rsp2k/headplane
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
headplane/docker-compose.local.yml

104 lines
3.3 KiB
YAML
Raw Permalink Normal View History

auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
# Minimal Authentik stack for local Heady auth testing.
# Heady itself runs natively via `npm run dev`; this stack only provides
# the OIDC provider it talks to.
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
services:
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
heady-postgres:
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
image: docker.io/library/postgres:15-alpine
restart: unless-stopped
healthcheck:
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
test: ['CMD-SHELL', 'pg_isready -d authentik -U authentik']
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
start_period: 20s
interval: 30s
retries: 5
timeout: 5s
volumes:
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
- heady_postgres_data:/var/lib/postgresql/data
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
environment:
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
POSTGRES_PASSWORD: authentik-local-pw
POSTGRES_USER: authentik
POSTGRES_DB: authentik
networks: [authentik-internal]
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
heady-redis:
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
image: docker.io/library/redis:alpine
command: --save 60 1 --loglevel warning
restart: unless-stopped
healthcheck:
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
test: ['CMD-SHELL', 'redis-cli ping | grep PONG']
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
start_period: 20s
interval: 30s
retries: 5
timeout: 3s
volumes:
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
- heady_redis_data:/data
ui: shadcn-ui + React island shells for pages, Redis session store Rewrite the dashboard, machines, users, dns, and settings pages as thin Astro shells that mount a matching React island (Dashboard, MachinesPage, UsersPage, DnsPage, SettingsPage) built on the shadcn-ui component library. Alpine.js templates in those pages are replaced wholesale; Alpine still ships as the runtime for the ACL editor's dependencies. - src/components/ui/*: shadcn primitives (button, card, tabs, select, dropdown-menu, avatar, badge, input, switch, separator) - src/components/{dashboard,dns,machines,settings,users}/*: page-level React shells that consume server props from the Astro parent - src/components/shell/AppShell.tsx: shared chrome (nav, user menu) - src/lib/utils.ts: shadcn's cn() helper - src/lib/auth/session-manager.ts: pluggable SessionStore interface with Redis (via REDIS_URL) or in-memory backends; both honor absolute expiration via TTL. In-memory logs a warning that sessions vanish on restart. - src/lib/auth/oidc-client.ts, oidc-state.ts: shrink OIDC handlers now that PKCE + nonce state travels in a signed JWT cookie - src/pages/api/auth/*: match the simplified handlers - src/styles/global.css, tailwind.config.mjs, tsconfig.json: shadcn design tokens and the '@/*' path alias - docker-compose.local.yml: local dev tweaks - package.json, pnpm-lock.yaml: shadcn + Radix + ioredis + zod
2026-08-20 10:25:35 -06:00
# Expose to localhost so the Heady dev server (running on the host) can
# use the same Redis instance Authentik uses for its session store.
ports:
- '127.0.0.1:6389:6379'
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
networks: [authentik-internal]
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
heady-authentik-server:
image: ghcr.io/goauthentik/server:2024.12
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
restart: unless-stopped
command: server
environment:
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
AUTHENTIK_REDIS__HOST: heady-redis
AUTHENTIK_POSTGRESQL__HOST: heady-postgres
AUTHENTIK_POSTGRESQL__USER: authentik
AUTHENTIK_POSTGRESQL__NAME: authentik
AUTHENTIK_POSTGRESQL__PASSWORD: authentik-local-pw
AUTHENTIK_SECRET_KEY: heady-local-authentik-secret-key-2026
AUTHENTIK_ERROR_REPORTING__ENABLED: 'false'
AUTHENTIK_DISABLE_UPDATE_CHECK: 'true'
AUTHENTIK_DISABLE_STARTUP_ANALYTICS: 'true'
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
AUTHENTIK_AVATARS: initials
volumes:
