authentik with Docker Compose in production
Running authentik on Docker Compose for small production setups: host requirements, the downloaded compose file, secrets in .env, the /data mount since 2025.12, backups and when to move to Kubernetes.
authentik deployment and installation
Installing authentik in your own infrastructure: Docker Compose, Kubernetes with Helm and AWS, PostgreSQL and storage choices, reverse proxies, configuration as code and air-gapped networks.
authentik on Kubernetes with the Helm chart
Installing authentik on Kubernetes with Helm for production: minimum values, generated secrets, an external PostgreSQL instead of the bundled demo database, ingress, autoscaling servers and workers, and upgrades.
authentik on AWS with the CloudFormation template
Deploying authentik on AWS with the official CloudFormation template: ECS Fargate server and worker services, Multi-AZ RDS PostgreSQL, ALB with an ACM certificate, EFS storage and the parameters to size.
External PostgreSQL for authentik
Running authentik on a managed or self-run PostgreSQL: TLS verification modes, connection counts after the Redis removal, read replicas, transaction-mode poolers from 2026.8 and backups.
Putting authentik behind a reverse proxy
Configuring NGINX, Traefik, Caddy or a cloud load balancer in front of authentik: required forwarded headers, trusted proxy CIDRs enforced from 2026.8, websockets, and the symptoms of a wrong setup.
Configuring email delivery for authentik
Setting up SMTP for recovery, invitations, email codes and notifications: global settings versus per-stage settings, TLS, testing delivery and troubleshooting messages that never arrive.
authentik in air-gapped networks
Running authentik with no internet access: disabling update checks, startup analytics and error reporting, avatars and map tiles, mirroring server and outpost images, and deploying outposts manually.
Managing authentik configuration as code with blueprints
Versioning flows, providers and applications as YAML blueprints: discovery from the blueprints directory, OCI-hosted blueprints, context variables, atomic apply and rollback, and restricting blueprint changes.
Managing authentik with Terraform
Using the goauthentik Terraform provider to manage applications, providers, flows and groups: matching provider and authentik versions, state handling, and combining Terraform with blueprints.
Automated authentik installs without plaintext admin passwords
Bootstrapping authentik from CI or configuration management: bootstrap settings, AUTHENTIK_BOOTSTRAP_PASSWORD_HASH and the hash_password command from 2026.5, and the 2026.8 change that hides passwords from the process list.
S3 storage for authentik files
Moving icons, backgrounds, uploads and CSV exports to S3-compatible storage instead of a local /data volume: when it is needed for multiple servers, provider choices and backing up the bucket.
