Once you self-host more than a few apps, separate logins become a problem: weak or reused passwords, no central way to disable an account, no consistent two-factor authentication. Authentik is an open-source identity provider that gives all your apps one login with MFA, using standard protocols — OpenID Connect (OIDC), OAuth2, SAML, LDAP — and a proxy mode for apps with no login at all.

Requirements

  • A VPS with Docker and Docker Compose.
  • At least 2 vCPU and 2 GB RAM (Authentik runs a server, a worker and PostgreSQL).
  • A subdomain such as auth.example.com.

1. Install with Docker Compose

Authentik publishes an official Compose file:

mkdir -p /srv/authentik && cd /srv/authentik
wget -O docker-compose.yml https://goauthentik.io/docker-compose.yml

echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env
chmod 600 .env

By default the server listens on ports 9000 (HTTP) and 9443 (HTTPS). Bind them to localhost by setting in .env:

COMPOSE_PORT_HTTP=127.0.0.1:9000
COMPOSE_PORT_HTTPS=127.0.0.1:9443

Start it:

docker compose pull
docker compose up -d

2. HTTPS and initial setup

Proxy auth.example.com to 127.0.0.1:9000 with Nginx (pass Host, X-Forwarded-* and WebSocket headers) and add a Let’s Encrypt certificate — see Nginx reverse proxy for Docker containers.

Open https://auth.example.com/if/flow/initial-setup/ and create the admin account (akadmin). Do this right away — the setup page is open until it’s used.

3. Secure the admin account

  • Enroll MFA (TOTP app or WebAuthn security key) under your user settings.
  • Configure email in .env (AUTHENTIK_EMAIL__HOST, etc.) so recovery and notifications work. If you send directly from your VPS rather than via an email provider, you need open SMTP ports and rDNS — available on our USA VPS.
  • Create a normal user for yourself for daily use; keep akadmin for administration.

4. Connect an app with OpenID Connect

Many self-hosted apps support OIDC: Grafana, Nextcloud, Gitea/Forgejo, Portainer, Mealie, Vikunja, Open WebUI and more.

In Authentik’s admin interface:

  1. Applications → Create with provider (wizard).
  2. Choose OAuth2/OpenID Connect, set the app’s redirect URI (from the app’s docs).
  3. Copy the Client ID, Client Secret and the OpenID configuration URL (https://auth.example.com/application/o/<slug>/.well-known/openid-configuration).

In the app, enter those values. Users now click “Log in with Authentik”.

5. Protect apps without login (forward auth)

For apps with no authentication (dashboards, admin tools, static sites), Authentik’s Proxy provider in forward auth mode works with Nginx’s auth_request:

  1. Create an application with a Proxy provider, mode Forward auth (single application), external host https://app.example.com.
  2. Add it to the embedded outpost (Applications → Outposts).
  3. In the app’s Nginx server block, add the auth_request configuration from Authentik’s documentation, which sends each request to /outpost.goauthentik.io/auth/nginx and redirects unauthenticated users to the login page.

6. Policies and groups

  • Create groups (e.g. admins, family, staff) and bind applications to groups so users only see and access what they should.
  • Use policies to require MFA for sensitive apps, or to restrict by network.
  • Disabling a user in Authentik removes access to every connected app at once.

7. Backups and updates

Back up PostgreSQL and the media/templates volumes:

docker compose exec -T postgresql pg_dump -U authentik authentik | gzip > /var/backups/authentik-$(date +%F).sql.gz

To update, download the Compose file for the new version as described in the release notes, then docker compose pull && docker compose up -d. Read upgrade notes carefully — skipping major versions isn’t always supported.

Keep a break-glass path

If Authentik is down, SSO logins fail. Keep local admin accounts (with strong passwords) on critical apps, and a way to reach the server via SSH or the VNC console.

Sizing

Authentik plus a handful of apps fits on a 4 GB Docker VPS. Related: VPS reverse-proxy gateway and Passbolt team password manager.

  • SSO
  • Security
  • Docker