# authentik_outpost_proxy

Deploys an [authentik](https://goauthentik.io) proxy (ForwardAuth)
outpost via Docker Compose. The outpost serves the
`/outpost.goauthentik.io/auth/*` endpoints locally, so a Traefik
`ForwardAuth` middleware on the same host can gate services behind
authentik without routing the auth subrequest through additional reverse
proxies.

Use this when the protected service runs on a **different host** than the
authentik server: the embedded outpost only works for services co-located
with authentik (the subrequest must reach it without an intermediate proxy
mangling `X-Forwarded-Host`). Co-locating a proxy outpost with the service
keeps the ForwardAuth subrequest on the local docker network.

The outpost connects back to an authentik server using an outpost token
issued in the authentik admin interface (register the outpost there and
assign the proxy providers it should serve). The image version must match
the authentik server version.

## Requirements

- Docker and Docker Compose on the target host (e.g. via
  `digitalboard.core.base`)
- Ansible collection: `community.docker`
- An authentik proxy outpost registered on the server, with the proxy
  providers for the protected services assigned to it.

## Role variables

| Variable | Default | Description |
| --- | --- | --- |
| `authentik_outpost_proxy_image` | `ghcr.io/goauthentik/proxy:2026.2.2` | Outpost image (match the server version). |
| `authentik_outpost_proxy_host` | `https://authentik.local.test` | URL of the authentik server. |
| `authentik_outpost_proxy_token` | `changeme` | Outpost token — **override this**. |
| `authentik_outpost_proxy_insecure` | `"true"` | Skip TLS verification toward the authentik server. |
| `authentik_outpost_proxy_network` | `proxy` | Docker network the local Traefik routers and this outpost share. |
| `authentik_outpost_proxy_extra_hosts` | `[]` | Extra `host:ip` entries for in-container DNS. |

The local ForwardAuth middleware then points at the container over the
shared network, e.g.
`http://authentik-outpost-proxy-proxy-1:9000/outpost.goauthentik.io/auth/traefik`.

## Example

```yaml
- hosts: storage
  become: true
  roles:
    - role: digitalboard.core.authentik_outpost_proxy
      vars:
        authentik_outpost_proxy_host: "https://auth.example.com"
        authentik_outpost_proxy_token: "{{ vault_authentik_proxy_outpost_token }}"
```

## License

MIT-0