What do I need before installing Authentik?

A Linux host with Docker and the Docker Compose v2 plugin, at least 2 CPU cores and 2 GB of RAM, and a few minutes. Authentik's own documentation lists those as the minimum requirements. Running it inside an LXC container or a small VM on Proxmox is perfectly fine.

What is the default Authentik login after installing?

There is no default password. The first time you open the initial-setup URL at http://your-server:9000/if/flow/initial-setup/ you set the password for the built-in akadmin account yourself. Make sure to include the trailing slash or you will get a Not Found error.

What is the difference between an application and a provider in Authentik?

A provider is the technical integration — how Authentik talks to a service, using OAuth2, SAML, LDAP, RADIUS, or a proxy. An application is the user-facing tile that points at a provider and controls who is allowed to see and use it. You almost always create the two together with the built-in wizard.

How do I protect an app that has no login of its own?

Use a Proxy provider with forward authentication. Your reverse proxy asks Authentik's embedded outpost whether each request is allowed; if the visitor is not signed in, Authentik shows its own login page first and only lets valid sessions through to the app.

Can I run Authentik on ports 80 and 443?

Yes. By default it listens on 9000 for HTTP and 9443 for HTTPS. To change that, set COMPOSE_PORT_HTTP and COMPOSE_PORT_HTTPS in the .env file before you start the stack. In most homelabs a reverse proxy sits in front, so leaving the defaults is common.

How to Set Up Authentik with Docker Compose

On this page

Task 1: Install Authentik with Docker Compose
Task 2: Set your first admin and look around
Task 3: Create your first application and provider
Task 4: Put a login in front of an app that has none
Where to go next

In the overview post I made the case for running a single front door for your homelab. This is the part where we actually build it. By the end you’ll have Authentik running, a real admin account, and — the fun part — a login screen sitting in front of an app that shipped without one.

I’ll keep this grounded: every command here is the one from Authentik’s own installation docs, and I’ve flagged the two places people most often trip.

First: make these values your own

This guide uses placeholder values so it stays safe to publish. Swap them for yours before you paste:

10.0.0.20 — the IP (or hostname) of your Docker host running Authentik.
auth.homelab.lan — the internal DNS name you’ll reach Authentik at.
app.homelab.lan — the internal DNS name of the test app you’ll protect.
The akadmin password — you’ll set this yourself on first launch; keep it in your password manager, never in a note.

Rule of thumb: if a value looks specific to one machine, it’s a placeholder to change — not a literal to copy.

Task 1: Install Authentik with Docker Compose

1Check the prerequisites2 min

You need a host with Docker and the Compose v2 plugin, 2 CPU cores and 2 GB of RAM minimum. If you’re on Proxmox, an LXC container or a small VM both work — Authentik doesn’t care which.

Confirm Compose v2 is present (note the space — docker compose, not the old docker-compose):

Verify Docker Compose v2


docker compose version

2Download the compose file1 min

Authentik publishes a maintained compose.yml. Make a folder for the stack and pull it in:

Fetch the official compose file


mkdir -p ~/authentik && cd ~/authentik
wget https://docs.goauthentik.io/compose.yml

That file defines three services: the server, a worker, and a PostgreSQL database. (Recent Authentik releases dropped the separate Redis container from the official Compose file.) You don’t need to edit it.

3Generate the secrets2 min

Authentik needs two secrets: a database password and an application secret key. Never invent these by hand — generate real random values and append them to a .env file that Compose reads automatically:

Create the .env with strong random secrets


echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env

Treat .env like a password

That file now contains your database password and the key that signs every session token. Keep it out of Git, off shared notes, and back it up somewhere private — if you lose AUTHENTIK_SECRET_KEY, existing sessions and tokens break.

Optionally, if you want Authentik to reach it on the standard web ports instead of 9000/9443, add these two lines to the same .env before starting — though if a reverse proxy will front it, leave the defaults:

Optional: use ports 80 and 443


echo "COMPOSE_PORT_HTTP=80" >> .env
echo "COMPOSE_PORT_HTTPS=443" >> .env

4Pull and start the stack5 min

Bring Authentik up


docker compose pull
docker compose up -d

The first pull downloads a few hundred megabytes and the database initializes on first boot, so give it a minute before the web interface answers. If the page doesn’t load right away, Authentik’s docs suggest simply restarting the containers — first-boot timing is the usual culprit, not a real fault.

Task 2: Set your first admin and look around

1Run the initial-setup flow3 min

Open the initial-setup URL in a browser. This is the single most common place people stumble, so read the address carefully:

Initial setup — mind the trailing slash


http://10.0.0.20:9000/if/flow/initial-setup/

The trailing slash is not optional

Leave off the final / and Authentik returns a Not Found error. .../initial-setup/ works; .../initial-setup does not. It catches nearly everyone once.

