LinuxsecurityTested on real hardware

Deploy Authentik with Docker Compose (Linux)

Stand up Authentik — the open-source identity provider — with Docker Compose: fetch the official compose file, generate strong secrets, and reach the first-run admin setup.

Distrosubuntu, debian
Shellbash
Updated
Script
bash
# Deploy Authentik (open-source identity provider) with Docker Compose.
# Requirements: Docker + Compose v2, at least 2 CPU cores and 2 GB of RAM.

# 1. Create a working directory and fetch the official compose file
mkdir -p ~/authentik && cd ~/authentik
wget https://docs.goauthentik.io/compose.yml

# 2. Generate strong secrets into a .env file (never invent these by hand).
#    PG_PASS is the database password; AUTHENTIK_SECRET_KEY signs sessions/tokens.
echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env

# 3. (Optional) serve on the standard web ports instead of 9000/9443.
#    Leave commented if a reverse proxy will sit in front of Authentik.
# echo "COMPOSE_PORT_HTTP=80"   >> .env
# echo "COMPOSE_PORT_HTTPS=443" >> .env

# 4. Pull images and start the stack (server, worker, PostgreSQL).
docker compose pull
docker compose up -d

# 5. Finish setup in a browser — MIND THE TRAILING SLASH or you get a 404:
#      http://YOUR_SERVER_IP:9000/if/flow/initial-setup/
#    On that page you set the password for the built-in 'akadmin' superuser.

What this does

This script deploys Authentik, an open-source identity provider, using its officially maintained Docker Compose file. It creates a working directory, pulls the compose definition, generates two strong random secrets into a .env file, and brings up the full stack — the Authentik server, a background worker, and a PostgreSQL database. (Recent Authentik releases no longer ship a separate Redis container in the official Compose file.) After it runs, you finish setup in the browser by creating the first admin account.

For the concepts, the guided walkthrough, and how to protect your first app, see the companion post: How to Set Up Authentik with Docker Compose.

Prerequisites

  • A Linux host with Docker and the Docker Compose v2 plugin (docker compose version should work). If you need it, start with the Install Docker on Linux playbook.
  • At least 2 CPU cores and 2 GB of RAM, per Authentik’s installation requirements. A Proxmox LXC or a small VM is fine.
  • wget and openssl available (both ship with most distros).

Notes

  • Make these values your own before you rely on the result: replace YOUR_SERVER_IP in the setup URL with the actual IP or hostname of this Docker host, and choose a strong password for the akadmin account on first launch — keep it in your password manager, never in a note. If a value looks specific to one machine, it’s a placeholder to change, not a literal to copy.
  • The trailing slash on the setup URL is mandatory. http://YOUR_SERVER_IP:9000/if/flow/initial-setup/ works; the same URL without the final / returns a Not Found error. This trips up almost everyone once.
  • Guard the .env file. It holds your database password and the key that signs every session token. Keep it out of Git and back it up privately — losing AUTHENTIK_SECRET_KEY invalidates existing sessions and tokens.
  • First boot takes a minute. The database initializes on the first up, so the web interface may not answer immediately. If it doesn’t load, Authentik’s docs suggest simply restarting the containers (docker compose restart) — first-run timing is the usual cause, not a fault.
  • Put it behind HTTPS. The defaults listen on 9000/9443; in a real homelab you’d front Authentik with a reverse proxy — see the Traefik + Let’s Encrypt playbook.
All playbooks