authentik

Upstream source: Current installation guide. authentik needs PostgreSQL, a web server, and a background worker. Server and worker share the same application data volume. This minimal stack omits the upstream Docker socket mount, so Docker-managed outposts must be arranged separately.

Towbar manifest

.towbar/services/authentik.compose.yml

id: authentik
name: authentik
file: deploy/authentik/compose.yml
strategy: maintenance
services:
  server:
    port: 9000
    domains:
      - authentik.example.com
    ingress:
      type: proxy
  postgresql: {}
  worker: {}
environments:
  production:
    server: 192.0.2.10
secrets:
  runtime:
    - PG_PASS
    - AUTHENTIK_SECRET_KEY

Compose project

deploy/authentik/compose.yml

services:
  postgresql:
    image: postgres:16-alpine@sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea
    environment:
      POSTGRES_DB: authentik
      POSTGRES_USER: authentik
      POSTGRES_PASSWORD: ${PG_PASS}
    volumes:
      - database:/var/lib/postgresql/data
    healthcheck:
      test:
        - CMD-SHELL
        - pg_isready -U authentik -d authentik
      interval: 10s
      retries: 10
  server:
    image: ghcr.io/goauthentik/server:2026.8.3@sha256:ab9b4e8cc4ab3f8d1198d2db6aeea66bafea1963b3f2843589e0d163f97d9849
    command:
      - server
    depends_on:
      postgresql:
        condition: service_healthy
    environment:
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
    volumes:
      - data:/data
  worker:
    image: ghcr.io/goauthentik/server:2026.8.3@sha256:ab9b4e8cc4ab3f8d1198d2db6aeea66bafea1963b3f2843589e0d163f97d9849
    command:
      - worker
    user: root
    depends_on:
      postgresql:
        condition: service_healthy
    environment:
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
    volumes:
      - data:/data
      - certs:/certs
volumes:
  database: {}
  data: {}
  certs: {}

Configure

Prepare the example server, connect the repository, and map production to the branch containing these files. Replace the example server IP and domain.
Commit every file shown below under deploy/authentik/. The Towbar manifest points to the Compose file; it does not create it for you.
Sync the repository and inspect the resolved Compose project. Save the runtime values below if this example declares any.
Use a server with at least two CPU cores and 2 GB of RAM, as required by the upstream Compose guide. Save PG_PASS and AUTHENTIK_SECRET_KEY before deploying.
Back up PostgreSQL and the shared data/certificate volumes together. Without the Docker socket, deploy any future outposts manually.
Deploy it manually and run the verification below before enabling auto-deploy.

Runtime values

Save these values on the Compose project after the repository sync. The manifest declares required keys, not their values.

Key	Value to save
`PG_PASS`	Generate a unique PostgreSQL password (under 100 characters).
`AUTHENTIK_SECRET_KEY`	Generate a long random key; retain it across upgrades.

Verify

Open /if/flow/initial-setup/ to set the first akadmin password, create a test application and provider, and confirm the worker is healthy after a redeploy. For field constraints, see Compose guide.

Start here

Open-source software

Service recipes

Datastore recipes

Complete stacks

Towbar manifest

Compose project

Configure

Runtime values

Verify

​Towbar manifest

​Compose project

​Configure

​Runtime values

​Verify

Towbar manifest

Compose project

Configure

Runtime values

Verify