- Add Authentik service stack to infrastructure.yml
- Includes Authentik server, worker, PostgreSQL database, and Redis
- Alternative SSO with web UI for user management
- Access at authentik.${DOMAIN}
- Protected by Authelia SSO (comment out to use standalone)
- Fix Uptime Kuma duplicate listing
- Remove from utilities.yml
- Keep only in monitoring.yml where it belongs
- Add Traefik labels and SSO protection to monitoring instance
- Enable SSO on Jellyseerr by default
- Changed from bypass to protected (security-first approach)
- Users can comment out SSO if needed for public access
- Update SSO toggling documentation
- Emphasize commenting out (not removing) middleware line
- Add docker command examples for running from outside stack folder
- Show both "cd to directory" and "full path" methods
- Add examples for starting and stopping services multiple ways
- Enhance security-first methodology
- Update copilot instructions to default SSO to enabled
- Only Plex and Jellyfin bypass SSO by default
- All other services start secured, expose gradually
- Emphasize commenting (not removing) for easier re-enable
- Update services-reference.md
- Add Authentik to infrastructure section (12 services)
- Move Uptime Kuma to monitoring section (8 services)
- Remove from utilities (now 6 services)
- Update Jellyseerr SSO status from ✗ to ✓
- Improve Authentik documentation with deployment guidance
- Add Authentik environment variables to .env.example
- AUTHENTIK_SECRET_KEY, DB credentials
- Generation instructions included
All changes align with security-first principle: start secure, expose services only when ready for deployment.
Co-authored-by: kelinfoxy <67766943+kelinfoxy@users.noreply.github.com>
- Create core.yml combining DuckDNS, Traefik, Authelia, and Gluetun into single stack
- Simplifies initial deployment (deploy all core services with one command)
- All core services in /opt/stacks/core/ directory
- Reduces complexity for first-time setup
- Add Authelia SSO protection to Homepage and Homarr dashboards
- Prevents exposing service list before authentication
- Both dashboards now require sign-in to access
- Redesign services-reference.md with compact tree-view table
- Reduced from ~460 lines to ~150 lines while keeping all info
- Single comprehensive table with tree structure
- Shows: Stack, Services, SSO status, Storage paths, Access URLs
- Fits on 1-2 screen heights as requested
- Add comprehensive "Toggling SSO On/Off" section
- Quick guide to enable/disable Authelia middleware
- Use cases for development vs production
- AI can automatically toggle SSO when asked
- Add "Authelia Customization" section with:
- Branding and appearance options
- User management via YAML files
- Access control rules examples
- 2FA/TOTP configuration
- Session management settings
- Email notification setup
- Explanation of no web UI (by design, perfect for AI)
- Alternatives with web UI (Authentik, Keycloak)
- Update .github/copilot-instructions.md
- Add core stack explanation
- Update file organization to show core stack structure
- Add SSO toggling instructions
- Update docs/getting-started.md
- Simplify Step 7 to deploy single core stack
- Remove separate steps for DuckDNS, Traefik, Authelia
- Add verification and troubleshooting for core deployment
- Update subsequent steps to Step 8, 9, 10
Co-authored-by: kelinfoxy <67766943+kelinfoxy@users.noreply.github.com>