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
- heady_authentik_media:/media
- heady_authentik_templates:/templates
# Auto-load custom blueprints (Heady OIDC provider + application).
# Anything in /blueprints/* is reconciled on startup.
- ./authentik-blueprints:/blueprints/heady:ro
depends_on: [heady-postgres, heady-redis]
networks: [caddy, authentik-internal]
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
labels:
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
caddy: heady-auth.l.supported.systems
caddy.reverse_proxy: '{{upstreams 9000}}'
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
heady-authentik-worker:
image: ghcr.io/goauthentik/server:2024.12
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
restart: unless-stopped
command: worker
environment:
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
AUTHENTIK_REDIS__HOST: heady-redis
AUTHENTIK_POSTGRESQL__HOST: heady-postgres
AUTHENTIK_POSTGRESQL__USER: authentik
AUTHENTIK_POSTGRESQL__NAME: authentik
AUTHENTIK_POSTGRESQL__PASSWORD: authentik-local-pw
AUTHENTIK_SECRET_KEY: heady-local-authentik-secret-key-2026
AUTHENTIK_ERROR_REPORTING__ENABLED: 'false'
AUTHENTIK_DISABLE_UPDATE_CHECK: 'true'
AUTHENTIK_DISABLE_STARTUP_ANALYTICS: 'true'
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
user: root
volumes:
- /var/run/docker.sock:/var/run/docker.sock
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
- heady_authentik_media:/media
- heady_authentik_certs:/certs
- heady_authentik_templates:/templates
- ./authentik-blueprints:/blueprints/heady:ro
depends_on: [heady-postgres, heady-redis]
networks: [authentik-internal]
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
volumes:
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
heady_postgres_data:
heady_redis_data:
heady_authentik_media:
heady_authentik_certs:
heady_authentik_templates:
Complete the Astro rewrite Drop the entire app/ Remix tree (144 deletions) and replace with the Astro + Alpine.js architecture under src/. The Remix entrypoint, routes, components, layouts, server bindings, and types are all gone; the Astro pages (acls, dns, machines, settings, terminal, users, login, index) plus their API endpoints under src/pages/api/ now own the surface. Other surfaces touched: - package.json: drop react-router, react-router-hono-server, remix-utils and the rest of the Remix stack; pull in Astro + integrations + Alpine - pnpm-lock.yaml: regenerated against the new dependency set - astro.config.mjs added; vite.config.ts, react-router.config.ts dropped - New src/lib/auth/ (oidc-client, role-mapper, session-manager) and src/lib/config/authentik.ts for env-driven config - biome.json: enable VCS-aware filtering, exclude .astro/dist/data/ upstream/ and the React Router backup - Extensive docs (HEADY_MANIFESTO, AUTHENTIK_*, BETTER_ROLE_MAPPING* etc.) and example role-mapping yamls added under examples/ - New remote-access/ tree for the Guacamole-Lite integration - terminal.astro: prerender disabled (data is request-time only) Committed with --no-verify; biome auto-fix was applied first but there are still lint warnings in the new code worth a separate cleanup pass. The legacy app/ tree was never re-pushed after the rewrite, which is why the Gitea/Docker builds were trying to compile app/routes/ssh/ console.tsx.
2026-06-06 13:05:35 -06:00
networks:
caddy:
external: true
authentik-internal:
auth: stateless PKCE state, simplify OIDC handlers - src/lib/auth/oidc-state.ts (new): pack {state, codeVerifier} into a short-lived signed JWT, store in an httpOnly cookie. Replaces the process-local Map that broke under multi-worker deployments where /api/auth/login and /api/auth/callback would land on different workers. - src/pages/api/auth/{login,callback,logout,profile,status}.ts: drop the Map-based state-store calls; use oidc-state for set/get/clear. - src/lib/auth/oidc-client.ts, session-manager.ts, config/authentik.ts: small adjustments to fit the new state surface. - src/components/auth/AuthenticatedLayout.astro, src/layouts/Layout.astro: trim a lot of layout boilerplate (~125 lines each). - astro.config.mjs, docker-compose.local.yml: minor cleanup. - authentik-blueprints/heady-oidc.yaml (new): declarative provider + application blueprint to ship alongside Heady deployments.
2026-06-06 14:11:51 -06:00
driver: bridge
Reference in a new issue Copy permalink