[{"data":1,"prerenderedAt":140},["ShallowReactive",2],{"seo-verification":3,"blog-self-host-authentik-on-a-vps-open-source-auth0-alternative-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":24,"featuredImage":26,"bgImage":27,"posterImage":28,"relatedSolution":29,"intro":31,"sections":32,"ctaTitle":81,"ctaBody":82,"ctaButton":83,"ctaUrl":84,"relatedPosts":85},192,"self-host-authentik-on-a-vps-open-source-auth0-alternative",{"fr":10,"en":8,"ar":11},"self-host-authentik-vps","استضافة-authentik-على-vps-بديل-auth0-مفتوح-المصدر","Self-Host Authentik on a VPS: Open-Source Auth0 Alternative","Deploy Authentik on a ServOrbit VPS for a full IdP (OIDC, SAML 2.0, passkeys, visual flows) to unify authentication across your entire self-hosted stack.",4,0,false,"2026-07-26T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[25],{"id":19,"name":20,"slug":21,"color":22,"icon":23},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fself-host-authentik-vps-poster.svg",{"categorySlug":23,"appSlug":30},"authentik","Managing access across five self-hosted services without a central IdP means five user databases to sync, five password-reset flows to maintain, and no way to revoke access globally when a team member leaves. Authentik (Apache 2.0, ~22 k ⭐, v2026.5) solves this with a fully self-hosted Identity Provider: OIDC, SAML 2.0, passkeys and a visual flow editor — all in three Docker containers, with no Redis since v2025.10.",[33,37,48,51,74,77],{"type":34,"title":35,"body":36},"h2","Authelia vs Authentik: two complementary tools","Authelia and Authentik are often confused because both touch authentication. The difference is fundamental: Authelia is a forward-auth proxy — it intercepts HTTP requests and requires MFA before passing them through, without managing users itself. Authentik is a full Identity Provider: it has its own user directory, admin console, OIDC and SAML flows, and can export those identities to Authelia or any other consumer. In practice: Authelia protects a service in 5 minutes; Authentik takes 30 minutes but gives you true SSO and user lifecycle management.",{"type":38,"title":39,"items":40},"ul","What you get with Authentik",[41,42,43,44,45,46,47],"OIDC\u002FOAuth2 provider — connect Gitea, Nextcloud, Mattermost, Grafana, Docmost for SSO with a 4-field form.","SAML 2.0 IdP — integrate enterprise SaaS (GSuite, Office 365) that requires SAML without a paid vendor.","LDAP proxy — expose your Authentik directory via LDAP for legacy apps that don't speak OIDC.","Passkeys & WebAuthn — Touch ID, Face ID, YubiKey as a second factor, no plugin required.","Visual flow editor — drag-and-drop canvas to design any auth journey: enrolment, progressive MFA, email verification, captcha.","Self-serve user portal — each user manages their own password, MFA devices and social connections.","Lean stack — PostgreSQL 16 + server + worker, Redis removed since v2025.10.",{"type":34,"title":49,"body":50},"Architecture: 3 containers, no external dependencies","Since v2025.10, the Authentik stack no longer needs Redis. The minimum is: a PostgreSQL 16 container (users, tokens, events) + a server container (Django\u002FPython, admin console on port 9000, \u002Fif\u002Fadmin\u002F) + a worker container (async tasks: emails, token cleanup, LDAP sync). On a 2 GB ServOrbit VPS, all three containers consume around 550 MB at idle — enough for a team of 20 with several OIDC applications connected.",{"type":52,"title":53,"items":54,"steps":70},"steps","Deployment in 5 steps",[55,58,61,64,67],{"title":56,"body":57},"Order a ServOrbit VPS","2 GB RAM on Ubuntu 24.04 is the recommended minimum. The admin console can be resource-hungry during complex configurations; 4 GB is comfortable for production use.",{"title":59,"body":60},"Point a subdomain","Create an A record for `auth.yourdomain.com` pointing to the VPS IP. ServOrbit's reverse proxy automatically provisions a TLS certificate via Let's Encrypt. OIDC callbacks require HTTPS — without a domain, the install cannot work.",{"title":62,"body":63},"Install from the marketplace","In the ServOrbit console: Marketplace → Cybersecurity & Bastion → Authentik → Deploy. The AWX job starts PostgreSQL, generates APP_SECRET and ADMIN_PASSWORD, and starts the server and worker. The admin console is reachable at `https:\u002F\u002Fauth.yourdomain.com\u002Fif\u002Fadmin\u002F` in 60–90 seconds.",{"title":65,"body":66},"Create your first OIDC provider","In the Authentik admin: Applications → Providers → Create → OAuth2\u002FOpenID Provider. Name it `gitea` (or the target service), select the default flow, copy the Client ID and Client Secret. In Gitea, go to Administration → Authentication → Add → OAuth2, fill in these values and the discovery