Skip to main content

08-medikeep.md

kstack: book: Centerpoint Home Lab chapter: Documents & Organization page: Medikeep tags: [medikeep, medical, health, postgres, authentik-sso]

Overview

Medikeep is a personal medical records tracker. It stores health records, prescriptions, appointments, and related documents. SSO is configured via Authentik (native OIDC integration — not Traefik ForwardAuth). The external route uses GeoBlock and CrowdSec; the internal route is TLS-only with no additional auth middleware.

Access

Type URL Auth
External https://medical.jeeves5454.ddns.net Authentik OIDC + GeoBlock + CrowdSec
Internal https://medikeep.home.local Authentik OIDC (Step-CA TLS)

SSO is handled by Medikeep's built-in SSO_ENABLED: true — it redirects to Authentik on login. Traefik does not apply ForwardAuth to this service.

Containers

Container Image Role
medikeep ghcr.io/afairgiant/medikeep:latest Web application
medikeep-db postgres:15.8-alpine PostgreSQL database

medikeep (application)

Key environment variables:

Variable Value / Notes
SSO_ENABLED true
SSO_PROVIDER_TYPE authentik
SSO_ISSUER_URL https://auth.jeevesconsults.ca/application/o/medikeep/
SSO_CLIENT_ID EN44sdEMtf29bgTN077W48XsCSpi9bj1Wk0eypI1
SSO_CLIENT_SECRET REDACTED
SSO_REDIRECT_URI https://medical.jeeves5454.ddns.net/auth/sso/callback
DB_HOST medikeep-db
DB_PORT 5432
DB_NAME medical_records
DB_USER medapp
DB_PASSWORD REDACTED
LOG_LEVEL DEBUG
LOG_ROTATION_METHOD logrotate
ENABLE_API_DOCS false
DEBUG false
PUID / PGID 1000
TZ America/Toronto

Bind mounts:

Host Path Container Path Purpose
/home/jeeves/docker/medikeep/uploads /app/uploads Document uploads
/home/jeeves/docker/medikeep/logs /app/logs Application logs
/home/jeeves/docker/medikeep/backups /app/backups Backup output

medikeep-db (PostgreSQL 15.8)

Image: postgres:15.8-alpine

Variable Value
POSTGRES_DB medical_records
POSTGRES_USER medapp
POSTGRES_PASSWORD REDACTED

Bind mounts:

Host Path Container Path
/home/jeeves/docker/medikeep/postgres/data /var/lib/postgresql/data

Traefik Labels

traefik.http.routers.medikeep-ext.rule: Host(`medical.jeeves5454.ddns.net`)
traefik.http.routers.medikeep-ext.entrypoints: websecure
traefik.http.routers.medikeep-ext.tls.certresolver: letsencrypt
traefik.http.routers.medikeep-ext.middlewares: plex-geoblock@file,crowdsec-bouncer@file
traefik.http.routers.medikeep-ext.service: medikeep-svc

traefik.http.routers.medikeep-int.rule: Host(`medikeep.home.local`)
traefik.http.routers.medikeep-int.entrypoints: websecure
traefik.http.routers.medikeep-int.tls.certresolver: step-ca
traefik.http.routers.medikeep-int.service: medikeep-svc

traefik.http.services.medikeep-svc.loadbalancer.server.port: 8000

Notes / Gotchas

  • SSO_REDIRECT_URI points to the external domain — this is the OAuth callback URL registered in Authentik. Even when accessing via the internal home.local URL, the OIDC callback will redirect through the external domain.
  • Medikeep's LOG_LEVEL is set to DEBUG — logs may be verbose. Logs are accessible in the bind-mounted /app/logs directory.
  • Contains sensitive personal medical data. Limit backup exposure and ensure the PostgreSQL data directory is included in regular backup schedules.

Last Updated: 2026-06-17

No comments to display

Back to top