Zero-Trust SSO Gateway

# Check if OpenSSH Client capability is installed
Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Client*'

# Install OpenSSH Client (requires admin privileges)
Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

# Connect to your server (replace with your values)
ssh username@server-ip

# Example:
# ssh admin@192.168.1.100
# ssh admin@203.0.113.50

# Update the package index (list of available packages)
sudo apt update

# Upgrade all installed packages to their latest versions
# -y flag automatically confirms prompts
sudo apt upgrade -y

# Install common utilities we'll need
sudo apt install -y curl wget git nano htop net-tools

# Install UFW (may already be installed on Ubuntu)
sudo apt install ufw -y

# IMPORTANT: Allow SSH first to prevent lockout!
sudo ufw allow ssh

# Allow HTTP (port 80) - required for Let's Encrypt certificate verification
sudo ufw allow 80/tcp

# Allow HTTPS (port 443) - all secure web traffic
sudo ufw allow 443/tcp

# Enable the firewall
sudo ufw enable

# Remove any old Docker packages that might conflict
# It's OK if these packages aren't found
sudo apt remove docker docker-engine docker.io containerd runc 2>/dev/null || true

# Install packages needed to use HTTPS repositories
sudo apt install -y \
    apt-transport-https \
    ca-certificates \
    curl \
    gnupg \
    lsb-release

# Create directory for Docker's GPG key
sudo install -m 0755 -d /etc/apt/keyrings

# Download and add Docker's official GPG key
# This verifies that packages are authentically from Docker
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
    sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

# Set proper permissions on the key file
sudo chmod a+r /etc/apt/keyrings/docker.gpg

# Add Docker repository to apt sources
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Update apt to recognize the new Docker repository
sudo apt update

# Install Docker Engine, CLI, containerd, and plugins
sudo apt install -y \
    docker-ce \
    docker-ce-cli \
    containerd.io \
    docker-buildx-plugin \
    docker-compose-plugin

# Add current user to the docker group
sudo usermod -aG docker $USER

# Apply the group change without logging out
# This creates a new shell with updated group membership
newgrp docker

# Create main directory for all identity services
mkdir -p ~/identity-stack

# Create subdirectories for configuration and data
mkdir -p ~/identity-stack/traefik
mkdir -p ~/identity-stack/authentik/media
mkdir -p ~/identity-stack/authentik/templates
mkdir -p ~/identity-stack/postgres-data
mkdir -p ~/identity-stack/redis-data

# Navigate to the project directory
cd ~/identity-stack

# Verify the structure
tree . 2>/dev/null || ls -la

# Ensure we're in the project directory
cd ~/identity-stack

# Generate a random secret key for Authentik (50 characters)
# This is used to encrypt session data and tokens
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 36)" >> .env

# Generate a random password for PostgreSQL database
echo "PG_PASS=$(openssl rand -base64 24)" >> .env

# View the generated secrets (keep these safe!)
cat .env

# Create Traefik configuration file
# IMPORTANT: Replace YOUR_EMAIL@example.com with your real email
cat > ~/identity-stack/traefik/traefik.yml << 'EOF'
# ============================================
# TRAEFIK STATIC CONFIGURATION
# ============================================

# Global settings
global:
  checkNewVersion: true
  sendAnonymousUsage: false

# API and Dashboard configuration
api:
  dashboard: true          # Enable Traefik dashboard
  insecure: false          # Dashboard requires authentication

# Logging configuration
log:
  level: INFO              # DEBUG, INFO, WARN, ERROR
  filePath: "/var/log/traefik/traefik.log"

accessLog:
  filePath: "/var/log/traefik/access.log"
  bufferingSize: 100

# Entrypoints define how traffic enters Traefik
entryPoints:
  # HTTP entrypoint - redirects all traffic to HTTPS
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true
  
  # HTTPS entrypoint - main secure traffic handler
  websecure:
    address: ":443"
    http:
      tls:
        certResolver: letsencrypt

# Certificate resolvers for automatic TLS
certificatesResolvers:
  letsencrypt:
    acme:
      # IMPORTANT: Replace with YOUR email address
      email: YOUR_EMAIL@example.com
      storage: /letsencrypt/acme.json
      httpChallenge:
        entryPoint: web

# Provider configuration
providers:
  # Docker provider - auto-discovers containers
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false  # Only expose containers with traefik.enable=true
    network: identity-network
  
  # File provider - for additional dynamic config
  file:
    directory: /etc/traefik/dynamic
    watch: true
EOF

# Replace placeholder with your actual email
# Example: sed -i 's/YOUR_EMAIL@example.com/admin@mycompany.com/g' ...
sed -i 's/YOUR_EMAIL@example.com/YOUR_REAL_EMAIL@domain.com/g' \
    ~/identity-stack/traefik/traefik.yml

