Compose-Files/Backups/Miker/Bookstack/authentik.md

---
tags:
  - Documentation
  - Bookstack
  - Notes
---
# Authentik

# Install and Setup

<iframe height="336" src="https://www.youtube.com/embed/KlDJ4K45M_o" width="600"></iframe>

<p class="callout info">*This document and video was written and produced by Brian @ Awesome Open Source. Please support his channel and ongoing efforts through Patreon: [https://www.patreon.com/bePatron?u=234177](https://www.patreon.com/bePatron?u=234177)*</p>

## Introduction

As the internet and services have become more and more the norm in our society protecting our services with authentication has become ever more important as well. This is where amazing projects like Authentik, and Authelia come in. These solutions give you the opportunity to setup a Single Sign On system for all of your services. That means you just need to have one very secure login, and you can access any of the services you use everyday.

### What You'll Need

- Docker and Docker Compose Installed on a Host that you can access from the Internet
- A domain or sub-domain that you own and can set an A or CNAME Record for.
- NGinX Proxy Manager (or other reverse proxy of your choice)
- an SMTP Email Server
- About 30 minutes of your time

### Installation

#### Configure and Install Authentik

Let's create our folder structure. First, we want to create a parent 'docker' folder, and inside that place any / all of our application folders we may want to run on this host. In this case our application folder will be 'authentik'.

`mkdir -p docker/authentik`

Next, we'll move into our new folder and create our docker-compose.yml file. This file defines our application containers, and helps put them all into a private network on our host so the various parts of the overall application can communicate securely.

`nano docker-compose.yml`

Copy the block of yaml code from below, and paste it into the document we just opened. You can paste in the linux terminal by right clicking, and selecting paste, or by using CTRL + Shift + V.

<div id="bkmrk-services%3A-postgresql"><div class="cm-editor ͼ1 ͼ2 ͼ4 ͼ1p"><div class="cm-scroller" tabindex="-1"><div class="cm-gutters cm-gutters-before"><div class="cm-gutter cm-lineNumbers"><div class="cm-gutterElement"><div><div><div>---</div>  
<div>services:</div><div> postgresql:</div><div> image: docker.io/library/postgres:16-alpine</div><div> restart: unless-stopped</div><div> container_name: authentik-db</div><div> healthcheck:</div><div> test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]</div><div> start_period: 20s</div><div> interval: 30s</div><div> retries: 5</div><div> timeout: 5s</div><div> volumes:</div><div> - ./database:/var/lib/postgresql/data</div><div> environment:</div><div> POSTGRES_PASSWORD: ${PG_PASS:?database password required}</div><div> POSTGRES_USER: ${PG_USER:-authentik}</div><div> POSTGRES_DB: ${PG_DB:-authentik}</div><div> env_file:</div><div> - .env</div><div> networks:</div><div> - authentik</div>  
<div> redis:</div><div> image: docker.io/library/redis:alpine</div><div> command: --save 60 1 --loglevel warning</div><div> restart: unless-stopped</div><div> container_name: authentik-redis</div><div> healthcheck:</div><div> test: ["CMD-SHELL", "redis-cli ping | grep PONG"]</div><div> start_period: 20s</div><div> interval: 30s</div><div> retries: 5</div><div> timeout: 3s</div><div> volumes:</div><div> - ./redis:/data</div><div> networks:</div><div> - authentik</div>  
<div> server:</div><div> image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.1}</div><div> restart: unless-stopped</div><div> container_name: authentik-server</div><div> command: server</div><div> environment:</div><div> AUTHENTIK_REDIS__HOST: redis</div><div> AUTHENTIK_POSTGRESQL__HOST: postgresql</div><div> AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}</div><div> AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}</div><div> AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}</div><div> volumes:</div><div> - ./media:/media</div><div> - ./custom-templates:/templates</div><div> env_file:</div><div> - .env</div><div> ports:</div><div> - "${COMPOSE_PORT_HTTP:-9000}:9000"</div><div> - "${COMPOSE_PORT_HTTPS:-9443}:9443"</div><div> depends_on:</div><div> - postgresql</div><div> - redis</div><div> networks:</div><div> - authentik</div>  
<div> worker:</div><div> image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.8.1}</div><div> restart: unless-stopped</div><div> container_name: authentik-worker</div><div> command: worker</div><div> environment:</div><div> AUTHENTIK_REDIS__HOST: redis</div><div> AUTHENTIK_POSTGRESQL__HOST: postgresql</div><div> AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}</div><div> AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}</div><div> AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}</div><div> # `user: root` and the docker socket volume are optional.</div><div> # See more for the docker socket integration here:</div><div> # https://goauthentik.io/docs/outposts/integrations/docker</div><div> # Removing `user: root` also prevents the worker from fixing the permissions</div><div> # on the mounted folders, so when removing this make sure the folders have the correct UID/GID</div><div> # (1000:1000 by default)</div><div> user: root</div><div> volumes:</div><div> - /var/run/docker.sock:/var/run/docker.sock</div><div> - ./media:/media</div><div> - ./certs:/certs</div><div> - ./custom-templates:/templates</div><div> env_file:</div><div> - .env</div><div> depends_on:</div><div> - postgresql</div><div> - redis</div><div> networks:</div><div> - authentik</div>  
<div>networks:</div><div> authentik:</div><div> external: true</div>  
</div></div>  
</div></div></div></div></div></div><p class="callout warning">NOTE: In the above, if you used it in the past, I have adjusted it to remove (comment out) one line which said `user: root` based on errors after an upgrade to 2025.8.2. Many people had the same error, and this was determined to be the cause.</p>

