ansible for authentik deployment.

ansible/playbooks/roles/authentik/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: roles/authentik/defaults/main.yml
+# ------------------------------------------------------------------------------
+
+authentik_base_dir: /opt/docker/authentik
+
+# All secrets MUST be set in vault
+authentik_secret_key: ""
+authentik_admin_password: ""
+authentik_database_password: ""

ansible/playbooks/roles/authentik/handlers/main.yml

@@ -0,0 +1,8 @@
+# ------------------------------------------------------------------------------
+# FILE: roles/authentik/handlers/main.yml
+# ------------------------------------------------------------------------------
+
+- name: restart authentik
+  community.docker.docker_compose_v2:
+    project_src: "{{ authentik_base_dir }}"
+    state: restarted

ansible/playbooks/roles/authentik/tasks/main.yml

@@ -0,0 +1,37 @@
+# ------------------------------------------------------------------------------
+# FILE: roles/authentik/tasks/main.yml
+# DESCRIPTION: Deploys Authentik from boilerplate-generated files in the repo.
+#              The compose.yaml lives in boilerplates/authentik/.
+#              The .env file is templated to inject secrets from Ansible vault.
+# ------------------------------------------------------------------------------
+
+- name: Create Authentik directory structure
+  file:
+    path: "{{ authentik_base_dir }}"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: docker
+    mode: '0775'
+
+- name: Copy compose.yaml from boilerplate
+  copy:
+    src: "{{ playbook_dir }}/../../boilerplates/authentik/compose.yaml"
+    dest: "{{ authentik_base_dir }}/compose.yaml"
+    owner: "{{ ansible_user }}"
+    group: docker
+    mode: '0644'
+  notify: restart authentik
+
+- name: Deploy .env with secrets from vault
+  template:
+    src: env.j2
+    dest: "{{ authentik_base_dir }}/.env"
+    owner: "{{ ansible_user }}"
+    group: docker
+    mode: '0600'
+  notify: restart authentik
+
+- name: Start Authentik
+  community.docker.docker_compose_v2:
+    project_src: "{{ authentik_base_dir }}"
+    state: present

ansible/playbooks/roles/authentik/templates/env.j2

@@ -0,0 +1,4 @@
+# Managed by Ansible — do not edit manually
+AUTHENTIK_SECRET_KEY={{ authentik_secret_key }}
+DATABASE_PASSWORD={{ authentik_database_password }}
+AUTHENTIK_ADMIN_PASSWORD={{ authentik_admin_password }}