Obsidian Obsidian

[SSO] Knowledge base for Markdown files

A powerful knowledge base that works on top of a local folder of plain text Markdown files. Obsidian is a free and flexible app for your private thoughts that stores notes locally with extensive plugin support and open file formats.

Links:

TODO: Set up regular backups of the /config/vaults volume containing vault data TODO: Consider GPU acceleration configuration if needed for advanced use cases

Authentik ForwardAuth

Authentik ForwardAuth limits access to the browser-hosted Obsidian desktop to the admins group. All admitted users share the same desktop, vault, terminal, and container privileges; it is not a multi-user authorization boundary.

Setup

scripts/authentik-apps.py --application obsidian --apply
scripts/labctl.py service recreate tools/obsidian

Keep localaccess-authentik@file on the router and the UI port private to Traefik. OBSIDIAN_CUSTOM_USER and OBSIDIAN_PASSWORD provide a temporary native recovery path when configured through ignored host values.

Verify

Confirm authorized access, non-member denial, logout, session-refresh group revocation, local recovery, and absence of a direct browser route.

name: obsidian
services:
  obsidian:
    image: lscr.io/linuxserver/obsidian:latest
    container_name: obsidian
    restart: unless-stopped
    environment:
      TZ: ${TIMEZONE}
      PUID: ${PUID}
      PGID: ${PGID}
      CUSTOM_USER: ${OBSIDIAN_CUSTOM_USER:-}
      PASSWORD: ${OBSIDIAN_PASSWORD:-}
      LC_ALL: ${OBSIDIAN_LC_ALL:-}
    volumes:
      - ${DOCKER_VOLUMES}/obsidian:/config
      - ${STORAGE_OBSIDIAN}:/config/vaults
    shm_size: "1gb"
    networks:
      - proxy
    labels:
      traefik.enable: true
      traefik.http.routers.obsidian.rule: Host(`obsidian.${MYDOMAIN}`)
      traefik.http.routers.obsidian.middlewares: localaccess-authentik@file
      traefik.http.services.obsidian.loadbalancer.server.port: 3000
      homepage.group: Tools
      homepage.name: Obsidian
      homepage.icon: obsidian.png
      homepage.href: https://obsidian.${MYDOMAIN}/
      homepage.description: "[SSO] Knowledge base for Markdown files"

networks:
  proxy:
    external: true