Retire Authentik now that every app logs in with Pocket ID

All of Authentik's applications (including Tailscale's tailnet login)
have moved to Pocket ID, and its only recent sign-ins were those
handovers. Drops its stack, the auth. route and DNS record, the auth
subdomain variables, Gotify's leftover hairpin entries, and the dockcheck
exclude; the docs now name Pocket ID as the SSO provider.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/README.md

@@ -12,7 +12,7 @@ Deploys and manages a comprehensive self-hosted infrastructure with 24 container
 - **Firewall Integration**: UFW-Docker script properly configures firewall rules
 
 ### Security Features
-- **Centralized SSO**: Authentik provides OIDC authentication for most services
+- **Centralized SSO**: Pocket ID provides passkey OIDC authentication for most services
 - **Network Isolation**: Services restricted to appropriate network segments
 - **Container Hardening**: Non-root users, capability dropping, security options
 - **Secret Management**: Ansible vault for sensitive configuration
@@ -22,7 +22,7 @@ Deploys and manages a comprehensive self-hosted infrastructure with 24 container
 
 ### Infrastructure (`infrastructure/`)
 - **Caddy** - Reverse proxy with automatic HTTPS (static IP: 172.20.0.5)
-- **Authentik** - Enterprise authentication server (OIDC/SAML SSO)
+- **Pocket ID** - Passkey OIDC provider
 - **Dockge** - Docker compose stack management UI
 
 ### Development (`development/`)
@@ -89,7 +89,7 @@ roles/docker/
 │   ├── infrastructure/
 │   │   ├── main.yml               # Infrastructure category orchestrator
 │   │   ├── caddy.yml              # Reverse proxy
-│   │   └── authentik.yml          # Authentication
+│   │   └── pocketid.yml           # Authentication
 │   ├── development/
 │   │   ├── main.yml               # Development category orchestrator
 │   │   ├── gitea.yml              # Git hosting
@@ -135,7 +135,7 @@ ansible-playbook site.yml -i hosts.yml --tags infrastructure,monitoring
 ### Deploy Individual Services
 ```bash
 # Deploy specific services
-ansible-playbook site.yml -i hosts.yml --tags authentik
+ansible-playbook site.yml -i hosts.yml --tags pocketid
 ansible-playbook site.yml -i hosts.yml --tags gitea,bytestash
 ansible-playbook site.yml -i hosts.yml --tags paperlessngx
 ```
@@ -145,7 +145,7 @@ ansible-playbook site.yml -i hosts.yml --tags paperlessngx
 ### MMDL (Task Management)
 - **URL**: https://tasks.thesatelliteoflove.com
 - **Initial Setup**: Visit `/install` endpoint first to run database migrations
-- **Authentication**: Integrates with Authentik OIDC provider
+- **Authentication**: Integrates with the Pocket ID OIDC provider
 - **Database**: Uses MySQL 8.0 with automatic schema migration
 - **Features**: CalDAV integration, multiple account support, task management
 
@@ -181,7 +181,7 @@ The role uses a centralized variable hierarchy in `group_vars/all/`:
 
 ### Network Configuration
 Services expect to be accessible via subdomains of configured domains:
-- `auth.thesatelliteoflove.com` - Authentik
+- `id.thesatelliteoflove.com` - Pocket ID
 - `git.thesatelliteoflove.com` - Gitea
 - `books.thesatelliteoflove.com` - Kavita
 - `tasks.thesatelliteoflove.com` - MMDL
@@ -203,7 +203,7 @@ Services expect to be accessible via subdomains of configured domains:
 - Restricted access for sensitive tools (Stirling PDF)
 
 ### Authentication
-- Centralized SSO through Authentik for most services
+- Centralized SSO through Pocket ID for most services
 - OAuth integration where supported
 - Secure secret management through Ansible vault
 

roles/docker/tasks/infrastructure/authentik.yml

@@ -1,27 +0,0 @@
-- name: make authentik directories
-  ansible.builtin.file:
-    path: "{{ item}}"
-    state: directory
-  loop:
-    - /opt/stacks/authentik
-
-- name: Template out the compose file
-  ansible.builtin.template:
-    src: authentik-compose.yml.j2
-    dest: /opt/stacks/authentik/compose.yml
-    owner: root
-    mode: '0644'
-
-- name: Template out the .env file
-  ansible.builtin.template:
-    src: authentik-env.j2
-    dest: /opt/stacks/authentik/.env
-    owner: root
-    mode: '0640'
-    group: docker
-
-- name: deploy authentik stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/authentik
-    files:
-    - compose.yml

