docs: add articles

2026-09-22 16:11:58 +02:00
parent a865ce0d0c
commit 2e70932cf0
10 changed files with 516 additions and 0 deletions
@@ -0,0 +1,110 @@
+# authentik
+
+## サーバーを立てる手順
+
+```
+mkdir -p /opt/authentik
+chown $USER:$USER /opt/authentik
+
+# 公式 compose を取得
+wget https://docs.goauthentik.io/compose.yml
+# curl を使うなら:
+# curl -O https://docs.goauthentik.io/compose.yml
+
+# .env を作成
+echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
+echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env
+
+# 必要なら公開ポート変更
+# echo "COMPOSE_PORT_HTTP=80" >> .env
+# echo "COMPOSE_PORT_HTTPS=443" >> .env
+
+# イメージ取得と起動
+docker compose -f compose.yml pull
+docker compose -f compose.yml up -d
+```
+
+## 初期セットアップ
+```
+http://<サーバのIPまたはホスト名>:9000/if/flow/initial-setup/
+```
+もしくは、
+```
+docker compose exec server ak changepassword akadmin
+```
+- 注意：サーバ立ち上がった後に実行
+- `docker compose exec` ... 起動中コンテナの中でコマンド実行
+- `server` ... compose内のauthentik serverサービス名
+- `ak` ... authentikの管理CLIコマンド
+- `changepassword` ... パスワード変更サブコマンド
+- `akadmin` ... 対象ユーザー名(初期管理者)
+
+実行イメージ
+```
+docker compose exec server ak changepassword akadmin
+( 大量のログ )
+Changing password for user 'akadmin'
+Password: 
+Password (again): 
+( ログ )
+Password changed successfully for user 'akadmin'
+```
+
+## 補足：Nginxの設定
+`/etc/nginx/sites-available/auth.unchioshi.net`:
+```
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name auth.unchioshi.net;
+
+    ssl_certificate     /etc/letsencrypt/live/unchioshi.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/unchioshi.net/privkey.pem;
+
+    client_max_body_size 16m;
+
+    location / {
+        proxy_pass http://127.0.0.1:9000;
+
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $host;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+
+        proxy_read_timeout 300;
+        proxy_send_timeout 300;
+    }
+
+    location /-/metrics/ {
+        deny all;
+        return 404;
+    }
+}
+```
+
+サーバー証明書：
+```
+ubuntu@localhost:~$ sudo certbot certificates 
+Saving debug log to /var/log/letsencrypt/letsencrypt.log
+
+- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+Found the following certs:
+  Certificate Name: unchioshi.net
+    Serial Number: 6a9796023640060b9b76f0b64f322bb1122
+    Key Type: ECDSA
+    Domains: unchioshi.net auth.unchioshi.net git.unchioshi.net img.unchioshi.net wiki.unchioshi.net
+    Expiry Date: 2026-12-20 04:38:25+00:00 (VALID: 88 days)
+    Certificate Path: /etc/letsencrypt/live/unchioshi.net/fullchain.pem
+    Private Key Path: /etc/letsencrypt/live/unchioshi.net/privkey.pem
+- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+ubuntu@localhost:~$ 
+```