# The name of the Nomad job.
job_name = "authentik"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The authentik server/worker image (both tasks use it). Pin a tag in production.
image = "ghcr.io/goauthentik/server:latest"

# Host port for the authentik web UI / API.
port = 9000

# AUTHENTIK_SECRET_KEY — a long random value used to sign sessions/tokens. CHANGE THIS (e.g. `openssl rand -base64 50`) and keep it stable.
secret_key = "CHANGE_ME_authentik_secret_key_use_openssl_rand_base64_50"

# Initial password for the built-in `akadmin` user, set on first start. CHANGE THIS. Empty = you set the password via the first-run flow at /if/flow/initial-setup/.
bootstrap_password = ""

# Email for the initial akadmin user (used with bootstrap_password).
bootstrap_email = "admin@example.com"

# Resources for the authentik server task.
server_resources = {
    cpu    = 500
    memory = 512
  }

# Resources for the authentik worker task.
worker_resources = {
    cpu    = 500
    memory = 512
  }

# PostgreSQL image backing authentik.
postgres_image = "postgres:16-alpine"

# Host port PostgreSQL listens on. authentik connects on 127.0.0.1.
db_port = 5432

# Password for the authentik Postgres user. CHANGE THIS. (DB name and user are both "authentik".)
db_password = "authentik"

# Docker named volume for the Postgres data dir (users, apps, flows). Back it up.
db_data_volume = "authentik_db_data"

# Redis image (cache/queues; ephemeral, no volume).
redis_image = "redis:7-alpine"

# Host port Redis listens on.
redis_port = 6379

# Resources for the PostgreSQL task.
postgres_resources = {
    cpu    = 500
    memory = 512
  }

# Placement constraints — pin the job to one node so the Postgres local volume stays put (single all-in-one alloc). On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []