LinuxsecurityTested on real hardware

Deploy Authentik with Docker Compose (Linux)

Stand up Authentik — the open-source identity provider — with Docker Compose: fetch the official compose file, generate strong secrets, and reach the first-run admin setup.

Distrosubuntu, debian
Shellbash
Updated
Script
bash
# Deploy Authentik (open-source identity provider) with Docker Compose.
# Requirements: Docker + Compose v2, at least 2 CPU cores and 2 GB of RAM.

# 1. Create a working directory and fetch the official compose file
mkdir -p ~/authentik && cd ~/authentik
wget https://docs.goauthentik.io/compose.yml

# 2. Generate strong secrets into a .env file (never invent these by hand).
#    PG_PASS is the database password; AUTHENTIK_SECRET_KEY signs sessions/tokens.
echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env

# 3. (Optional) serve on the standard web ports instead of 9000/9443.
#    Leave commented if a reverse proxy will sit in front of Authentik.
# echo "COMPOSE_PORT_HTTP=80"   >> .env
# echo "COMPOSE_PORT_HTTPS=443" >> .env

# 4. Pull images and start the stack (server, worker, PostgreSQL).
docker compose pull
docker compose up -d

# 5. Finish setup in a browser. Open the ROOT URL; Authentik starts first-run setup:
#      http://YOUR_SERVER_IP:9000/
#    There you set the email, password and Base URL for the built-in 'akadmin' superuser.

What this does

This script deploys Authentik, an open-source identity provider, using its officially maintained Docker Compose file. It creates a working directory, pulls the compose definition, generates two strong random secrets into a .env file, and brings up the full stack — the Authentik server, a background worker, and a PostgreSQL database. (Recent Authentik releases no longer ship a separate Redis container in the official Compose file.) After it runs, you finish setup in the browser by creating the first admin account.

For the concepts, the guided walkthrough, and how to protect your first app, see the companion post: How to Set Up Authentik with Docker Compose.

Prerequisites

  • A Linux host with Docker and the Docker Compose v2 plugin (docker compose version should work). If you need it, start with the Install Docker on Linux playbook.
  • At least 2 CPU cores and 2 GB of RAM, per Authentik’s installation requirements. A Proxmox LXC or a small VM is fine.
  • wget and openssl available (both ship with most distros).

Notes

  • Make these values your own before you rely on the result: replace YOUR_SERVER_IP in the setup URL with the actual IP or hostname of this Docker host, and choose a strong password for the akadmin account on first launch — keep it in your password manager, never in a note. If a value looks specific to one machine, it’s a placeholder to change, not a literal to copy.
  • Start setup from the root URL. Open http://YOUR_SERVER_IP:9000/ and Authentik starts its first-run flow. On Authentik 2026.8.5, going straight to /if/flow/initial-setup/ is refused with Request has been denied, and the message points you back to the root URL. The form asks for the admin Email, the Password (twice) and a Base URL: the address Authentik builds its own links from, with no path on the end.
  • Guard the .env file. It holds your database password and the key that signs every session token. Keep it out of Git and back it up privately — losing AUTHENTIK_SECRET_KEY invalidates existing sessions and tokens.
  • First boot takes a few minutes. The database initializes on the first up, and the worker then creates the initial-setup flow. Until docker compose ps shows the worker healthy, the setup page won’t load (about two and a half minutes on a 2-vCPU VM, re-tested on Authentik 2026.8.5). If it still doesn’t load once everything is healthy, Authentik’s docs suggest restarting the containers (docker compose restart).
  • Put it behind HTTPS. The defaults listen on 9000/9443; in a real homelab you’d front Authentik with a reverse proxy — see the Traefik + Let’s Encrypt playbook.
All playbooks