# Verify the change
grep "email:" ~/identity-stack/traefik/traefik.yml

# Create the letsencrypt directory
mkdir -p ~/identity-stack/letsencrypt

# Create empty acme.json file
touch ~/identity-stack/letsencrypt/acme.json

# Set restrictive permissions (required by Traefik)
# 600 = owner can read/write, no one else can access
chmod 600 ~/identity-stack/letsencrypt/acme.json

# Create docker-compose.yml
# IMPORTANT: Replace 'yourdomain.com' with your actual domain
cat > ~/identity-stack/docker-compose.yml << 'EOF'
# ============================================
# IDENTITY STACK - DOCKER COMPOSE
# Authentik + Traefik + PostgreSQL + Redis
# ============================================

version: "3.8"

services:
  # ----------------------------------------
  # TRAEFIK - Reverse Proxy & Edge Router
  # ----------------------------------------
  traefik:
    image: traefik:v3.0
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    ports:
      - "80:80"      # HTTP (redirects to HTTPS)
      - "443:443"    # HTTPS
    volumes:
      # Docker socket - allows Traefik to detect containers
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # Traefik configuration
      - ./traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      # Let's Encrypt certificates
      - ./letsencrypt:/letsencrypt
      # Log files
      - ./traefik/logs:/var/log/traefik
    networks:
      - identity-network
    labels:
      # Enable Traefik for this container
      - "traefik.enable=true"
      # Dashboard router
      - "traefik.http.routers.traefik.rule=Host(\`traefik.yourdomain.com\`)"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik.service=api@internal"
      # Protect dashboard with Authentik
      - "traefik.http.routers.traefik.middlewares=authentik@docker"

  # ----------------------------------------
  # POSTGRESQL - Database for Authentik
  # ----------------------------------------
  postgresql:
    image: postgres:16-alpine
    container_name: authentik-postgres
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    volumes:
      - ./postgres-data:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${PG_PASS}
      POSTGRES_USER: authentik
      POSTGRES_DB: authentik
    networks:
      - identity-network

  # ----------------------------------------
  # REDIS - Cache & Session Store
  # ----------------------------------------
  redis:
    image: redis:alpine
    container_name: authentik-redis
    restart: unless-stopped
    command: --save 60 1 --loglevel warning
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    volumes:
      - ./redis-data:/data
    networks:
      - identity-network

  # ----------------------------------------
  # AUTHENTIK SERVER - Identity Provider
  # ----------------------------------------
  authentik-server:
    image: ghcr.io/goauthentik/server:2024.2.2
    container_name: authentik-server
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    volumes:
      - ./authentik/media:/media
      - ./authentik/templates:/templates
    depends_on:
      postgresql:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - identity-network
    labels:
      - "traefik.enable=true"
      # Main Authentik router
      - "traefik.http.routers.authentik.rule=Host(\`authentik.yourdomain.com\`)"
      - "traefik.http.routers.authentik.entrypoints=websecure"
      - "traefik.http.routers.authentik.tls.certresolver=letsencrypt"
      - "traefik.http.services.authentik.loadbalancer.server.port=9000"
      # Forward Auth middleware for protecting other apps
      - "traefik.http.middlewares.authentik.forwardauth.address=http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
      - "traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true"
      - "traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version"

  # ----------------------------------------
  # AUTHENTIK WORKER - Background Tasks
  # ----------------------------------------
  authentik-worker:
    image: ghcr.io/goauthentik/server:2024.2.2
    container_name: authentik-worker
    restart: unless-stopped
    command: worker
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    volumes:
      - ./authentik/media:/media
      - ./authentik/templates:/templates
    depends_on:
      postgresql:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - identity-network

# ----------------------------------------
# NETWORKS
# ----------------------------------------
networks:
  identity-network:
    name: identity-network
    driver: bridge
EOF

# Replace yourdomain.com with your actual domain
# Example: sed -i 's/yourdomain.com/homelab.example.com/g' ...
sed -i 's/yourdomain.com/YOUR_ACTUAL_DOMAIN.com/g' \
    ~/identity-stack/docker-compose.yml

# Verify the change
grep "Host" ~/identity-stack/docker-compose.yml

# Navigate to project directory
cd ~/identity-stack

# Pull the latest images
docker compose pull

# Start all services in detached mode
# -d = run in background
docker compose up -d

# Watch the logs to monitor startup (Ctrl+C to exit)
docker compose logs -f

https://authentik.yourdomain.com/if/flow/initial-setup/

https://authentik.yourdomain.com