Add authentik role

roles/authentik/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+authentik_db_name: authentik
+authentik_db_user: authentik
+
+authentik_tag: 2026.8.3

roles/authentik/handlers/main.yml

@@ -0,0 +1,10 @@
+---
+- name: Restart authentik-server
+  runit:
+    name: authentik-server
+    state: restarted
+
+- name: Restart authentik-worker
+  runit:
+    name: authentik-worker
+    state: restarted

roles/authentik/tasks/main.yml

@@ -0,0 +1,117 @@
+---
+- name: Install dependencies for authentik
+  xbps:
+    pkg:
+      - podman
+      - python3-dnspython
+      - python3-psycopg2
+    state: present
+
+- name: add dns entry
+  community.general.nsupdate:
+    key_name: "ansible"
+    key_secret: "{{ dns_tsig_key }}"
+    key_algorithm: "hmac-sha512"
+    server: "127.0.0.1"
+    zone: "cosmosim.dev"
+    record: "{{ zitadel_domain }}."
+    type: "CNAME"
+    value: "{{ inventory_hostname }}."
+    state: present
+
+- name: Create authentik user
+  ansible.builtin.user:
+    name: authentik
+    state: present
+    createhome: true
+
+- name: Create postgres role
+  community.postgresql.postgresql_user:
+    name: "{{ authentik_db_user }}"
+    state: present
+    password: "{{ authentik_db_pass }}"
+  become: true
+  become_user: postgres
+
+- name: Create postgres database
+  community.postgresql.postgresql_db:
+    name: "{{ authentik_db_name }}"
+    owner: "{{ authentik_db_user }}"
+    state: present
+  become: true
+  become_user: postgres
+
+- name: Create podman network
+  containers.podman.podman_network:
+    name: authentik
+  become: true
+  become_user: authentik
+
+- name: Create runtime directory
+  ansible.builtin.file:
+    path: /home/authentik/{{ item }}
+    owner: authentik
+    group: authentik
+    mode: "0775"
+    state: directory
+  with_items:
+    - data
+    - certs
+    - custom-templates
+
+- name: Upload configuration
+  ansible.builtin.template:
+    src: templates/conf.j2
+    dest: /etc/authentik.env
+    owner: root
+    group: authentik
+    mode: "0640"
+  notify:
+    - Restart authentik-server
+    - Restart authentik-worker
+
+- name: Install Service (1/3)
+  ansible.builtin.file:
+    path: /etc/sv/{{item}}
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  with_items:
+    - authentik-server
+    - authentik-server/log
+    - authentik-worker
+    - authentik-worker/log
+
+- name: Install Service (2/3)
+  ansible.builtin.template:
+    src: authentik.run.j2
+    dest: /etc/sv/authentik-{{ item }}/run
+    owner: root
+    group: root
+    mode: "0755"
+  notify:
+    - Restart authentik-server
+    - Restart authentik-worker
+  with_items:
+    - worker
+    - server
+
+- name: Install Service (3/3)
+  ansible.builtin.template:
+    src: "log.run.j2"
+    dest: "/etc/sv/{{ item }}/log/run"
+    owner: root
+    group: root
+    mode: "0755"
+  with_items:
+    - authentik-server
+    - authentik-worker
+
+- name: Enable services
+  runit:
+    name: "{{ item }}"
+    enabled: true
+  with_items:
+    - authentik-server
+    - authentik-worker

roles/authentik/templates/authentik.run.j2

@@ -0,0 +1,20 @@
+#!/bin/sh
+exec 2>&1
+export HOME=/home/authentik
+
+exec chpst -u authentik:authentik -C $HOME \
+  podman run -it --rm --sig-proxy \
+    --name=authentik-{{ item }} \
+    --env-file=/etc/authentik.env \
+{% if item == "server" %}
+    -p 9000:9000 \
+{% endif %}
+{% if mailhost_is_local is defined and mailhost_is_local %}
+    --add-host={{ mail_host }}:host-gateway \
+{% endif %}
+    --network=authentik \
+    -v ./data:/data \
+    -v ./certs:/certs \
+    -v ./custom-templates:/templates \
+    --mount type=bind,src=/tmp/.s.PGSQL.5432,target=/tmp/.s.PGSQL.5432 \
+    ghcr.io/goauthentik/server:{{ authentik_tag }} {{ item }}

roles/authentik/templates/conf.j2

@@ -0,0 +1,19 @@
+AUTHENTIK_POSTGRESQL__HOST=/tmp
+AUTHENTIK_POSTGRESQL__NAME={{ authentik_db_name }}
+AUTHENTIK_POSTGRESQL__PASSWORD={{ authentik_db_pass }}
+AUTHENTIK_POSTGRESQL__USER={{ authentik_db_user }}
+AUTHENTIK_SECRET_KEY={{ authentik_secret_key }}
+
+# SMTP server
+AUTHENTIK_EMAIL__HOST={{ mail_host }}
+AUTHENTIK_EMAIL__PORT=465
+# Optionally authenticate (don't add quotation marks to your password)
+AUTHENTIK_EMAIL__USERNAME=auth@cosmosim.dev
+AUTHENTIK_EMAIL__PASSWORD={{ authentik_mail_pass }}
+# STARTTLS / explicit TLS, usually on port 587
+AUTHENTIK_EMAIL__USE_TLS=false
+# Implicit TLS/SSL on the SMTP connection (`USE_SSL` is the variable name), usually on port 465
+AUTHENTIK_EMAIL__USE_SSL=true
+AUTHENTIK_EMAIL__TIMEOUT=10
+# Sender email address; verify that the domain is valid.
+AUTHENTIK_EMAIL__FROM=auth@cosmosim.dev

roles/authentik/templates/log.run.j2

@@ -0,0 +1,2 @@
+#!/bin/sh
+exec vlogger -t {{ item }}