version: '3'

services:
  authelia:
    image: authelia/authelia:latest
    container_name: authelia
    restart: always
    environment:
      # Secrets loaded from files — never commit the actual secret files
      AUTHELIA_JWT_SECRET_FILE: /secrets/jwt_secret
      AUTHELIA_SESSION_SECRET_FILE: /secrets/session_secret
      AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: /secrets/storage_encryption_key
      AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: /secrets/oidc_hmac_secret
    volumes:
      - /var/authelia/config:/config
      - /var/authelia/data:/data
      - /var/authelia/secrets:/secrets:ro
    networks:
      authelia_network:
        ipv4_address: 172.26.0.2

  authelia-redis:
    image: redis:alpine
    container_name: authelia-redis
    restart: always
    command: redis-server --appendonly yes
    volumes:
      - /var/authelia/redis:/data
    networks:
      authelia_network:
        ipv4_address: 172.26.0.3

networks:
  authelia_network:
    name: authelia_network
    driver: bridge
    ipam:
      config:
        - subnet: 172.26.0.0/16