Add authentik role

2026-10-04 19:34:22 +02:00
parent 1350a98aac
commit e4613ccb53
11 changed files with 206 additions and 0 deletions
@@ -0,0 +1,117 @@
+---
+- name: Install dependencies for authentik
+  xbps:
+    pkg:
+      - podman
+      - python3-dnspython
+      - python3-psycopg2
+    state: present
+
+- name: add dns entry
+  community.general.nsupdate:
+    key_name: "ansible"
+    key_secret: "{{ dns_tsig_key }}"
+    key_algorithm: "hmac-sha512"
+    server: "127.0.0.1"
+    zone: "cosmosim.dev"
+    record: "{{ zitadel_domain }}."
+    type: "CNAME"
+    value: "{{ inventory_hostname }}."
+    state: present
+
+- name: Create authentik user
+  ansible.builtin.user:
+    name: authentik
+    state: present
+    createhome: true
+
+- name: Create postgres role
+  community.postgresql.postgresql_user:
+    name: "{{ authentik_db_user }}"
+    state: present
+    password: "{{ authentik_db_pass }}"
+  become: true
+  become_user: postgres
+
+- name: Create postgres database
+  community.postgresql.postgresql_db:
+    name: "{{ authentik_db_name }}"
+    owner: "{{ authentik_db_user }}"
+    state: present
+  become: true
+  become_user: postgres
+
+- name: Create podman network
+  containers.podman.podman_network:
+    name: authentik
+  become: true
+  become_user: authentik
+
+- name: Create runtime directory
+  ansible.builtin.file:
+    path: /home/authentik/{{ item }}
+    owner: authentik
+    group: authentik
+    mode: "0775"
+    state: directory
+  with_items:
+    - data
+    - certs
+    - custom-templates
+
+- name: Upload configuration
+  ansible.builtin.template:
+    src: templates/conf.j2
+    dest: /etc/authentik.env
+    owner: root
+    group: authentik
+    mode: "0640"
+  notify:
+    - Restart authentik-server
+    - Restart authentik-worker
+
+- name: Install Service (1/3)
+  ansible.builtin.file:
+    path: /etc/sv/{{item}}
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  with_items:
+    - authentik-server
+    - authentik-server/log
+    - authentik-worker
+    - authentik-worker/log
+
+- name: Install Service (2/3)
+  ansible.builtin.template:
+    src: authentik.run.j2
+    dest: /etc/sv/authentik-{{ item }}/run
+    owner: root
+    group: root
+    mode: "0755"
+  notify:
+    - Restart authentik-server
+    - Restart authentik-worker
+  with_items:
+    - worker
+    - server
+
+- name: Install Service (3/3)
+  ansible.builtin.template:
+    src: "log.run.j2"
+    dest: "/etc/sv/{{ item }}/log/run"
+    owner: root
+    group: root
+    mode: "0755"
+  with_items:
+    - authentik-server
+    - authentik-worker
+
+- name: Enable services
+  runit:
+    name: "{{ item }}"
+    enabled: true
+  with_items:
+    - authentik-server
+    - authentik-worker