Zero-Trust SSO Gateway

# Navigate to project directory
cd ~/homelab-iam

# Generate random passwords automatically
POSTGRES_PASS=$(openssl rand -base64 32 | tr -d '\n')
REDIS_PASS=$(openssl rand -base64 32 | tr -d '\n')
AUTHENTIK_KEY=$(openssl rand -base64 50 | tr -d '\n')

# Create the .env file with your secrets
cat > .env << EOF
# ============================================
# HOMELAB IAM CONFIGURATION
# ============================================

# IMPORTANT: Replace these with YOUR values!
DOMAIN=yourdomain.com
ACME_EMAIL=your-email@example.com

# Database passwords (auto-generated - don't change)
POSTGRES_PASSWORD=${POSTGRES_PASS}
REDIS_PASSWORD=${REDIS_PASS}
AUTHENTIK_SECRET_KEY=${AUTHENTIK_KEY}
EOF

# Protect the file
chmod 600 .env

# Show the file contents
cat .env

cat > ~/homelab-iam/traefik/traefik.yml << 'EOF'
# Traefik Configuration
api:
  dashboard: true

log:
  level: INFO

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"

certificatesResolvers:
  letsencrypt:
    acme:
      email: ${ACME_EMAIL}
      storage: /etc/traefik/acme/acme.json
      httpChallenge:
        entryPoint: web

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: traefik-public
  file:
    directory: /etc/traefik/dynamic
    watch: true
EOF

cat > ~/homelab-iam/traefik/dynamic/middlewares.yml << 'EOF'
http:
  middlewares:
    authentik-auth:
      forwardAuth:
        address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid

    security-headers:
      headers:
        frameDeny: true
        contentTypeNosniff: true
        browserXssFilter: true
        stsSeconds: 31536000
        stsIncludeSubdomains: true
EOF

# Create certificate storage file
touch ~/homelab-iam/traefik/acme/acme.json
chmod 600 ~/homelab-iam/traefik/acme/acme.json

cat > ~/homelab-iam/docker-compose.yml << 'EOF'
services:
  # TRAEFIK - Reverse Proxy
  traefik:
    image: traefik:v3.0
    container_name: traefik
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - ./traefik/dynamic:/etc/traefik/dynamic:ro
      - ./traefik/acme:/etc/traefik/acme
    environment:
      - ACME_EMAIL=${ACME_EMAIL}
    networks:
      - traefik-public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(\`traefik.${DOMAIN}\`)"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik.service=api@internal"

  # POSTGRESQL - Database
  postgres:
    image: postgres:16-alpine
    container_name: postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: authentik
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: authentik
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - authentik-internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U authentik"]
      interval: 10s
      timeout: 5s
      retries: 5

  # REDIS - Session Cache
  redis:
    image: redis:7-alpine
    container_name: redis
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis_data:/data
    networks:
      - authentik-internal
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # AUTHENTIK SERVER
  authentik-server:
    image: ghcr.io/goauthentik/server:2024.4.2
    container_name: authentik-server
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_POSTGRESQL__HOST: postgres
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${POSTGRES_PASSWORD}
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_REDIS__PASSWORD: ${REDIS_PASSWORD}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
      AUTHENTIK_ERROR_REPORTING__ENABLED: false
    volumes:
      - authentik_media:/media
      - authentik_templates:/templates
    networks:
      - traefik-public
      - authentik-internal
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.authentik.rule=Host(\`authentik.${DOMAIN}\`)"
      - "traefik.http.routers.authentik.entrypoints=websecure"
      - "traefik.http.routers.authentik.tls.certresolver=letsencrypt"
      - "traefik.http.services.authentik.loadbalancer.server.port=9000"

  # AUTHENTIK WORKER
  authentik-worker:
    image: ghcr.io/goauthentik/server:2024.4.2
    container_name: authentik-worker
    restart: unless-stopped
    command: worker
    environment:
      AUTHENTIK_POSTGRESQL__HOST: postgres
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${POSTGRES_PASSWORD}
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_REDIS__PASSWORD: ${REDIS_PASSWORD}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
    volumes:
      - authentik_media:/media
      - authentik_templates:/templates
    networks:
      - authentik-internal
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

networks:
  traefik-public:
    name: traefik-public
  authentik-internal:
    name: authentik-internal

volumes:
  postgres_data:
  redis_data:
  authentik_media:
  authentik_templates:
EOF

# Navigate to project directory
cd ~/homelab-iam

# Pull all images first
docker compose pull

# Start all services
docker compose up -d

# Check status
docker compose ps

# Check all containers are running
docker compose ps

# Check for any errors
docker compose logs --tail=20

# Check Authentik specifically
docker logs authentik-server --tail=20

# Check Traefik
docker logs traefik --tail=20