Authentik

Authentik is an open-source identity provider that centralises authentication for your applications. It supports SSO over OAuth 2.0, OpenID Connect, SAML, LDAP, and proxy/forward-auth, with flexible flows, policies, and a self-service user portal.

Software included

Component	Version
Authentik	2026.5.4
PostgreSQL	18
Docker	Latest stable
Ubuntu	24.04 LTS

Authentik runs its server and worker containers with PostgreSQL, as a Docker Compose stack. Redis is no longer required. Authentik moved caching, background tasks, and WebSocket communication to PostgreSQL, so the stack is PostgreSQL, the server, and the worker.

Requirements

Resource	Minimum	Recommended
vCPU	2	4
RAM	2 GB	4 GB
Storage	20 GB	40 GB

Environment variables

You can optionally set these when deploying Authentik from the marketplace. Leave a password field blank to have a secure random value generated automatically.

Variable	Description
`AUTHENTIK_HOSTNAME`	Public hostname or IP Authentik is served from
`AUTHENTIK_BOOTSTRAP_EMAIL`	Email for the initial `akadmin` account
`AUTHENTIK_BOOTSTRAP_PASSWORD`	Password for the initial `akadmin` account

Getting started

1. Connect to your VM

ssh ubuntu@<your-vm-ip>

2. Wait for first-boot configuration

On the first boot, a setup script generates the admin, database, and secret-key values, writes the environment file, and starts the stack with Docker Compose. This takes 1-2 minutes. Track progress:

journalctl -u authentik-first-boot.service -f

The login message (MOTD) confirms when Authentik is ready and prints the admin credentials.

3. Retrieve the admin credentials

The credentials are also written to a root-only file:

sudo cat /etc/authentik/credentials.txt

4. Access the admin interface

Open a browser and navigate to:

http://<your-vm-ip>:9000

Sign in with the akadmin email and the generated password. HTTPS is also available on port 9443 with a self-signed certificate.

Managing Authentik

Authentik runs as a Docker Compose stack in /opt/authentik.

# Check status
cd /opt/authentik && docker compose ps

# Restart
cd /opt/authentik && docker compose restart

# View logs
cd /opt/authentik && docker compose logs -f

Environment configuration: /opt/authentik/.env. Database, media, and certificate data are stored under /opt/authentik.

Security

Ports 9000 (HTTP) and 9443 (HTTPS) are open on the VM’s network interface. UFW is enabled and allows those ports plus SSH (port 22). Authentik serves a default self-signed certificate on 9443.

To restrict access to a specific IP:

sudo ufw delete allow 9000/tcp
sudo ufw delete allow 9443/tcp
sudo ufw allow from <trusted-ip> to any port 9000
sudo ufw allow from <trusted-ip> to any port 9443

For production use, point a DNS record at the VM and front Authentik with TLS, either using the built-in HTTPS on 9443 with your own certificate, or a reverse proxy (Caddy, nginx, or Traefik) that terminates TLS and forwards to port 9000.