ansible for authentik deployment.

ansible/playbooks/deploy_authentik.yml

@@ -0,0 +1,18 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/deploy_authentik.yml
+# DESCRIPTION: Deploys Authentik identity provider on turnstile.
+#              Installs Docker and configures Authentik with PostgreSQL and Redis.
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/deploy_authentik.yml
+# ------------------------------------------------------------------------------
+
+- name: Deploy Authentik identity provider
+  hosts: authentik_server
+  become: true
+
+  roles:
+    - common
+    - docker-host
+    - authentik

ansible/playbooks/roles/authentik/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: roles/authentik/defaults/main.yml
+# ------------------------------------------------------------------------------
+
+authentik_base_dir: /opt/docker/authentik
+
+# All secrets MUST be set in vault
+authentik_secret_key: ""
+authentik_admin_password: ""
+authentik_database_password: ""

ansible/playbooks/roles/authentik/handlers/main.yml

@@ -0,0 +1,8 @@
+# ------------------------------------------------------------------------------
+# FILE: roles/authentik/handlers/main.yml
+# ------------------------------------------------------------------------------
+
+- name: restart authentik
+  community.docker.docker_compose_v2:
+    project_src: "{{ authentik_base_dir }}"
+    state: restarted

ansible/playbooks/roles/authentik/tasks/main.yml

@@ -0,0 +1,37 @@
+# ------------------------------------------------------------------------------
+# FILE: roles/authentik/tasks/main.yml
+# DESCRIPTION: Deploys Authentik from boilerplate-generated files in the repo.
+#              The compose.yaml lives in boilerplates/authentik/.
+#              The .env file is templated to inject secrets from Ansible vault.
+# ------------------------------------------------------------------------------
+
+- name: Create Authentik directory structure
+  file:
+    path: "{{ authentik_base_dir }}"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: docker
+    mode: '0775'
+
+- name: Copy compose.yaml from boilerplate
+  copy:
+    src: "{{ playbook_dir }}/../../boilerplates/authentik/compose.yaml"
+    dest: "{{ authentik_base_dir }}/compose.yaml"
+    owner: "{{ ansible_user }}"
+    group: docker
+    mode: '0644'
+  notify: restart authentik
+
+- name: Deploy .env with secrets from vault
+  template:
+    src: env.j2
+    dest: "{{ authentik_base_dir }}/.env"
+    owner: "{{ ansible_user }}"
+    group: docker
+    mode: '0600'
+  notify: restart authentik
+
+- name: Start Authentik
+  community.docker.docker_compose_v2:
+    project_src: "{{ authentik_base_dir }}"
+    state: present

ansible/playbooks/roles/authentik/templates/env.j2

@@ -0,0 +1,4 @@
+# Managed by Ansible — do not edit manually
+AUTHENTIK_SECRET_KEY={{ authentik_secret_key }}
+DATABASE_PASSWORD={{ authentik_database_password }}
+AUTHENTIK_ADMIN_PASSWORD={{ authentik_admin_password }}

ansible/playbooks/update_traefik_routes.yml

@@ -0,0 +1,22 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/update_traefik_routes.yml
+# DESCRIPTION: Syncs Traefik dynamic configuration files to lightning-lane.
+#              No restart needed — Traefik watches the directory for changes.
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/update_traefik_routes.yml
+# ------------------------------------------------------------------------------
+
+- name: Update Traefik dynamic configuration
+  hosts: load_balancers
+  become: true
+
+  tasks:
+    - name: Sync dynamic configuration from boilerplate
+      copy:
+        src: "{{ playbook_dir }}/../../boilerplates/traefik/dynamic/"
+        dest: /opt/docker/traefik/dynamic/
+        owner: wed
+        group: docker
+        mode: '0644'