08-medikeep.md
kstack: book: Centerpoint Home Lab chapter: Documents & Organization page: Medikeep tags: [medikeep, medical, health, postgres, authentik-sso]
Overview
emptyMedikeep is a personal medical records tracker. It stores health records,
prescriptions, appointments, and related documents. SSO is configured via
Authentik (native OIDC integration — not Traefik ForwardAuth). The external
route uses GeoBlock and CrowdSec; the internal route is TLS-only with no
additional auth middleware.
Access
https://medical.jeeves5454.ddns.net
Authentik OIDC + GeoBlock + CrowdSec
Internal
https://medikeep.home.local
Authentik OIDC (Step-CA TLS)
SSO is handled by Medikeep's built-in SSO_ENABLED: true — it redirects to
Authentik on login. Traefik does not apply ForwardAuth to this service.
Containers
medikeep
ghcr.io/afairgiant/medikeep:latest
Web application
medikeep-db
postgres:15.8-alpine
PostgreSQL database
medikeep (application)
Key environment variables:
SSO_ENABLED
true
SSO_PROVIDER_TYPE
authentik
SSO_ISSUER_URL
https://auth.jeevesconsults.ca/application/o/medikeep/
SSO_CLIENT_ID
EN44sdEMtf29bgTN077W48XsCSpi9bj1Wk0eypI1
SSO_CLIENT_SECRET
REDACTED
SSO_REDIRECT_URI
https://medical.jeeves5454.ddns.net/auth/sso/callback
DB_HOST
medikeep-db
DB_PORT
5432
DB_NAME
medical_records
DB_USER
medapp
DB_PASSWORD
REDACTED
LOG_LEVEL
DEBUG
LOG_ROTATION_METHOD
logrotate
ENABLE_API_DOCS
false
DEBUG
false
PUID / PGID
1000
TZ
America/Toronto
Bind mounts:
/home/jeeves/docker/medikeep/uploads
/app/uploads
Document uploads
/home/jeeves/docker/medikeep/logs
/app/logs
Application logs
/home/jeeves/docker/medikeep/backups
/app/backups
Backup output
medikeep-db (PostgreSQL 15.8)
Image: postgres:15.8-alpine
POSTGRES_DB
medical_records
POSTGRES_USER
medapp
POSTGRES_PASSWORD
REDACTED
Bind mounts:
/home/jeeves/docker/medikeep/postgres/data
/var/lib/postgresql/data
Traefik Labels
traefik.http.routers.medikeep-ext.rule: Host(`medical.jeeves5454.ddns.net`)
traefik.http.routers.medikeep-ext.entrypoints: websecure
traefik.http.routers.medikeep-ext.tls.certresolver: letsencrypt
traefik.http.routers.medikeep-ext.middlewares: plex-geoblock@file,crowdsec-bouncer@file
traefik.http.routers.medikeep-ext.service: medikeep-svc
traefik.http.routers.medikeep-int.rule: Host(`medikeep.home.local`)
traefik.http.routers.medikeep-int.entrypoints: websecure
traefik.http.routers.medikeep-int.tls.certresolver: step-ca
traefik.http.routers.medikeep-int.service: medikeep-svc
traefik.http.services.medikeep-svc.loadbalancer.server.port: 8000
Notes / Gotchas
SSO_REDIRECT_URI points to the external domain — this is the OAuth callback
URL registered in Authentik. Even when accessing via the internal home.local
URL, the OIDC callback will redirect through the external domain.
Medikeep's LOG_LEVEL is set to DEBUG — logs may be verbose. Logs are
accessible in the bind-mounted /app/logs directory.
Contains sensitive personal medical data. Limit backup exposure and ensure
the PostgreSQL data directory is included in regular backup schedules.
Last Updated: 2026-06-17