diff --git a/authentik/.env.example b/authentik/.env.example
new file mode 100644
index 0000000..a1222c4
--- /dev/null
+++ b/authentik/.env.example
@@ -0,0 +1,20 @@
+# ===================================
+# Authentification app (authentik)
+
+# PostgresQL conf 
+PG_PASS=change_this_cuz_its_ur_db_pass
+PG_USER=authentik # it's okay
+
+# Image Settings
+AUTHENTIK_IMAGE=ghcr.io/goauthentik/server
+AUTHENTIK_TAG=2025.10.2
+
+# Networking
+PORT_HTTP=9000
+PORT_HTTPS=9443 # btw likely already used by portainer
+
+AUTHENTIK_SECRET_KEY=super_secret_super_scary_authenik_key
+
+AUTHENTIK_BOOTSTRAP_PASSWORD=pls_change_this
+
+AUTHENTIK_ERROR_REPORTING__ENABLED=true # Or false to turn off
\ No newline at end of file
diff --git a/authentik/compose.yaml b/authentik/compose.yaml
new file mode 100644
index 0000000..fa3c125
--- /dev/null
+++ b/authentik/compose.yaml
@@ -0,0 +1,105 @@
+services:
+  postgresql:
+    image: docker.io/library/postgres:15-alpine
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      POSTGRES_DB: ${PG_DB:-authentik}
+      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
+      POSTGRES_USER: ${PG_USER:-authentik}
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+        - CMD-SHELL
+        - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 5s
+    volumes:
+      - database:/var/lib/postgresql/data
+    networks:
+      - authentik
+
+  server:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.2}
+    command: server
+    restart: unless-stopped
+    ports:
+      - ${PORT_HTTP:-9000}:9000
+      - ${PORT_HTTPS:-9443}:9443
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+      # Services
+      # - "traefik.http.services.authentik-server.loadbalancer.server.port=9443"
+      - "traefik.http.services.authentik-server.loadbalancer.server.port=9000"
+
+      # Prod Router
+      - "traefik.http.routers.authentik-server.rule=Host(`auth.forust.xyz`)"
+      - "traefik.http.routers.authentik-server.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server.service=authentik-server"
+      - "traefik.http.routers.authentik-server.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`) || Host(`auth-dashboard.internal`)"
+      - "traefik.http.routers.authentik-server-local.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server-local.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server-local.service=authentik-server"
+      - "traefik.http.routers.authentik-server-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.authentik-server-dev.rule=Host(`auth.gigaforust.internal`)"
+      - "traefik.http.routers.authentik-server-dev.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server-dev.service=authentik-server"
+      - "traefik.http.routers.authentik-server-dev.tls=true"
+    volumes:
+      - ./media:/media
+      - ./custom-templates:/templates
+    networks:
+      - traefik-proxy
+      - authentik
+    depends_on:
+      postgresql:
+        condition: service_healthy
+  worker:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.2}
+    restart: unless-stopped
+    user: root
+    command: worker
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./media:/media
+      - ./certs:/certs
+      - ./custom-templates:/templates
+    networks:
+      - authentik
+    depends_on:
+      postgresql:
+        condition: service_healthy
+volumes:
+  database:
+    driver: local
+networks:
+  authentik:
+  traefik-proxy:
+    external: true
diff --git a/traefik/.env.example b/traefik/.env.example
index 45a90cb..cf72c84 100644
--- a/traefik/.env.example
+++ b/traefik/.env.example
@@ -1,22 +1,3 @@
 # ===================================
 # Traefik envs 
 EMAIL=bobrovod@national.shitposting.agency
-
-# ===================================
-# Authentification app (authentik)
-
-# PostgresQL conf 
-PG_PASS=change_this_cuz_its_ur_db_pass
-PG_USER=authentik # it's okay
-
-# Image Settings
-AUTHENTIK_IMAGE=ghcr.io/goauthentik/server
-AUTHENTIK_TAG=2025.10.2
-
-# Networking
-PORT_HTTP=9000
-PORT_HTTPS=9443 # btw likely already used by portainer
-
-AUTHENTIK_SECRET_KEY=super_secret_super_scary_authenik_key
-
-AUTHENTIK_ERROR_REPORTING__ENABLED=true # Or false to turn off
\ No newline at end of file
diff --git a/traefik/compose.yaml b/traefik/compose.yaml
index 1998e1d..68f57dc 100644
--- a/traefik/compose.yaml
+++ b/traefik/compose.yaml
@@ -86,81 +86,6 @@ services:
     environment:
       - TZ=Europe/Bratislava
 
-  postgresql:
-    image: docker.io/library/postgres:15
-    restart: unless-stopped
-    container_name: authentik-postgresql
-    env_file:
-    - .env
-    environment:
-      POSTGRES_DB: ${PG_DB:-authentik}
-      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
-      POSTGRES_USER: ${PG_USER:-authentik}
-    volumes:
-    - auth-database:/var/lib/postgresql/data
-    healthcheck:
-      interval: 30s
-      retries: 5
-      start_period: 20s
-      test:
-      - CMD-SHELL
-      - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
-      timeout: 5s
-
-  server:
-    image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2025.10.2}
-    restart: unless-stopped
-    container_name: authentik-server
-    command: server
-    ports:
-    - ${PORT_HTTP:-9000}:9000
-    - ${PORT_HTTPS:-9443}:9443
-    env_file:
-    - .env
-    environment:
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
-    volumes:
-    - ./auth-media:/media
-    - ./auth-custom-templates:/templates
-    networks:
-      - traefik-proxy
-    depends_on:
-      postgresql:
-        condition: service_healthy
-
-  worker:
-    image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2025.10.2}
-    restart: unless-stopped
-    container_name: authentik-worker
-    command: worker
-    user: root
-    env_file:
-    - .env
-    environment:
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
-    volumes:
-    - /var/run/docker.sock:/var/run/docker.sock:ro
-    - ./auth-media:/media
-    - ./certs:/certs
-    - ./auth-custom-templates:/templates
-    depends_on:
-      postgresql:
-        condition: service_healthy
-    networks:
-      - traefik-proxy
-
-volumes:
-  auth-database:
-    driver: local
-
 networks:
   traefik-proxy:
     external: true