Authentik SSO einrichten: Sicherer Zugriff auf mehrere Anwendungen

mkdir -p /opt/authentik && cd /opt/authentik
wget -O compose.yml https://docs.goauthentik.io/compose.yml

echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env
echo "AUTHENTIK_ERROR_REPORTING__ENABLED=false" >> .env

AUTHENTIK_EMAIL__HOST=smtp.example.com
AUTHENTIK_EMAIL__PORT=587
[email protected]
AUTHENTIK_EMAIL__PASSWORD=SMTP_PAROLASI
AUTHENTIK_EMAIL__USE_TLS=true
[email protected]

sudo docker compose -f compose.yml config
sudo docker compose -f compose.yml up -d
sudo docker compose -f compose.yml ps
curl -I http://127.0.0.1:9000/if/flow/initial-setup/

sudo docker compose -f compose.yml run --rm worker ak dump_config
sudo docker compose -f compose.yml logs --since 10m server worker

sudo docker compose -f compose.yml exec -T postgresql pg_dump -U authentik -d authentik -Fc > authentik-$(date +%F).dump
sha256sum authentik-$(date +%F).dump

sudo docker compose -f compose.yml exec server ak changepassword akadmin

cd /opt/authentik
sudo docker compose -f compose.yml pull
sudo docker compose -f compose.yml up -d
sudo docker compose -f compose.yml ps

sudo apt update
sudo apt install -y nginx certbot python3-certbot-nginx
sudo tee /etc/nginx/sites-available/sso.example.com > /dev/null <<'NGINX'
server {
    listen 80;
    listen [::]:80;
    server_name sso.example.com;
    client_max_body_size 10G;
    proxy_read_timeout 3600;
    proxy_send_timeout 3600;
    location / {
        proxy_pass http://127.0.0.1:9000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}
NGINX
sudo ln -s /etc/nginx/sites-available/sso.example.com /etc/nginx/sites-enabled/sso.example.com
sudo nginx -t
sudo systemctl reload nginx

sudo certbot --nginx -d sso.example.com --redirect --agree-tos --no-eff-email -m [email protected]
sudo certbot renew --dry-run
curl -I https://sso.example.com
openssl s_client -connect sso.example.com:443 -servername sso.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates