Authentik
Authentik: a first setup, important settings, verification, and recovery considerations.
Working directory: ~/homelab/core/auth. Follow the common setup workflow first. This is a setup note based on the linked documentation, not a copy of my live configuration or a runtime verification of this full stack.
Start here
Authentik provides identity and application sign-in. Download the official Compose file for one release and keep its server, worker, and database dependencies together. Older guides may describe different dependencies. First prove local administrator access before putting another application behind it.
Settings and data
Generate the database password and Authentik secret key once and protect them. Keep the database private. Review optional Docker-socket access and outpost management in the official example; do not grant host-management access simply to test login. Retain an independent recovery administrator for dependent services where supported.
Check it
Create a test user, add MFA, and integrate one disposable application with an exact redirect URI. Test sign-in, sign-out, and an unauthorized account. Verify that bypassing the proxy cannot reach the protected application through a separately published port.
When something fails
Redirect mismatch calls for comparing scheme, hostname, path, and trailing slash with the registered URI. Time-based MFA needs correct clocks. Back up database, required media/configuration, and secret key together. Do not migrate every service until a restore and an authentication-outage procedure are documented.