups.authentik = {};
+  };
+}

 

diff --git a/modules/nixos/server/services/authentik/worker.nix b/modules/nixos/se
rver/services/authentik/worker.nix
new file mode 100644
index 0000000..293e2e3
--- /dev/null
+++ b/modules/nixos/server/services/authentik/worker.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+  inherit (config.ooknet.server.authentik) stateDir postgres;
+in {
+  config = mkIf (elem "authentik" services) {
+    virtualisation.oci-containers.containers = {
+      authentik-worker = {
+        image = "ghcr.io/goauthentik/server:2025.8.4";
+        autoStart = true;
+        hostname = "authentik-worker";
+        cmd = ["worker"];
+        user = "root";
+        volumes = [
+          "${stateDir}/media:/media"
+          "${stateDir}/certs:/certs"
+          "${stateDir}/custom-templates:/templates"
+          "/var/run/podman/podman.sock:/var/run/docker.sock"
+        ];
+        environment = {
+          AUTHENTIK_REDIS__HOST = "authentik-redis";
+          AUTHENTIK_POSTGRESQL__HOST = "authentik-postgres";
+          AUTHENTIK_POSTGRESQL__NAME = postgres.database;
+          AUTHENTIK_POSTGRESQL__USER = postgres.user;
+        };
+        environmentFiles = [
+          config.age.secrets.authentik-env.path
+        ];
+        dependsOn = ["authentik-postgres" "authentik-redis"];
+        networks = ["authentik"];
+      };
+    };
+  };
+}


diff --git a/modules/nixos/server/services/a
uthentik/worker.nix b/modules/nixos/server/s
ervices/authentik/worker.nix
new file mode 100644
index 0000000..293e2e3
--- /dev/null
+++ b/modules/nixos/server/services/authenti
k/worker.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+  inherit (config.ooknet.server.authentik) 
stateDir postgres;
+in {
+  config = mkIf (elem "authentik" services)
 {
+    virtualisation.oci-containers.container
s = {
+      authentik-worker = {
+        image = "ghcr.io/goauthentik/server
:2025.8.4";
+        autoStart = true;
+        hostname = "authentik-worker";
+        cmd = ["worker"];
+        user = "root";
+        volumes = [
+          "${stateDir}/media:/media"
+          "${stateDir}/certs:/certs"
+          "${stateDir}/custom-templates:/te
mplates"
+          "/var/run/podman/podman.sock:/var
/run/docker.sock"
+        ];
+        environment = {
+          AUTHENTIK_REDIS__HOST = "authenti
k-redis";
+          AUTHENTIK_POSTGRESQL__HOST = "aut
hentik-postgres";
+          AUTHENTIK_POSTGRESQL__NAME = post
gres.database;
+          AUTHENTIK_POSTGRESQL__USER = post
gres.user;
+        };
+        environmentFiles = [
+          config.age.secrets.authentik-env.
path
+        ];
+        dependsOn = ["authentik-postgres" "
authentik-redis"];
+        networks = ["authentik"];
+      };
+    };
+  };
+}

 

diff --git a/modules/nixos/server/services/default.nix b/modules/nixos/server/serv
ices/default.nix
index d94a0f3..e22b0ab 100644
--- a/modules/nixos/server/services/default.nix
+++ b/modules/nixos/server/services/default.nix
@@ -6,6 +6,7 @@
     ./copyparty
     ./monitoring
     ./auth
+    ./authentik
     # ./minecraft
   ];
 }


diff --git a/modules/nixos/server/services/d
efault.nix b/modules/nixos/server/services/d
efault.nix
index d94a0f3..e22b0ab 100644
--- a/modules/nixos/server/services/default.
nix
+++ b/modules/nixos/server/services/default.
nix
@@ -6,6 +6,7 @@
     ./copyparty
     ./monitoring
     ./auth
+    ./authentik
     # ./minecraft
   ];
 }

 

diff --git a/outputs/hosts/servers.nix b/outputs/hosts/servers.nix
index eab2a96..7636e0e 100644
--- a/outputs/hosts/servers.nix
+++ b/outputs/hosts/servers.nix
@@ -13,7 +13,7 @@ in {
       domain = "ooknet.org";
       type = "vm";
       profile = "linode";
-      services = ["website" "forgejo" "authelia"];
+      services = ["website" "forgejo"];
     };
     ooksmedia = mkServer {
       inherit withSystem;
@@ -21,7 +21,7 @@ in {
       hostname = "ooksmedia";
       domain = "ooknet.org";
       type = "desktop";
-      services = ["ookflix" "monitoring"];
+      services = ["ookflix" "monitoring" "authentik"];
     };
     ookstest = mkServer {
       inherit withSystem;


diff --git a/outputs/hosts/servers.nix b/out
puts/hosts/servers.nix
index eab2a96..7636e0e 100644
--- a/outputs/hosts/servers.nix
+++ b/outputs/hosts/servers.nix
@@ -13,7 +13,7 @@ in {
       domain = "ooknet.org";
       type = "vm";
       profile = "linode";
-      services = ["website" "forgejo" "auth
elia"];
+      services = ["website" "forgejo"];
     };
     ooksmedia = mkServer {
       inherit withSystem;
@@ -21,7 +21,7 @@ in {
       hostname = "ooksmedia";
       domain = "ooknet.org";
       type = "desktop";
-      services = ["ookflix" "monitoring"];
+      services = ["ookflix" "monitoring" "a
uthentik"];
     };
     ookstest = mkServer {
       inherit withSystem;

 
[ BACK TO LOG ]
──────────────────────────────────────────────────────────────────────────────────────
OOKNET
────────────────────────────────────────────────
OOKNET