Authentik: A Full Identity Provider for Your Self-Hosted Stack

1services: 
2  authentik-server: 
3    image: ghcr.io/goauthentik/server:2025.2
4    command: server
5    environment: 
6      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
7      AUTHENTIK_REDIS__HOST: redis
8      AUTHENTIK_POSTGRESQL__HOST: postgresql
9      AUTHENTIK_POSTGRESQL__USER: authentik
10      AUTHENTIK_POSTGRESQL__NAME: authentik
11      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
12    volumes: 
13      - authentik-media:/media
14      - authentik-templates:/templates
15    ports: 
16      - "9000:9000"
17      - "9443:9443"
18    depends_on: 
19      postgresql: 
20        condition: service_healthy
21      redis: 
22        condition: service_healthy
23    restart: unless-stopped
24
25  authentik-worker: 
26    image: ghcr.io/goauthentik/server:2025.2
27    command: worker
28    environment: 
29      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
30      AUTHENTIK_REDIS__HOST: redis
31      AUTHENTIK_POSTGRESQL__HOST: postgresql
32      AUTHENTIK_POSTGRESQL__USER: authentik
33      AUTHENTIK_POSTGRESQL__NAME: authentik
34      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
35    volumes: 
36      - authentik-media:/media
37      - authentik-templates:/templates
38      - authentik-certs:/certs
39    depends_on: 
40      postgresql: 
41        condition: service_healthy
42      redis: 
43        condition: service_healthy
44    restart: unless-stopped
45
46  postgresql: 
47    image: postgres:16-alpine
48    environment: 
49      POSTGRES_PASSWORD: ${PG_PASS}
50      POSTGRES_USER: authentik
51      POSTGRES_DB: authentik
52    volumes: 
53      - postgres-data:/var/lib/postgresql/data
54    healthcheck: 
55      test: ["CMD", "pg_isready", "-U", "authentik"]
56      interval: 10s
57      timeout: 5s
58      retries: 5
59    restart: unless-stopped
60
61  redis: 
62    image: redis:7-alpine
63    command: --save 60 1 --loglevel warning
64    volumes: 
65      - redis-data:/data
66    healthcheck: 
67      test: ["CMD", "redis-cli", "ping"]
68      interval: 10s
69      timeout: 5s
70      retries: 5
71    restart: unless-stopped
72
73volumes: 
74  postgres-data: 
75  redis-data: 
76  authentik-media: 
77  authentik-templates: 
78  authentik-certs: 

1# Generate secrets:
2# openssl rand -base64 60 | tr -d '\n'
3AUTHENTIK_SECRET_KEY=your-very-long-random-secret-key-here
4
5# PostgreSQL
6PG_PASS=strong-database-password
7
8# Initial admin bootstrap (optional — remove after first login)
9AUTHENTIK_BOOTSTRAP_PASSWORD=initial-admin-password
10AUTHENTIK_BOOTSTRAP_EMAIL=admin@example.com
11
12# Email (for password recovery and notifications)
13AUTHENTIK_EMAIL__HOST=smtp.example.com
14AUTHENTIK_EMAIL__PORT=587
15AUTHENTIK_EMAIL__USE_TLS=true
16AUTHENTIK_EMAIL__USERNAME=authentik@example.com
17AUTHENTIK_EMAIL__PASSWORD=email-password
18AUTHENTIK_EMAIL__FROM=authentik@example.com

1# Traefik labels for forward auth with Authentik
2services: 
3  my-service: 
4    image: myapp:latest
5    labels: 
6      - traefik.enable=true
7      - traefik.http.routers.myapp.rule=Host(`app.example.com`)
8      - traefik.http.routers.myapp.entrypoints=websecure
9      - traefik.http.routers.myapp.tls.certresolver=letsencrypt
10      # Forward auth to Authentik
11      - traefik.http.routers.myapp.middlewares=authentik@docker
12      - traefik.http.middlewares.authentik.forwardAuth.address=http://authentik-server:9000/outpost.goauthentik.io/auth/traefik
13      - traefik.http.middlewares.authentik.forwardAuth.trustForwardHeader=true
14      - traefik.http.middlewares.authentik.forwardAuth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email