Authentik (SSO / Identity Provider)

Overview
Authentik is the identity provider and single sign-on (SSO) gateway for all
externally-accessible services on Centerpoint. It implements ForwardAuth middleware
for Traefik, meaning that any request arriving at an external route tagged with
authentik-auth@docker is intercepted and validated by Authentik before being
forwarded to the backend service.
Authentik also serves as an OAuth2/OIDC provider — services like BookStack use
OIDC for native user login rather than ForwardAuth.
Access
Type
URL
Notes
Internal
https://auth.home.local
LAN access via Step-CA TLS
External
https://auth.jeevesconsults.ca
Internet-facing — OIDC redirect target
The external URL (
auth.jeevesconsults.ca) is the one registered as the OIDC issuer
with downstream services. It must be reachable by browsers completing OAuth2 flows.
Containers in This Stack
Container
Image
Role
authentik-server
ghcr.io/goauthentik/server:2026.5.x
HTTP server + ForwardAuth endpoint
authentik-worker
ghcr.io/goauthentik/server:2026.5.x
Background task worker (Rust entry)
authentik-postgresql
postgres:16-alpine
Primary database
authentik-geoip
ghcr.io/maxmind/geoipupdate:v7.x
GeoIP database updater (MaxMind)
Startup Order
authentik-postgresql must reach a healthy state before 
authentik-server and
authentik-worker start. The 
authentik-geoip sidecar runs independently.
Configuration
Compose project: 
authentik
Key Environment Variables
Variable
Value / Notes
AUTHENTIK_SECRET_KEY
REDACTED — long random string, must stay constant
AUTHENTIK_POSTGRESQL__HOST
authentik-postgresql
AUTHENTIK_POSTGRESQL__NAME
authentik
AUTHENTIK_POSTGRESQL__USER
authentik
AUTHENTIK_POSTGRESQL__PASSWORD
REDACTED
AUTHENTIK_REDIS__HOST
redis (internal sidecar or external Redis)
AUTHENTIK_LISTEN__HTTP
0.0.0.0:9000 — explicit bind required for Docker bridge
AUTHENTIK_ERROR_REPORTING__ENABLED
false
Important: 
AUTHENTIK_LISTEN__HTTP: "0.0.0.0:9000" is required in Authentik
2026.5+. Newer versions default to 
[::] (IPv6 wildcard) which Docker bridge
networks cannot reach via IPv4. Without this override, ForwardAuth requests from
Traefik fail silently.
ForwardAuth Middleware
The Authentik ForwardAuth middleware is defined on the 
authentik-server container
labels and is available to all services on 
traefik-net as:
authentik-auth@docker
Example usage on a protected external route:
labels:
  - "traefik.http.routers.<name>-ext.middlewares=authentik-auth@docker,plex-geoblock@file,crowdsec-bouncer@file"
OIDC Configuration (for native OIDC apps)
Applications using OIDC (e.g. BookStack) configure Authentik as their provider
with the following settings:
Setting
Value
Issuer URL
https://auth.jeevesconsults.ca/application/o/<app-slug>/
JWKS URL
<issuer>/.well-known/jwks.json
Client ID
Per-application (set in Authentik admin UI)
Client Secret
REDACTED — set per-application
email_verified
Requires custom Scope Mapping returning 
true (2026.5+ change)
Volumes / Bind Mounts
Host Path / Volume
Container Path
Purpose
authentik_media
/media
Uploaded assets (logos, avatars)
authentik_custom-templates
/templates
Custom email / flow templates
authentik_postgresql_data
/var/lib/postgresql/data
PostgreSQL data directory
authentik_geoip_data
/usr/share/GeoIP
MaxMind GeoIP databases
All volumes are named Docker volumes managed by Portainer.
Sub-section: PostgreSQL
The 
authentik-postgresql container is a dedicated Postgres 16 sidecar that stores
all Authentik state: users, groups, policies, flows, tokens, and audit logs. It is not
shared with any other service.
Database credentials are passed to the server via 
AUTHENTIK_POSTGRESQL__* environment
variables. The container is on the 
authentik-internal network only — it is never
exposed to 
traefik-net or the host.
Sub-section: GeoIP Updater
authentik-geoip runs the MaxMind GeoIPUpdate daemon, which downloads and refreshes
the 
GeoLite2-City and 
GeoLite2-ASN databases on a schedule. The databases are
shared into 
authentik-server via the 
authentik_geoip_data volume.
A MaxMind account and licence key (REDACTED) are required for the GeoIP databases.
Sub-section: Worker
authentik-worker runs as the same container image as 
authentik-server but with
the worker entrypoint. It handles background tasks: email delivery, outpost health
checks, blueprint application, and event cleanup. Since Authentik 2025.10+, the
worker uses a Rust-based entrypoint for improved performance.
Dependencies
authentik-postgresql (must be healthy before server/worker start)
traefik-net (server must be on this network for ForwardAuth to reach it)
MaxMind account for GeoIP updates (not strictly required, but GeoIP features
will be unavailable without it)
Notes / Gotchas
If the 
AUTHENTIK_SECRET_KEY changes, all tokens, sessions, and cookies are
immediately invalidated — all users will be logged out across all services.
Authentik's admin interface is at 
/if/admin/. Initial admin credentials are
set via the 
AUTHENTIK_BOOTSTRAP_PASSWORD env var on first start.
For OIDC apps: 
email_verified defaults to 
false since Authentik 2025.10. Create
a custom Scope Mapping that hard-codes 
"email_verified": True and attach it to the
OAuth2 provider.
Existing local users who also log in via OIDC must have their External Auth ID
set in Admin → Users → Edit → External Auth ID to match the 
sub claim from the
OIDC token, otherwise two separate accounts will be created.
DOZZLE_ENABLE_SHELL=true on Dozzle requires that this admin account is separate
from the Authentik service account.
Last Updated: 2026-06-16