On that page you set the password for the built-in akadmin account — the default superuser. There is no pre-set password to look up; whatever you type here becomes it. Put it straight into your password manager.

2Find the two interfaces2 min

Authentik has two faces, and knowing which is which saves confusion:

User interface (/) — the tile dashboard your family or teammates see: just the apps they’re allowed to open.
Admin interface (/if/admin/) — where you, as akadmin, configure everything: applications, providers, flows, and users.

Everything below happens in the admin interface. Sign in as akadmin and head there.

Do the boring hardening now

Before you wire up apps, give akadmin a second factor. Authentik → your name → MFA Devices → add a TOTP app or a passkey. Enforcing MFA on the account that controls every other login is the whole point of running an identity provider.

Task 3: Create your first application and provider

In Authentik, a provider is how it integrates with a service, and an application is the tile that points at that provider and decides who may use it. The admin interface builds both at once.

1Open the application wizard1 min

In the admin interface, go to Applications → Applications, then click the dropdown beside Create and choose With New Provider. This runs a short wizard instead of making you build the provider separately first.

2Walk the four stages4 min

The wizard has four short stages:

Application details — a name (say, “Grafana”) and an optional group.
Provider type — pick the protocol the app speaks. Modern apps use OAuth2/OpenID Connect; an app with no login of its own uses Proxy.
Provider configuration — accept the auto-filled name and choose the authorization flow (the default default-provider-authorization-explicit-consent is fine to start).
Bindings — leave empty for now to allow everyone, or bind a group later to restrict access.

Review the summary and click Create. You’ve now got a working application and its provider in one pass.

Note

For an OAuth2/OIDC app, this is where Authentik hands you the Client ID, Client Secret, and the OpenID configuration URL. You paste those into the app’s own “single sign-on” settings — each app words it slightly differently, but it always wants those three things.

This is the trick that makes Authentik feel like magic: taking a bare dashboard with no auth and giving it a real login — no code changes to the app. It works through a Proxy provider and forward authentication, where your reverse proxy asks Authentik to vet each request first.

Here’s the shape of a single request once it’s wired up:

1Create a Proxy provider3 min

Run the same Applications → Applications → Create → With New Provider wizard, but at the provider-type stage choose Proxy. Set it to Forward auth (single application) and give it the external URL you’ll use, e.g. https://app.homelab.lan. Authentik’s built-in embedded outpost handles this — there’s nothing extra to deploy for a first app.

2Point your reverse proxy at the outpost5 min

Now tell your proxy to check with Authentik before serving the app. With Traefik, that’s a forwardAuth middleware pointed at the embedded outpost’s auth endpoint:

Traefik forwardAuth middleware (dynamic config)


http:
middlewares:
  authentik:
    forwardAuth:
      address: http://10.0.0.20:9000/outpost.goauthentik.io/auth/traefik
      trustForwardHeader: true
      authResponseHeaders:
        - X-authentik-username
        - X-authentik-email
        - X-authentik-name
        - X-authentik-uid

Attach that authentik middleware to the router for app.homelab.lan. The address is the embedded outpost’s Traefik endpoint; trustForwardHeader lets Authentik see the original host, and the response headers pass the signed-in user’s identity down to the app.

3Test it end to end2 min

Open https://app.homelab.lan in a private browser window. Instead of the app, you should land on Authentik’s login page. Sign in — and you’re bounced straight through to the app, now wearing a login it never had. That round trip is the win.

Keep a way back in

Forward auth means Authentik now gates that app. Before you protect anything critical, make sure you have a break-glass path — a local admin account on the app itself, or proxy access that bypasses auth — so a misconfigured flow can’t lock you out of your own service.

Where to go next

You’ve got Authentik running, a hardened admin, and one app protected. The natural next moves are to bind a group to that application so only certain users see it, and to convert your OAuth2-capable apps (Grafana, Immich, and friends) from their own logins over to single sign-on one at a time. Do them one per evening — it’s oddly satisfying watching the separate passwords disappear.

Related posts:

Deploy Authentik with Docker Compose (playbook) — the copy-paste version of Task 1, if you just want the install in one block.
What Is Authentik? One Login for Your Whole Homelab — the concepts behind this walkthrough; read it first if “provider” and “SSO” are fuzzy.
What Is Traefik? The Reverse Proxy, Explained — the proxy that does the forward-auth handshake in Task 4.
Traefik + Let’s Encrypt: Automatic HTTPS — get HTTPS on app.homelab.lan before you put a login in front of it.
Run Vaultwarden in a Proxmox LXC — where your new akadmin password belongs.
Docker on Proxmox: LXC vs VM, Done Right — the host this Compose stack runs on.
Harden Proxmox Before You Expose Anything — secure the foundation under the identity layer.

Sources: Authentik installation docs, Authentik Traefik proxy docs.

Comments

Comments are powered by GitHub Discussions — sign in with a GitHub account to join the conversation.