🔐 Authentik — Identity Provider & SSO
Host: Cloud – Starbuck VPS · Compose:
Cloud/Starbuck/authentik/compose.yaml
Stack name:authentik
1. Overview
Authentik is the centralised Identity Provider (IdP) for the entire homelab. It provides OIDC/OAuth2 SSO for Grafana, Reitti, Open WebUI, pgAdmin, and other services, as well as SAML and LDAP if needed. Runs on the Starbuck cloud VPS for high availability.
2. Architecture & Services
| Service | Image | Port | Role |
|---|---|---|---|
postgresql |
postgres:16-alpine |
— | Authentik database |
redis |
redis:alpine |
— | Authentik session cache |
server |
goauthentik/server:2026.5.3 |
9000, 9443, 9300 |
Authentik API, UI, and metrics |
worker |
goauthentik/server:2026.5.3 |
— | Background task worker |
3. Networking
authentik— Internal network for server ↔ PostgreSQL ↔ Redis.cloudflare-net— Routesauthentik.m1ckyb.comvia Dockflare/Cloudflare Tunnel.
4. Persistent Storage
| Container | Host Path | Description |
|---|---|---|
postgresql |
/home/michael/data/authentik/database |
PostgreSQL data |
redis |
/home/michael/data/authentik/redis |
Redis persistence |
server |
/home/michael/data/authentik/media |
Uploaded media (avatars etc.) |
server |
/home/michael/data/authentik/custom-templates |
Custom UI templates |
server |
/home/michael/data/authentik/css/custom.css |
Custom CSS |
worker |
/home/michael/data/authentik/certs |
Signing certificates |
5. Environment Variables
Loaded from .env:
| Variable | Description |
|---|---|
PG_PASS |
PostgreSQL password (required) |
PG_USER |
PostgreSQL user (default: authentik) |
PG_DB |
Database name (default: authentik) |
AUTHENTIK_SECRET_KEY |
Django secret key |
AUTHENTIK_EMAIL__* |
SMTP settings for outbound email |
COMPOSE_PORT_HTTP |
HTTP port (default 9000) |
COMPOSE_PORT_HTTPS |
HTTPS port (default 9443) |
6. Access & Usage
| URL | Description |
|---|---|
https://authentik.m1ckyb.com |
Authentik UI (public, via Cloudflare Tunnel) |
https://authentik.m1ckyb.com/if/admin/ |
Admin interface |
Default superuser setup is done on first launch via the web UI.
docker compose -f Cloud/Starbuck/authentik/compose.yaml up -d
# Create admin user (first run)
docker exec -it $(docker ps -q -f name=authentik-server) ak create_admin_user
7. Maintenance & Backup
# Update (check breaking changes first)
docker compose -f Cloud/Starbuck/authentik/compose.yaml pull
docker compose -f Cloud/Starbuck/authentik/compose.yaml up -d
# Backup
rsync -av /home/michael/data/authentik/ /backup/authentik/
[!IMPORTANT] Authentik version upgrades may include database migrations. Always read the upgrade notes before pulling a new version. Never skip major versions.