How to Set Up Authentik with Docker Compose

You need a host with Docker and the Compose v2 plugin, 2 CPU cores and 2 GB of RAM minimum. If you’re on Proxmox, an LXC container or a small VM both work — Authentik doesn’t care which.

Confirm Compose v2 is present (note the space — docker compose, not the old docker-compose):

docker compose version

Authentik publishes a maintained compose.yml. Make a folder for the stack and pull it in:

mkdir -p ~/authentik && cd ~/authentik
wget https://docs.goauthentik.io/compose.yml

That file defines three services: the server, a worker, and a PostgreSQL database. (Recent Authentik releases dropped the separate Redis container from the official Compose file.) You don’t need to edit it.

Authentik needs two secrets: a database password and an application secret key. Never invent these by hand — generate real random values and append them to a .env file that Compose reads automatically:

echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env

Optionally, if you want Authentik to reach it on the standard web ports instead of 9000/9443, add these two lines to the same .env before starting — though if a reverse proxy will front it, leave the defaults:

echo "COMPOSE_PORT_HTTP=80" >> .env
echo "COMPOSE_PORT_HTTPS=443" >> .env

docker compose pull
docker compose up -d

The first pull downloads a few hundred megabytes and the database initializes on first boot, so give it a few minutes. Watch docker compose ps until the worker shows healthy: the worker creates the initial-setup flow on first boot, and until it has, the setup page in the next task won’t load. On a 2-vCPU VM that took about two and a half minutes in my re-test. If the page still won’t load once everything is healthy, Authentik’s docs suggest restarting the containers.

Open the root of the server in a browser. Authentik notices it hasn’t been set up yet and starts the first-run flow for you:

http://10.0.0.20:9000/

The form asks for four things:

• Email — the address for the built-in akadmin account, the default superuser.
• Password and Password (repeat) — there is no pre-set password to look up; whatever you type here becomes it. Put it straight into your password manager.
• Base URL — the address Authentik should use when it builds links for itself. Use the URL you’ll actually reach it at, with no path on the end. If you’ll put it behind a reverse proxy later, that’s your HTTPS name, such as https://auth.homelab.lan.

http://10.0.0.20:9000/

⤢

Authentik has two faces, and knowing which is which saves confusion:

• User interface (/) — the tile dashboard your family or teammates see: just the apps they’re allowed to open.
• Admin interface (/if/admin/) — where you, as akadmin, configure everything: applications, providers, flows, and users.

Everything below happens in the admin interface. Sign in as akadmin and head there.

In the admin interface, go to Applications → Applications and click New Application. That opens a short wizard that creates the application and a new provider together. (The dropdown beside the button also offers with Existing Provider… if you ever build a provider separately first.)

The wizard walks four short steps:

1. Application — a name (say, “Grafana”) and an optional group.
2. Choose a Provider — pick the protocol the app speaks. Modern apps use OAuth2/OpenID Connect; an app with no login of its own uses Proxy.
3. Configure Provider — accept the auto-filled name and choose the authorization flow (the default default-provider-authorization-explicit-consent is fine to start).
4. Configure Bindings — leave empty for now to allow everyone, or bind a group later to restrict access.

On the Review and Submit Application panel, check the summary and click Create Application. You’ve now got a working application and its provider in one pass.

⤢

Run the same Applications → Applications → New Application wizard, but at the Choose a Provider step pick Proxy. Set it to Forward auth (single application) and set External host to the URL you’ll use, e.g. https://app.homelab.lan. Authentik’s built-in embedded outpost answers the forward-auth checks, so there’s nothing extra to deploy for a first app.

This is the step I missed on my first pass. The embedded outpost only answers for applications assigned to it, and in my 2026.8.5 walk-through the wizard didn’t add the new proxy app for me. Until you do, the Providers column for the outpost shows a dash and forward auth has nothing to check against.

Go to Applications → Outposts, click the edit icon on authentik Embedded Outpost, move your app from Available Applications to Selected Applications, and click Save Changes.

⤢

Back on the list, the outpost’s Providers column now names your proxy provider:

⤢

Now tell your proxy to check with Authentik before serving the app. With Traefik, that’s a forwardAuth middleware pointed at the embedded outpost’s auth endpoint:

http:
  middlewares:
    authentik:
      forwardAuth:
        address: http://10.0.0.20:9000/outpost.goauthentik.io/auth/traefik
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-entitlements
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid
          - X-authentik-jwt
          - X-authentik-meta-jwks
          - X-authentik-meta-outpost
          - X-authentik-meta-provider
          - X-authentik-meta-app
          - X-authentik-meta-version

Attach that authentik middleware to the router for app.homelab.lan. The address is the embedded outpost’s Traefik endpoint; trustForwardHeader lets Authentik see the original host, and the response headers pass the signed-in user’s identity (username, groups, email and more) down to the app. That header list matches Authentik’s own Traefik example, and this exact middleware is the one I tested end to end on Traefik v3.

Open https://app.homelab.lan in a private browser window. Instead of the app, you should land on Authentik’s login page. Sign in, and because the wizard’s default authorization flow is the explicit consent one, Authentik asks once whether to let the app see your details:

⤢

Click Continue and you’re bounced straight through to the app, now wearing a login it never had. That round trip is the win.

For my test I put traefik/whoami, which simply echoes the request it receives, behind the middleware. Trimmed and with the values replaced, this is what arrived after sign-in:

X-Authentik-Username: akadmin
X-Authentik-Groups: authentik Admins
X-Authentik-Email: admin@homelab.lan
X-Authentik-Name: authentik Default Admin
X-Authentik-Jwt: eyJhbGciOi...  (a signed token, trimmed)
X-Authentik-Meta-Outpost: authentik Embedded Outpost
X-Authentik-Meta-Provider: Provider for Test Proxy App
X-Authentik-Meta-Version: goauthentik.io/outpost/2026.8.5

The app never handled a password. It got a set of headers saying who you are and which groups you’re in, and apps that support header auth can log you in from those alone.