roles/docker/tasks/infrastructure/main.yml

@@ -5,10 +5,6 @@
   import_tasks: caddy.yml
   tags: caddy
 
-- name: Install authentik
-  import_tasks: authentik.yml
-  tags: authentik
-
 - name: Install pocketid
   import_tasks: pocketid.yml
   tags: pocketid

roles/docker/templates/Caddyfile.j2

@@ -1,7 +1,3 @@
-auth.thesatelliteoflove.com {
-    reverse_proxy authentik-server-1:9000
-}
-
 {{ subdomains.pocketid }} {
     reverse_proxy pocket-id:1411
 }

roles/docker/templates/authentik-compose.yml.j2

@@ -1,88 +0,0 @@
----
-
-services:
-  postgresql:
-    image: docker.io/library/postgres:16-alpine
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
-      start_period: 20s
-      interval: 30s
-      retries: 5
-      timeout: 5s
-    volumes:
-      - database:/var/lib/postgresql/data
-    environment:
-      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
-      POSTGRES_USER: ${PG_USER:-authentik}
-      POSTGRES_DB: ${PG_DB:-authentik}
-    env_file:
-      - .env
-  trout:
-    image: docker.io/library/redis:alpine
-    command: --save 60 1 --loglevel warning
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
-      start_period: 20s
-      interval: 30s
-      retries: 5
-      timeout: 3s
-    volumes:
-      - trout:/data
-  server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.2}
-    restart: unless-stopped
-    command: server
-    environment:
-      AUTHENTIK_REDIS__HOST: trout
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-    volumes:
-      - ./media:/media
-      - ./custom-templates:/templates
-    env_file:
-      - .env
-    depends_on:
-      - postgresql
-      - trout
-  worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.2}
-    restart: unless-stopped
-    command: worker
-    environment:
-      AUTHENTIK_REDIS__HOST: trout
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-    # `user: root` and the docker socket volume are optional.
-    # See more for the docker socket integration here:
-    # https://goauthentik.io/docs/outposts/integrations/docker
-    # Removing `user: root` also prevents the worker from fixing the permissions
-    # on the mounted folders, so when removing this make sure the folders have the correct UID/GID
-    # (1000:1000 by default)
-    user: root
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ./media:/media
-      - ./certs:/certs
-      - ./custom-templates:/templates
-    env_file:
-      - .env
-    depends_on:
-      - postgresql
-      - trout
-
-volumes:
-  database:
-    driver: local
-  trout:
-    driver: local
-
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/authentik-env.j2

@@ -1,15 +0,0 @@
-PG_PASS={{ vault_authentik.postgres_password }}
-AUTHENTIK_SECRET_KEY={{ vault_authentik.secret_key }}
-# SMTP Host Emails are sent to
-AUTHENTIK_EMAIL__HOST={{ smtp.host }}
-AUTHENTIK_EMAIL__PORT=25
-# Optionally authenticate (don't add quotation marks to your password)
-AUTHENTIK_EMAIL__USERNAME={{ smtp.username }}
-AUTHENTIK_EMAIL__PASSWORD={{ vault_smtp.password }}
-# Use StartTLS
-AUTHENTIK_EMAIL__USE_TLS=true
-# Use SSL
-AUTHENTIK_EMAIL__USE_SSL=false
-AUTHENTIK_EMAIL__TIMEOUT=10
-# Email address authentik will send from, should have a correct @domain
-AUTHENTIK_EMAIL__FROM=auth@{{ email_domains.updates }}

roles/docker/templates/gotify-compose.yml.j2

@@ -11,7 +11,6 @@ services:
     labels:
       mag37.dockcheck.update: true
     extra_hosts:
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
       - "{{ subdomains.gotify_assistant }}:{{ docker.hairpin_ip }}"
 
   igotify-assistant:
@@ -27,7 +26,6 @@ services:
     labels:
       mag37.dockcheck.update: true
     extra_hosts:
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
       - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"
 
 volumes: