Identity provider / SSO for the homelab. Version 2026.5.3 (pinned). Server + worker + PostgreSQL 16 + Redis 7 via Docker Compose.
| Guest | LXC 117 "Authentik" on M910q |
| IP | 192.168.86.213 |
| Tailscale | — |
| Resources | 1 vCPU / 3 GB |
| Rootfs | 20G ceph-storage |
| Port | Purpose |
|---|---|
| 9000 | HTTP UI/API |
| 9443 | HTTPS (self-signed) — NPM forward-auth outposts point here |
/opt/authentik/docker-compose.yml; secrets properly in .env (PG_PASS, AUTHENTIK_SECRET_KEY) ✅./postgres (DB), ./media, ./custom-templates — all on the LXC rootfs⚠️ Not in the vzdump job and no DB dumps — this is the SSO identity store; losing it locks you out of everything behind forward-auth. Add LXC 117 to vzdump + periodic docker exec authentik-postgresql-1 pg_dump -U authentik authentik.
cd /opt/authentik && docker compose pull && docker compose up -d && docker image prune -f
Pinned version — bump the image tag deliberately, read release notes (authentik upgrades run DB migrations).
Kuma: Authentik - Ping / Local (:9000 keyword) / Domain (auth.codycodez.com).