authentik
Run your own identity provider, background worker and private PostgreSQL database.
Choose your deployment and the way you want to use Selfhost. The instructions below follow that choice.
Set up authentik
Run your own identity provider, background worker and private PostgreSQL database.
Customize deployment inputs (2)
- Local HTTP port behind your TLS proxy
port - portDefault:
19000 - Administrator email
admin-email - emailDefault:
"admin@example.com"
Save this as inputs.json and adjust the values before initialization.
{
"port": 19000,
"admin-email": "admin@example.com"
}selfhost app --directory ./authentik init authentik --stack --inputs inputs.json Initialization writes portable files and does not start the app. Review compose.yaml, the private .env and any files in files/, then start it:
selfhost app --directory ./authentik startNo Selfhost dashboard or background service is needed. You can also start these files directly:
cd authentik
docker compose -f compose.yaml up -d- Review the generated Compose and environment, then start the project.
- Route your public identity hostname to the loopback port through a TLS proxy. The proxy must replace incoming forwarding headers. Use a restricted SSH tunnel or verified HTTPS for another server.
- Sign in as akadmin using ADMIN_PASSWORD from the project environment, then change the password and configure your own administrator.
- Create an OAuth2/OpenID Connect application with Authorization Code and PKCE and Selfhost's HTTPS /auth/callback URL. Add its application issuer, client and your exact subject ID in Selfhost login settings.
- Outposts are managed separately; this stack does not grant access to the Docker socket.
Integrations for this deployment
This deployment has no attached native settings or onboarding profile. Follow its setup instructions above and use the app’s own administration interface. Choosing another deployment can expose different Selfhost integrations.
Versions and updates
This deployment uses the following images. Existing projects retain their saved recipe and images. A new catalogue version does not silently update them.
- database:
postgres:16-alpine - identity:
ghcr.io/goauthentik/server:2026.8.3 - worker:
ghcr.io/goauthentik/server:2026.8.3
Review compatibility and back up app data before an update. Choose an image version and review the change.
Keep control of your setup
Selfhost remains optional. Your app runs using ordinary Compose files, its own settings and persistent data. Keep the Compose project name and volumes to preserve storage. Configuration exports and setting backups do not include application data.