# authentik

## サーバーを立てる手順

```
mkdir -p /opt/authentik
chown $USER:$USER /opt/authentik

# 公式 compose を取得
wget https://docs.goauthentik.io/compose.yml
# curl を使うなら:
# curl -O https://docs.goauthentik.io/compose.yml

# .env を作成
echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env

# 必要なら公開ポート変更
# echo "COMPOSE_PORT_HTTP=80" >> .env
# echo "COMPOSE_PORT_HTTPS=443" >> .env

# イメージ取得と起動
docker compose -f compose.yml pull
docker compose -f compose.yml up -d
```

## 初期セットアップ
```
http://<サーバのIPまたはホスト名>:9000/if/flow/initial-setup/
```
もしくは、
```
docker compose exec server ak changepassword akadmin
```
- 注意：サーバ立ち上がった後に実行
- `docker compose exec` ... 起動中コンテナの中でコマンド実行
- `server` ... compose内のauthentik serverサービス名
- `ak` ... authentikの管理CLIコマンド
- `changepassword` ... パスワード変更サブコマンド
- `akadmin` ... 対象ユーザー名(初期管理者)

実行イメージ
```
docker compose exec server ak changepassword akadmin
( 大量のログ )
Changing password for user 'akadmin'
Password: 
Password (again): 
( ログ )
Password changed successfully for user 'akadmin'
```

## 補足：Nginxの設定
`/etc/nginx/sites-available/auth.unchioshi.net`:
```
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 443 ssl http2;
    server_name auth.unchioshi.net;

    ssl_certificate     /etc/letsencrypt/live/unchioshi.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/unchioshi.net/privkey.pem;

    client_max_body_size 16m;

    location / {
        proxy_pass http://127.0.0.1:9000;

        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $host;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        proxy_read_timeout 300;
        proxy_send_timeout 300;
    }

    location /-/metrics/ {
        deny all;
        return 404;
    }
}
```

サーバー証明書：
```
ubuntu@localhost:~$ sudo certbot certificates 
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: unchioshi.net
    Serial Number: 6a9796023640060b9b76f0b64f322bb1122
    Key Type: ECDSA
    Domains: unchioshi.net auth.unchioshi.net git.unchioshi.net img.unchioshi.net wiki.unchioshi.net
    Expiry Date: 2026-12-20 04:38:25+00:00 (VALID: 88 days)
    Certificate Path: /etc/letsencrypt/live/unchioshi.net/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/unchioshi.net/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ubuntu@localhost:~$ 
```