authentik-server

authentik-server is Authentik, the fleet's identity provider, with the database, cache, and helpers it needs. It holds the user accounts, and gives the sign-in that Traefik asks for in front of the fleet's web interfaces.

It runs on one host, id01. See Identity (id01) for the build.

What it runs

authentik-server
authentik-worker
postgres
postgres-backup
redis
geoipupdate
socket-proxy

Service	Does
authentik-server	Serves the web interface, the API, and the sign-in flows, on port 9000 inside the proxy network
authentik-worker	Runs background tasks: database migrations, outgoing mail, and managing outposts, the helper services Authentik uses to guard an application
postgres	Holds every user, group, application, and flow
postgres-backup	Dumps the database each day, and keeps 7 daily, 4 weekly, and 6 monthly dumps
redis	Cache and task queue for the server and the worker
geoipupdate	Downloads the GeoLite2 City and ASN databases every 8 hours
socket-proxy	Gives the worker a filtered view of the Docker socket, which it uses to manage outposts

The project is authentik, so the containers are named authentik- and the service, such as authentik-postgres. The two Authentik containers are authentik-authentik-server and authentik-authentik-worker.

Postgres, Redis, and the socket proxy sit on networks marked internal. Only authentik-server joins proxy, where Traefik reaches it.

Values it reads

Key	Reads	Kind	Described under
AUTHENTIK_SECRET_KEY	AUTHENTIK_SECRET_KEY	Secret	Authentik
AUTHENTIK_EMAIL__HOST	GLOBAL_EMAIL_HOST	Variable	Mail
AUTHENTIK_EMAIL__PORT	GLOBAL_EMAIL_PORT	Variable	Mail
AUTHENTIK_EMAIL__USERNAME	GLOBAL_EMAIL_USER	Variable	Mail
AUTHENTIK_EMAIL__PASSWORD	GLOBAL_EMAIL_PASS	Secret	Mail
AUTHENTIK_EMAIL__USE_TLS	GLOBAL_EMAIL_TLS	Variable	Mail
AUTHENTIK_EMAIL__USE_SSL	GLOBAL_EMAIL_SSL	Variable	Mail
AUTHENTIK_EMAIL__FROM	GLOBAL_EMAIL_FROM	Variable	Mail
POSTGRES_USER	AUTHENTIK_POSTGRES_USER	Secret	Authentik
POSTGRES_PASSWORD	AUTHENTIK_POSTGRES_PASSWORD	Secret	Authentik
GEOIPUPDATE_ACCOUNT_ID	GLOBAL_GEOIPUPDATE_ACCOUNT_ID	Secret	Authentik
GEOIPUPDATE_LICENSE_KEY	GLOBAL_GEOIPUPDATE_LICENSE_KEY	Secret	Authentik

It also reads the 19 operational defaults, as every stack does.

The host page says what to put in each and when. See Stage the values.

id01 blanks the two mail login keys in its inventory entry, because Postfix on ci01 offers no login. See Blanking a reference.

What the host needs

The project is authentik, so the stack's folders sit under /opt/docker/volumes/authentik and /opt/docker/logs/authentik. Both are mode 0750, owned by the admin account with group 101000.

Folder	Owner	Mode
/opt/docker/volumes/authentik/authentik-media	101000:101000	Default
/opt/docker/volumes/authentik/authentik-templates	101000:101000	Default
/opt/docker/volumes/authentik/authentik-certs	101000:101000	Default
/opt/docker/volumes/authentik/postgres-data	100000:100000	Default
/opt/docker/volumes/authentik/postgres-backup-data	100000:100000	Default
/opt/docker/volumes/authentik/geoip-data	101000:101000	Default

This stack opens no port on the host's firewall.

The host's NixOS configuration creates the folders when the host is deployed. It reads them from the host's file in the private repo, nixos/hosts/<host>.json, which nixos-sync.yml writes from the stack's setup.yaml. See Host layout.

The stack also needs a Traefik on the same host, which is traefik-bootstrap in bootstrap mode and traefik-agent after it.

Hostnames

Traefik routes five names to authentik-server. With the host id01, the sub-domain home., and the domain myah-mitchell.com, they are:

Hostname	Comes from
auth.myah-mitchell.com	AUTHENTIK_SERVICE_NAME, meant as the public name
authentik.myah-mitchell.com	AUTHENTIK_HOSTNAME on the domain
authentik.home.myah-mitchell.com	AUTHENTIK_HOSTNAME on the sub-domain
authentik.id01.home.myah-mitchell.com	AUTHENTIK_HOSTNAME on the host

The fifth is the project name on the host, which here is the same as the fourth.

The route uses the chain-no-auth chain in both modes. Authentik cannot ask itself for a sign-in.

The container carries no kop-public labels, so the route publisher in traefik-agent sends none of these names to tf01, and the public name is not reachable from the internet as the repo stands.

A second route answers /outpost.goauthentik.io/ on any name under the domain. It is what lets an application behind the sign-in chain finish its redirect.

Verify

In Komodo, the authentik-server Stack shows as running with seven services.

On the host, list the Stack's containers. Komodo names the Compose project after the Stack, not after PROJECT_NAME:

docker compose -p authentik-server ps

Every container shows healthy in the STATUS column. The server's own check asks port 9000 for a page, so healthy there means Authentik is answering.

Data worth keeping

Folder under /opt/docker/volumes/authentik	Holds
postgres-data	The live database
postgres-backup-data	The dumps
authentik-media	Uploaded icons and images

All three are on the persistent disk, so they survive a rebuild of the VM. AUTHENTIK_SECRET_KEY has to survive with them, since a database restored under a different key cannot be read.