URL `https:\u002F\u002Fauth.yourdomain.com\u002Fapplication\u002Fo\u002Fgitea\u002F.well-known\u002Fopenid-configuration`. Users can now log in to Gitea via Authentik.",{"title":68,"body":69},"Enable passkeys for the admin account","In the Authentik user portal (`\u002Fif\u002Fuser\u002F`), click MFA Devices → Add WebAuthn. Your browser will prompt you to register a passkey (Touch ID \u002F Face ID \u002F FIDO2 key). On the next login to `\u002Fif\u002Fadmin\u002F`, your fingerprint is enough — no password typed, no TOTP code to copy.",[71],{"title":72,"body":73},"Logging in for the first time","Open https:\u002F\u002F\u003Cyour-domain>\u002Fif\u002Fadmin\u002F and sign in with the username akadmin and the password provided. If the application takes you to an initial setup screen, set the password yourself there, immediately.",{"type":34,"title":75,"body":76},"Connect your entire stack via SSO","Every service you deploy from the ServOrbit marketplace can be connected to Authentik in minutes. Nextcloud supports OIDC via the Social Login app. Mattermost is configured under System Console → OAuth 2.0. Grafana reads OIDC from grafana.ini. Docmost, Metabase and Dockge each have an OAuth\u002FOIDC configuration form. Once the plumbing is done, a newly created user in Authentik instantly gains access to all connected services — and revoking an account means a global logout at the next token refresh.",{"type":78,"title":79,"body":80},"tip","Custom authentication flows","The visual flow editor is what truly sets Authentik apart. You can build an enrollment flow that sends a verification email, requests a TOTP, then shows a profile-completion form — all without writing a single line of code. Pre-built stages (Email, Authenticator, Prompt, User Write, Deny) chain together on a canvas and each transition can carry a condition. It's the equivalent of what Auth0 offers with Actions, but open-source and entirely under your control.","Unified authentication on your VPS","Deploy Authentik on a ServOrbit VPS and connect Gitea, Nextcloud, Grafana and all your services via SSO from a single IdP — under your control.","Deploy Authentik","\u002Fmarketplace\u002Fcybersecurity-bastion\u002Fauthentik",[86,103,119],{"id":87,"slug":88,"slugs":89,"title":92,"excerpt":93,"readTime":94,"views":95,"isPinned":16,"publishedAt":96,"category":97,"categories":98,"featuredImage":26,"bgImage":27,"posterImage":100,"relatedSolution":101},162,"self-host-authelia-on-a-vps-mfa-and-sso-for-your-whole-stack",{"fr":90,"en":88,"ar":91},"self-host-authelia-vps","استضافة-authelia-على-vps-مصادقة-ثنائية-ودخول-موحد-لمنظومتك","Self-Host Authelia on a VPS: MFA and SSO for Your Whole Stack","Deploy Authelia on your VPS to add MFA, SSO and fine-grained access control in front of any self-hosted app — no code changes, one configuration file.",5,2,"2026-07-04T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[99],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fself-host-authelia-vps-poster.svg",{"categorySlug":23,"appSlug":102},"authelia",{"id":104,"slug":105,"slugs":106,"title":109,"excerpt":110,"readTime":94,"views":15,"isPinned":16,"publishedAt":111,"category":112,"categories":113,"featuredImage":26,"bgImage":27,"posterImage":115,"relatedSolution":116},164,"self-host-headscale-on-a-vps-your-own-tailscale-control-server",{"fr":107,"en":105,"ar":108},"self-host-headscale-tailscale-vps","استضافة-headscale-على-vps-خادم-تحكم-tailscale-خاص-بك","Self-Host Headscale on a VPS: Your Own Tailscale Control Server","Replace Tailscale's cloud control server with Headscale on your own VPS — unlimited users, full WireGuard mesh networking, magic DNS and ACLs, with no SaaS dependency.","2026-07-05T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[114],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fself-host-headscale-tailscale-vps-poster.svg",{"categorySlug":117,"appSlug":118},"networking-vpn","headscale",{"id":120,"slug":121,"slugs":122,"title":125,"excerpt":126,"readTime":14,"views":15,"isPinned":16,"publishedAt":127,"category":128,"categories":134,"featuredImage":26,"bgImage":27,"posterImage":136,"relatedSolution":137},74,"host-gitea-on-your-own-vps",{"fr":123,"en":121,"ar":124},"heberger-gitea","استضافة-gitea-على-خادم-vps-الخاص-بك","Host Gitea on your own VPS","Deploy Gitea on a VPS with Docker, reverse proxy and SSL. A lightweight, fast Git forge, 100% under your control.","2026-04-07T00:00:00+00:00",{"id":129,"name":130,"slug":131,"color":132,"icon":133},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[135],{"id":129,"name":130,"slug":131,"color":132,"icon":133},"\u002Fblog\u002Fcovers\u002Fheberger-gitea-poster.svg",{"categorySlug":138,"appSlug":139},"development","gitea",1787581011896]