authentik

Last reviewed Aug 26, 2026 · 880 words

authentik costs you 4 containers, about 1 GB of RAM at idle, and one honest afternoon. In return every app behind your reverse proxy gets one login, MFA, groups, and a single place to revoke access when a phone goes missing. That trade pays off for a homelab with more than 5 services and more than 1 user. Below that line it is heavier than the problem, and the last section says what to run instead.

Why the stack is heavy

authentik (Python, MIT, 25,156 stars, first released 2020) is a full identity provider, not a login gate. It speaks OAuth2 and OpenID Connect, SAML, LDAP, RADIUS and SCIM, and it ships an embedded proxy outpost that can sit in front of apps that speak none of those. The reference compose file runs a server, a worker, PostgreSQL, and at last check Redis. Each of the two authentik processes wants a few hundred MB, so the 1 GB floor is real and 2 GB is comfortable. The flexibility that makes it heavy is also the reason it wins: flows and policies are editable objects, so "require a hardware key for the admin group but only a password for the kids' Jellyfin login" is configuration, not a feature request.

Bring it up in this order

Generate secrets first, because changing AUTHENTIK_SECRET_KEY later invalidates sessions and some stored data:

wget https://goauthentik.io/docker-compose.yml
echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env
docker compose up -d

authentik listens on 9000 for HTTP and 9443 for HTTPS. Before you put it behind a proxy or share the URL, open http://host:9000/if/flow/initial-setup/ and set the akadmin password; that URL only works until the first admin exists. Then add a second admin user with MFA enrolled, store both passwords, and only then move on to applications. Put it behind Caddy or Traefik with a real certificate before any client is configured, because every OIDC redirect you set up will embed the URL and you do not want to redo them.

Forward auth is the first win

The fastest return is protecting apps that have no login of their own or a weak one: Uptime Kuma's dashboard, a Docker log viewer, an internal wiki. Create a Proxy provider in forward-auth mode, attach it to an application, assign the provider to the embedded outpost, and add 4 lines to the proxy:

kuma.example.com {
    forward_auth authentik:9000 {
        uri /outpost.goauthentik.io/auth/caddy
        copy_headers X-Authentik-Username X-Authentik-Groups
    }
    reverse_proxy uptime-kuma:3001
}

You also need a route for /outpost.goauthentik.io/* on that hostname pointing at authentik so the outpost can finish the login dance. Once this works for one app, the second takes 3 minutes.

OIDC for the apps that speak it, LDAP for the ones that do not

Gitea, Nextcloud, Immich, Grafana, Portainer and most modern self-hosted apps accept OpenID Connect, and that is the better integration: the app knows who you are, maps groups to roles, and logs you in with one click. authentik gives you a client ID and secret per app plus a discovery URL of the form https://auth.example.com/application/o/<slug>/. For the holdouts, Jellyfin among them, the LDAP outpost presents authentik users as a directory; it is a separate container and worth adding only when a specific app needs it. The identity category has the full list of what talks to what.

Never lock the admin behind itself

Three rules I learned the expensive way. Do not put authentik's own hostname behind forward auth. Keep local admin login enabled on at least one critical app, so a broken authentik does not mean a broken Grafana at 2 in the morning. And back up three things together: the PostgreSQL database, the media directory, and the .env file with the secret key, because a database restore without the matching key is not a restore. Releases are dated year.month and the notes flag breaking changes clearly; update within a month or two, read them first.

What I'd do

For 1 user and a handful of apps, Authelia does forward auth and OIDC from a single small Go binary and a YAML file, with a fraction of the memory. It has no admin UI and no LDAP server of its own, and that is fine for a household. The longer SSO write-up covers the split in detail. authentik is the pick when you have groups of people, apps that need SAML or LDAP, or the wish to customise the login flow itself.

For everyone above that line, authentik behind Caddy on a box with 4 GB, two admins with MFA, forward auth on every app that lacks a login, OIDC on every app that has one, LDAP outpost only if Jellyfin demands it. Nightly dump of PostgreSQL plus media plus .env to the same backup target, updates on a calendar, and Grafana's local admin left alive as the escape hatch. That is a week of evenings the first time and about 10 minutes per new app forever after.