Once you've pasted in the code, save the file with CTRL + O, then press Enter to confirm, and exit the nano editor with CTRL + X.

Next we need to create an environment variable file that the docker-compose.yml file will read. This file allows us to customize our variables for the container setup without having to repeatedly enter like values throughout the docker-compose file.

`nano .env`

<p class="callout info">Note: The period in front of the filename. In unix based systems a filename starting with a period is a hidden file, and will not be shown with commands like `ls` alone. Instead you must use the flag `-a` (all) to show everything in a folder including hidden files, like this `ls -a`.</p>

Once open, copy the file contents below, and paste them into the .env file.

<div id="bkmrk-pg_user%3Dauthentik-pg"><div class="cm-editor ͼ1 ͼ2 ͼ4 ͼ1q"><div class="cm-scroller" tabindex="-1"><div class="cm-gutters cm-gutters-before"><div class="cm-gutter cm-lineNumbers"><div class="cm-gutterElement"><div><div>\#For a fresh authentik installation, you need to generate a password and a secret key.</div></div></div><div class="cm-gutterElement"><span style="font-family:'Lucida Console', 'DejaVu Sans Mono', 'Ubuntu Mono', Monaco, monospace;">PG\_USER=authentik</span></div></div></div><div class="cm-content"><div class="cm-line">PG_PASS=aReallyLongStrongPasswordShouldBePutHere</div><div class="cm-line"><div><div>  
</div><div>\#Enable error reporting</div><div>AUTHENTIK_ERROR_REPORTING__ENABLED=true</div></div></div><div class="cm-line">  
</div><div class="cm-line">AUTHENTIK_SECRET_KEY=someincrediblylongcomplexkeygoeshere</div><div class="cm-line">  
</div><div class="cm-line">\# SMTP Host Emails are sent to</div><div class="cm-line">AUTHENTIK_EMAIL__HOST=smtp.example.com</div><div class="cm-line">AUTHENTIK_EMAIL__PORT=587</div><div class="cm-line">  
</div><div class="cm-line">\# Optionally authenticate (don't add quotation marks to your password)</div><div class="cm-line">AUTHENTIK_EMAIL__USERNAME=auth@example.com</div><div class="cm-line">AUTHENTIK_EMAIL__PASSWORD=a-L0n6-Strong_password_should_go_here</div><div class="cm-line">  
</div><div class="cm-line">\# Use StartTLS</div><div class="cm-line">AUTHENTIK_EMAIL__USE_TLS=true</div><div class="cm-line">  
</div><div class="cm-line">\# Use SSL</div><div class="cm-line">AUTHENTIK_EMAIL__USE_SSL=false</div><div class="cm-line">AUTHENTIK_EMAIL__TIMEOUT=10</div><div class="cm-line">  
</div><div class="cm-line">\# Email address authentik will send from, should have a correct @domain</div><div class="cm-line"><div><div>AUTHENTIK_EMAIL__FROM=admn@example.com</div></div></div><div class="cm-line"><div><div>  
</div><div>\# Authentik listens on port 9000 for HTTP and 9443 for HTTPS. To change the exposed ports change these values</div></div></div><div class="cm-line">COMPOSE_PORT_HTTP=80</div><div class="cm-line">COMPOSE_PORT_HTTPS=443</div><div class="cm-line">  
</div><div class="cm-line">\# Authentik Version to Pull</div><div class="cm-line">ATHENTIK_TAG=2025.6.3</div></div><div class="cm-layer cm-layer-above cm-cursorLayer">  
</div><div class="cm-layer cm-selectionLayer">  
</div></div></div></div>I have intentionally added placeholders to most of the values. You'll want to go through and update these placeholders to be actual values for your installation. The values you must change at a minimum are:

