Authentik Authentik

Identity provider and SSO platform

Authentik

This directory contains the Authentik Compose definition and tracked blueprints. For the one-time deployment, break-glass administrator, MFA, recovery, Google federation, and backup procedure, read docs/authentik.md.

References

Host Secrets

Create the ignored config/docker/<host>/authentik/ directory and generate the required secret files:

mkdir -p config/docker/<host>/authentik
openssl rand -out config/docker/<host>/authentik/postgresql-password -base64 36
openssl rand -out config/docker/<host>/authentik/secret-key -hex 60
chmod 600 config/docker/<host>/authentik/postgresql-password config/docker/<host>/authentik/secret-key

Set AUTHENTIK_SECRETS_PATH in config/docker/<host>/.env.authentik to this directory. Do not commit the generated files.

Application SSO

For adding or migrating applications to Authentik, read app-onboarding.md.

Authentik is an identity provider and SSO platform supporting OIDC, OAuth2, SAML, LDAP, social login sources, and proxy authentication outposts.

The embedded proxy outpost is used, so the worker does not need access to the Docker socket. Do not change the sso hostname after configuring OIDC clients; it forms part of the permanent issuer URL.

Backup

backup.yaml defines nightly PostgreSQL database/role exports under ${DB_BACKUP_ROOT}/security-authentik/. Restore with Authentik’s data, templates, certificates and original secret key; recover identity before dependent SSO applications. See the backup guide for export commands, B2 coverage, retention and snapshot selection.

Recovery

  1. Recover database.dump, globals.sql and the manifest. With server/worker stopped, restore required roles and the authentik database into a compatible dedicated PostgreSQL destination with the original ownership.
  2. Restore ${DOCKER_VOLUMES}/authentik/{data,certs,templates}, tracked blueprints/Compose configuration and original ignored authentik/secret-key and authentik/postgresql-password. Preserve signing keys, OIDC settings and the issuer hostname; do not generate replacement setup secrets for a restore.
  3. Start PostgreSQL, then the matching Authentik server/worker images. Recover identity access before starting dependent SSO applications.

The DB export does not inventory every required application file automatically; confirm these files/secrets exist in the selected recovery copies.

Post-restore check

Restore the original secret key and paired state with the PostgreSQL dump. Check container health, sign in with the retained local administrator, and confirm one dependent application’s OIDC login. Keep the original issuer hostname.

name: authentik
services:
  postgresql:
    image: postgres:16.15-alpine3.24@sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea
    container_name: authentik-postgresql
    restart: unless-stopped
    environment:
      POSTGRES_DB: authentik
      POSTGRES_USER: authentik
      POSTGRES_PASSWORD_FILE: /run/secrets/authentik-postgresql-password
      POSTGRES_INITDB_ARGS: --data-checksums
    secrets:
      - authentik-postgresql-password
    volumes:
      - ${DOCKER_VOLUMES}/authentik/postgresql:/var/lib/postgresql/data
    networks:
      - authentik-backend
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d authentik -U authentik"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s
    labels:
      traefik.enable: false

  server:
    image: authentik/server:2026.8.5@sha256:602227a86455d6772e3d16b7d852713c4f864f40df5df894abd1285bb53979a5
    container_name: authentik-server
    restart: unless-stopped
    command: server
    shm_size: 512mb
    environment:
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentik
      # kics-scan ignore-line -- value is loaded from a mounted Compose secret.
      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/authentik-postgresql-password
      # kics-scan ignore-line -- value is loaded from a mounted Compose secret.
      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik-secret-key
      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
    secrets:
      - authentik-postgresql-password
      - authentik-secret-key
    volumes:
      - ${DOCKER_VOLUMES}/authentik/data:/data
      - ${DOCKER_VOLUMES}/authentik/templates:/templates
      - ./config/blueprints:/blueprints:ro
    networks:
      - authentik-backend
      - security-authentik
    depends_on:
      postgresql:
        condition: service_healthy
    labels:
      traefik.enable: true
      traefik.docker.network: security-authentik
      traefik.http.routers.authentik.rule: Host(`sso.${MYDOMAIN}`)
      traefik.http.routers.authentik.middlewares: localaccess@file
      traefik.http.services.authentik.loadbalancer.server.port: 9000
      homepage.group: Security
      homepage.name: Authentik
      homepage.icon: authentik.png
      homepage.href: https://sso.${MYDOMAIN}/
      homepage.description: "Identity provider and SSO platform"

  worker:
    image: authentik/server:2026.8.5@sha256:602227a86455d6772e3d16b7d852713c4f864f40df5df894abd1285bb53979a5
    container_name: authentik-worker
    restart: unless-stopped
    command: worker
    shm_size: 512mb
    environment:
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentik
      # kics-scan ignore-line -- value is loaded from a mounted Compose secret.
      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/authentik-postgresql-password
      # kics-scan ignore-line -- value is loaded from a mounted Compose secret.
      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik-secret-key
      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
    secrets:
      - authentik-postgresql-password
      - authentik-secret-key
    volumes:
      - ${DOCKER_VOLUMES}/authentik/data:/data
      - ${DOCKER_VOLUMES}/authentik/certs:/certs
      - ${DOCKER_VOLUMES}/authentik/templates:/templates
      - ./config/blueprints:/blueprints:ro
    networks:
      - authentik-backend
    depends_on:
      postgresql:
        condition: service_healthy
    labels:
      traefik.enable: false

networks:
  authentik-backend:
  security-authentik:
    external: true

secrets:
  authentik-postgresql-password:
    file: ${AUTHENTIK_SECRETS_PATH:?Authentik secrets path is required}/postgresql-password
  authentik-secret-key:
    file: ${AUTHENTIK_SECRETS_PATH:?Authentik secrets path is required}/secret-key