110 lines
3.1 KiB
YAML
110 lines
3.1 KiB
YAML
# authentik
|
|
|
|
## サーバーを立てる手順
|
|
|
|
```
|
|
mkdir -p /opt/authentik
|
|
chown $USER:$USER /opt/authentik
|
|
|
|
# 公式 compose を取得
|
|
wget https://docs.goauthentik.io/compose.yml
|
|
# curl を使うなら:
|
|
# curl -O https://docs.goauthentik.io/compose.yml
|
|
|
|
# .env を作成
|
|
echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
|
|
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env
|
|
|
|
# 必要なら公開ポート変更
|
|
# echo "COMPOSE_PORT_HTTP=80" >> .env
|
|
# echo "COMPOSE_PORT_HTTPS=443" >> .env
|
|
|
|
# イメージ取得と起動
|
|
docker compose -f compose.yml pull
|
|
docker compose -f compose.yml up -d
|
|
```
|
|
|
|
## 初期セットアップ
|
|
```
|
|
http://<サーバのIPまたはホスト名>:9000/if/flow/initial-setup/
|
|
```
|
|
もしくは、
|
|
```
|
|
docker compose exec server ak changepassword akadmin
|
|
```
|
|
- 注意：サーバ立ち上がった後に実行
|
|
- `docker compose exec` ... 起動中コンテナの中でコマンド実行
|
|
- `server` ... compose内のauthentik serverサービス名
|
|
- `ak` ... authentikの管理CLIコマンド
|
|
- `changepassword` ... パスワード変更サブコマンド
|
|
- `akadmin` ... 対象ユーザー名(初期管理者)
|
|
|
|
実行イメージ
|
|
```
|
|
docker compose exec server ak changepassword akadmin
|
|
( 大量のログ )
|
|
Changing password for user 'akadmin'
|
|
Password:
|
|
Password (again):
|
|
( ログ )
|
|
Password changed successfully for user 'akadmin'
|
|
```
|
|
|
|
## 補足：Nginxの設定
|
|
`/etc/nginx/sites-available/auth.unchioshi.net`:
|
|
```
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl http2;
|
|
server_name auth.unchioshi.net;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/unchioshi.net/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/unchioshi.net/privkey.pem;
|
|
|
|
client_max_body_size 16m;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:9000;
|
|
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
|
|
proxy_read_timeout 300;
|
|
proxy_send_timeout 300;
|
|
}
|
|
|
|
location /-/metrics/ {
|
|
deny all;
|
|
return 404;
|
|
}
|
|
}
|
|
```
|
|
|
|
サーバー証明書：
|
|
```
|
|
ubuntu@localhost:~$ sudo certbot certificates
|
|
Saving debug log to /var/log/letsencrypt/letsencrypt.log
|
|
|
|
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
|
Found the following certs:
|
|
Certificate Name: unchioshi.net
|
|
Serial Number: 6a9796023640060b9b76f0b64f322bb1122
|
|
Key Type: ECDSA
|
|
Domains: unchioshi.net auth.unchioshi.net git.unchioshi.net img.unchioshi.net wiki.unchioshi.net
|
|
Expiry Date: 2026-12-20 04:38:25+00:00 (VALID: 88 days)
|
|
Certificate Path: /etc/letsencrypt/live/unchioshi.net/fullchain.pem
|
|
Private Key Path: /etc/letsencrypt/live/unchioshi.net/privkey.pem
|
|
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
|
ubuntu@localhost:~$
|
|
``` |