PG\_PASS - This value can be any long, strong password you want.

AUTHENTIK\_SECRET\_KEY - This values should be a long string of numbers, letters (upper and lower case), and symbols at least 64 characters in length.

You should additionally setup the SMTP email options as this is a major part of user management and self-service in any authentication provider, such as when a user needs to reset his / her password, MFA device, register (if allowed). It's also how the Authentik install will send you information about events, updates, etc.

Finally, for the COMPOSE\_PORT\_HTTP and COMPOSE\_PORT\_HTTPS you may want to change these to be ports that aren't quite so common. If your host is also running NGINX Proxy Manager you should definitely change these to less common ports, as 80 and 443 are already in use by NPM.

Once you've updated the values appropriately, you can save and close the file with CTRL + O, then Enter to confirm, and then CTRL + X.

Now you are ready to bring up your Authentik application. Use the commands:

`docker compose up -d && docker compose logs -f`

The first part tells docker to get the necessary images and start the containers running in the background, and the second part tells docker once the containers are up, show us the logs.

You can discontinue the logs with CTRL + C.

Now navigate to the IP address of your host machine, and the port you set for the non SSL (HTTP) access in the .env file. You should see the Authentik login page. If so, then you are doing well. Next, setup the reverse proxy.

## Reverse Proxy Setup

Login to NGinX Proxy Manager (NPM) and click into the Proxy Hosts section. Select ‘Add Proxy Host’ from the upper right, and int he modal (pop-up) window that opens, we'll begin adding the information needed to get our domain name to resolve to our new server.

In the domain name field, enter your desired domain name. I used ‘authentik.mydomain.com’.

I own the domain ‘mydomain.com' have setup an A-record in DNS on the domain that will point the domain name to my public IP address.

Next, enter the private IP of your Authentik server. You can use ‘localhost’ if the Authentik server is running on the machine you are running NPM on. Next, enter the port number you entered in the .env file. If you didn't change it, it will be 80.

Enable the options for ‘Block Common Exploits’ and ‘Websocket Support’.

Now move to the SSL tab, and select “Request a New Certificate” from the drop-down box.

Enable the options for ‘Force SSL’, ‘HTTP/2 Support’, and both ‘HSTS’ options.

Enter your email address in the Email field, and enable the ‘Agree to Terms of Service’ option.

Click ‘Save’. If all is setup properly, the modal window will simply go away after a few seconds (maybe 30). Then you'll have a CA Certified LetsEncrypt certificate for your Authentik server.

You should now be able to get to your Authentik install using the FQDN (fully qualified domain name).

## Configure

To create your first (admin) user, you need to go to your domain at a special address.

[https://authentik.yourdomain.com/if/flow/initial-setup/](https://authentik.yourdomain.com/if/flow/initial-setup/)

Of course, use your actual domain name.

Enter your preferred email, and learn from my mistake and make sure it's correct before moving on. Next enter a long, strong password, then enter it again to confirm it. I cannot stress enough, you should absolutely use a password manager for keeping and helping you create long, strong passwords. I highly recommend Bitwarden, and Vaultwarden if you prefer to self host.

Click Create Account, and you should be logged in as an administrative user.

## Proxy Login

Make sure you have an outpost setup, and setup properly. We can use the authentik embedded outpost in this case.

### Make Sure Outpost is set Correctly

Click on Outposts on the left side menu, then click the edit icon in the list of outposts. if this is a new install you likely only have one outpost at this point.

