services:
  << service_name >>:
    image: ghcr.io/goauthentik/server:latest
    container_name: << service_name >>
    environment:
      - TZ=<< timezone >>
      - AUTHENTIK_SECRET_KEY=<< secret_key >>
      - AUTHENTIK_POSTGRESQL__HOST=<< service_name >>-db
      - AUTHENTIK_POSTGRESQL__USER=authentik
      - AUTHENTIK_POSTGRESQL__NAME=authentik
      - AUTHENTIK_POSTGRESQL__PASSWORD=<< db_password >>
      - AUTHENTIK_REDIS__HOST=<< service_name >>-redis
    volumes:
      - << appdata_dir >>/<< service_name >>:/media
      - << appdata_dir >>/<< service_name >>-templates:/templates
    command: server
    ports:
      - "<< port >>:9000"
    depends_on:
      - << service_name >>-db
      - << service_name >>-redis
    restart: unless-stopped
  << service_name >>-worker:
    image: ghcr.io/goauthentik/server:latest
    container_name: << service_name >>-worker
    command: worker
    environment:
      - AUTHENTIK_SECRET_KEY=<< secret_key >>
      - AUTHENTIK_POSTGRESQL__HOST=<< service_name >>-db
      - AUTHENTIK_POSTGRESQL__USER=authentik
      - AUTHENTIK_POSTGRESQL__NAME=authentik
      - AUTHENTIK_POSTGRESQL__PASSWORD=<< db_password >>
      - AUTHENTIK_REDIS__HOST=<< service_name >>-redis
    volumes:
      - << appdata_dir >>/<< service_name >>/media:/media
      - << appdata_dir >>/<< service_name >>-templates:/templates
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      - << service_name >>-db
      - << service_name >>-redis
    restart: unless-stopped
  << service_name >>-db:
    image: postgres:16-alpine
    container_name: << service_name >>-db
    environment:
      - POSTGRES_DB=authentik
      - POSTGRES_USER=authentik
      - POSTGRES_PASSWORD=<< db_password >>
    volumes:
      - << appdata_dir >>/<< service_name >>-db:/var/lib/postgresql/data
    restart: unless-stopped
  << service_name >>-redis:
    image: valkey/valkey:8-alpine
    container_name: << service_name >>-redis
    command: valkey-server --save 60 1
    volumes:
      - << appdata_dir >>/<< service_name >>-redis:/data
    restart: unless-stopped