Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
Deploy Authentik with Docker Compose, including PostgreSQL, initial admin, Nginx reverse proxy, OIDC provider, application integration, MFA, recovery account, SMTP and backup.
Deploy Authentik with Docker Compose, including PostgreSQL, initial admin, Nginx reverse proxy, OIDC provider, application integration, MFA, recovery account, SMTP and backup. Every command is presented as an operational step; replace example hostnames, passwords and secrets before execution.
Turkey (Turkish)
Germany (German)
Worldwide (English)
mkdir -p /opt/authentik && cd /opt/authentik
wget -O compose.yml https://docs.goauthentik.io/compose.ymlecho "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env
echo "AUTHENTIK_ERROR_REPORTING__ENABLED=false" >> .envAUTHENTIK_EMAIL__HOST=smtp.example.com
AUTHENTIK_EMAIL__PORT=587
[email protected]
AUTHENTIK_EMAIL__PASSWORD=SMTP_PAROLASI
AUTHENTIK_EMAIL__USE_TLS=true
[email protected]sudo docker compose -f compose.yml config
sudo docker compose -f compose.yml up -d
sudo docker compose -f compose.yml ps
curl -I http://127.0.0.1:9000/if/flow/initial-setup/sudo docker compose -f compose.yml run --rm worker ak dump_config
sudo docker compose -f compose.yml logs --since 10m server workersudo docker compose -f compose.yml exec -T postgresql pg_dump -U authentik -d authentik -Fc > authentik-$(date +%F).dump
sha256sum authentik-$(date +%F).dumpsudo docker compose -f compose.yml exec server ak changepassword akadmincd /opt/authentik
sudo docker compose -f compose.yml pull
sudo docker compose -f compose.yml up -d
sudo docker compose -f compose.yml pssudo apt update
sudo apt install -y nginx certbot python3-certbot-nginx
sudo tee /etc/nginx/sites-available/sso.example.com > /dev/null <<'NGINX'
server {
listen 80;
listen [::]:80;
server_name sso.example.com;
client_max_body_size 10G;
proxy_read_timeout 3600;
proxy_send_timeout 3600;
location / {
proxy_pass http://127.0.0.1:9000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
NGINX
sudo ln -s /etc/nginx/sites-available/sso.example.com /etc/nginx/sites-enabled/sso.example.com
sudo nginx -t
sudo systemctl reload nginxsudo certbot --nginx -d sso.example.com --redirect --agree-tos --no-eff-email -m [email protected]
sudo certbot renew --dry-run
curl -I https://sso.example.com
openssl s_client -connect sso.example.com:443 -servername sso.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates| Belirti / Symptom | Kök neden ve çözüm / Root cause and fix |
|---|---|
| Service or container does not start | Inspect compose configuration, dependency health, file permissions and the first fatal log line instead of repeatedly restarting. |
| Domain opens but HTTPS fails | Check A/AAAA records, ports 80/443, proxy mode, certificate challenge and conflicting reverse proxies. |
| Application cannot reach its database or queue | Use the internal service hostname, verify credentials and health checks, and keep database ports off the public interface. |
| Works initially but fails under load | Measure memory peaks, disk latency, connection pools and worker concurrency; increase capacity only after identifying the bottleneck. |
Yes after secrets are replaced, public access is restricted and a complete restore test has succeeded.
Minimums only prove the software can start. Size CPU, memory, IOPS and storage from representative workload measurements.
Yes. Use Full (strict) TLS and configure origin certificates, WebSockets and client IP forwarding where required.
Do not automatically apply major releases. Review migrations, back up data and retain the previous tested image.
Back up databases, uploaded files, persistent volumes, configuration, encryption keys and the deployed version together.
An NVMe VPS fits normal web workloads. Inference, accelerated OCR and video transcoding may require a compatible GPU.
Deploy Authentik with Docker Compose, including PostgreSQL, initial admin, Nginx reverse proxy, OIDC provider, application integration, MFA, recovery account, SMTP and backup.