In the pop-up window that opens, verify that your ‘authentik\_host’ has the same URL as your Authentik site. If you are using [https://auth.my-great-domain.com](https://auth.my-great-domain.com/) to reach your Authentik install, then you want this value to be the same.

You can now dismiss the pop-up if everything looks good. Additionally, in the outposts list, you should see a green check mark under health and version.

### Add a Provider

Next we need to add a provider for our setup.

Click on ‘Providers’ in the left side menu.

In this view, click on ‘Create’ at the top.

Again, when the pop-up window opens, select ‘Proxy Provider’, then click Next.

On the next page, enter a name that identifies the application you are creating a proxy authenticator for. The Proxy authentication is useful for applications and services you run that don't provide authentication in the app, but that you might like to expose to the internet. For instance, a dashboard, speedtest, etc.

Choose ‘Authorize Application’ from the Authentication Flow drop down.

Next, what you select will depend on how you are proxying your service traffic to your applications and service. If you are using a reverse proxy like NGinX Proxy Manager, Caddy, Traefik, etc, then you'll want to choose ‘Forward Auth (single application)’. If, however, you don't yet have a reverse proxy setup, then you'll potentially want to use the ‘Proxy’ option, which then turns Authentik into a reverse proxy for the site as well.

In our case we'll go with ‘Forward Auth (single application)’.

Now fill in your sites externally available FQDN (fully qualified domain name), for instance [https://mydash.example.com](https://mydash.example.com/)

You can change Token Validity to any timeframe you wish, but leaving it at 24 hours should be fine.

Click ‘Finish’.

You should be returned to your ‘Provider’ list, and you should see the provider you just created. You'll likely have a warning in the list that the provider is not associated to any applications. No worries, we'll fix this right now.

### Add an Application Entry for the Provider

In the left side menu click on ‘Applications’.

On the ‘Applications’ page, click the ‘Create’ button at the top, and you'll be presented with a pop-up window (modal window) where you need to fill in your application information.

Give your application a name that helps you easily identify the application. If you are creating an authentication for your dashboard, then call it ‘Dashboard’ for instance. As you fill in the ‘Name’ field, you'll notice that the ‘slug’ field is automatically filled in. The slug should not be changed unless you have a reason to do so, and the slug should always be lowercase, and not have spaces in it.

Now move down to the ‘Provider’ field, and select the provider you just created.

When creating these types of authentication flows, you always want to create a new provider, and a matching application entry for that provider, then select the provider for that application.

Finally, click the ‘Create’ button at the bottom of the modal window.

### Ensure the Provider is now Satisfied with the Application Entry

Navigate back to your Providers list on the left, and notice that our provider no longer shows the warning about not being associated to an application.

### Set the Application in Outposts

We are almost there. Navigate back to ‘Outposts’, and click the edit icon next to our outpost. In the modal window, next to the ‘Applications’ label, you should now see your application listed. You will click on this line in the field to select the application.

Click the ‘Update’ button at the bottom of the modal window. You should now see the application name listed under the ‘Providers’ column for the outpost. As you add more applications and providers, you'll see them added for any outpost you add them to. In this case, you can use this same outpost for multiple applications and providers needing a simple Forward Auth setup.

### Get your Reverse Proxy Snippet

Finally, navigate back to ‘Providers’ on the left side menu, and click the Name of your provider. This will show the Provider details in a new page. Scroll down, and notice various reverse proxy options are shown as tabs. Select the reverse proxy you are using, and you'll see a snippet of code that you'll use to setup your reverse proxy entry so it will start using Authentik before the application will load.

In our case, we've used NGinX Proxy Manager, so I'll click that tab, and copy that bit of code.

I'll open NGinX Proxy Manager and select the 3-dot icon on the row for my application, then select ‘Edit’.

Move to the ‘Advanced’ tab in the modal window, and paste in the code snippet.

In the pasted snippet, scroll down to the line for ‘proxy\_pass’, and change the FQDN for your Authentik instance to its internal IP address and port number.

NOTE: This is only done if you are running NGinX Proxy Manager, Authentik, and your Application on the same local area network.

In my case I change authentik.routemehome.org to 192.168.10.42.

Click ‘Save’.

If you now try to load your application, you should be prompted to login with Authentik. Verify you can login using your credentials, and you'd now setup.