[Unit]
Description=Authentik Worker Service
Wants=network-online.target
After=network.target network-online.target authentik-postgres.container

[Container]
Pod=authentik.pod
ContainerName=authentik-worker
Image=ghcr.io/goauthentik/server:2025.10 
AutoUpdate=registry
Exec=worker
User=root
Environment=AUTHENTIK_POSTGRESQL__HOST=authentik-postgres
Secret=pg_db,type=env,target=AUTHENTIK_POSTGRESQL__NAME
Secret=pg_user,type=env,target=AUTHENTIK_POSTGRESQL__USER
Secret=pg_pw,type=env,target=AUTHENTIK_POSTGRESQL__PASSWORD
Secret=secret_key,type=env,target=AUTHENTIK_SECRET_KEY
Volume=/var/vol/authentik/media:/media:z
Volume=/var/vol/authentik/certs:/certs:z
Volume=/var/vol/authentik/custom-templates:/templates:z

[Service]
Restart=on-failure
RestartSec=60
TimeoutStartSec=60

[Install]
WantedBy=multi-user.target default.target