# Copyright 2026 Kingsrook, LLC
# SPDX-License-Identifier: Apache-2.0

# Optional real provider reference. No Docker socket or published database port.
services:
  authentik-postgres:
    profiles: [auth]
    platform: linux/amd64
    image: postgres@sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea
    environment:
      POSTGRES_DB: authentik
      POSTGRES_USER: authentik
      POSTGRES_PASSWORD: ${AUTHENTIK_POSTGRES_PASSWORD:?Run the development initializer first}
    volumes:
      - authentik-database:/var/lib/postgresql/data
    healthcheck:
      test: [CMD-SHELL, "pg_isready -U authentik -d authentik"]
      interval: 5s
      timeout: 5s
      retries: 30
    labels:
      io.qrun.printing.dev: ${PRINTING_DEV_PROJECT:?Run the development initializer first}
    mem_limit: 512m
    cpus: 1.0

  authentik-server:
    profiles: [auth]
    platform: linux/amd64
    image: ghcr.io/goauthentik/server@sha256:602227a86455d6772e3d16b7d852713c4f864f40df5df894abd1285bb53979a5
    command: server
    depends_on:
      authentik-postgres:
        condition: service_healthy
    environment: &authentik-environment
      AUTHENTIK_POSTGRESQL__HOST: authentik-postgres
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_POSTGRES_PASSWORD:?Run the development initializer first}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?Run the development initializer first}
      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
      AUTHENTIK_DISABLE_UPDATE_CHECK: "true"
      AUTHENTIK_LOG_LEVEL: warning
    ports:
      - "127.0.0.1:${AUTHENTIK_HTTP_PORT:-19010}:9000"
    volumes:
      - authentik-data:/data
    labels:
      io.qrun.printing.dev: ${PRINTING_DEV_PROJECT:?Run the development initializer first}
    shm_size: 256mb
    mem_limit: 1536m
    cpus: 2.0

  authentik-worker:
    profiles: [auth]
    platform: linux/amd64
    image: ghcr.io/goauthentik/server@sha256:602227a86455d6772e3d16b7d852713c4f864f40df5df894abd1285bb53979a5
    command: worker
    depends_on:
      authentik-postgres:
        condition: service_healthy
    environment:
      <<: *authentik-environment
      AUTHENTIK_BOOTSTRAP_PASSWORD_HASH: ${AUTHENTIK_BOOTSTRAP_PASSWORD_HASH:?Run the development initializer first}
      AUTHENTIK_BOOTSTRAP_TOKEN: ${AUTHENTIK_BOOTSTRAP_TOKEN:?Run the development initializer first}
      AUTHENTIK_BOOTSTRAP_EMAIL: developer@example.invalid
    volumes:
      - authentik-data:/data
    labels:
      io.qrun.printing.dev: ${PRINTING_DEV_PROJECT:?Run the development initializer first}
    shm_size: 256mb
    mem_limit: 1536m
    cpus: 2.0

volumes:
  authentik-database:
    labels:
      io.qrun.printing.dev: ${PRINTING_DEV_PROJECT:?Run the development initializer first}
  authentik-data:
    labels:
      io.qrun.printing.dev: ${PRINTING_DEV_PROJECT:?Run the development initializer first}