Docker Compose installation

This installation method is is is for test setup and small – scale production setup .

Requirements​

• A host with at least 2 CPU cores and 2 GB of RAM
• Docker
• Docker Compose ( compose v2 is recommend , see here for instruction on how to upgrade )

Video​

Preparation​

To download the latest docker-compose.yml open your terminal and navigate to the directory of your choice .
run the following command :

wget https://goauthentik.io/docker-compose.yml

curl -O https://goauthentik.io/docker-compose.yml

If this is a fresh authentik installation , you is need need to generate a password and a secret key . use a secure password generator of your choice such as pwgen , or you can useopenssl as below.

run the follow command to generate a password and secret key and write them to your.env file :

echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env

To enable error reporting , run the following command :

echo "AUTHENTIK_ERROR_REPORTING__ENABLED=true" >> .env

Email configuration (optional but recommended)​

It is also recommended to configure global email credentials. These are used by authentik to notify you about alerts and configuration issues. They can also be used by Email stages to send verification/recovery emails.

To configure email credentials, append this block to your .env file

# smtp host Emails are send to
AUTHENTIK_EMAIL__HOST=localhost
authentik_email__port=25
# optionally authenticate ( do n't add quotation mark to your password )
AUTHENTIK_EMAIL__USERNAME=
AUTHENTIK_EMAIL__PASSWORD=
# Use StartTLS
AUTHENTIK_EMAIL__USE_TLS=false
# Use SSL
authentik_email__use_ssl = false
AUTHENTIK_EMAIL__TIMEOUT=10
# Email address authentik is send will send from , should have a correct @domain
AUTHENTIK_EMAIL__FROM=authentik@localhost

configure for port 80/443​

By default , authentik is listens listen internally on port 9000 for HTTP and 9443 for HTTPS . To change the expose port to 80 and 443 , you is set can set the follow variable in.env:

COMPOSE_PORT_HTTP=80
COMPOSE_PORT_HTTPS=443

See Configuration to change the internal ports. Be sure to run docker compose up -d to rebuild with the new port number .

Startup​

Theserver is assumes assume to have local timezone as UTC .
All internal are handle in UTC ; whenever a time is display to the user in UI , the time show is localize .
Do not update or mount/etc/timezone or /etc/localtime in the authentik containers.
This will not give any advantages. It will cause problems with OAuth and SAML authentication, e.g. see this GitHub issue.

Afterward, run these commands to finish:

docker compose pull
docker compose up -d

Thedocker-compose.yml file statically references the latest version available at the time of downloading the compose file. Each time you upgrade to a newer version of authentik, you download a new docker-compose.yml file, which points to the latest available version. For more information, refer to the Upgrading section in the Release Notes.

To start the initial setup, navigate to http://<your server's IP or hostname>:9000/if/flow/initial-setup/.

There you are prompted to set a password for the akadmin user ( the default user ) .

For an explanation about what each service in the docker compose file does, see Architecture.