[{"data":1,"prerenderedAt":118},["ShallowReactive",2],{"seo-verification":3,"blog-sso-authentik-vps-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"title":9,"excerpt":10,"readTime":11,"views":12,"isPinned":13,"publishedAt":14,"category":15,"categories":20,"featuredImage":22,"bgImage":23,"posterImage":24,"relatedSolution":25,"intro":28,"sections":29,"ctaTitle":72,"ctaBody":73,"ctaButton":74,"ctaUrl":75,"relatedPosts":76},111,"sso-authentik-vps","Centralizing authentication with Authentik on VPS","Centralize the authentication of all your apps with self-hosted Authentik on a VPS: SSO, MFA and forward auth in Docker Compose.",8,707,false,"2026-03-01T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[21],{"id":11,"name":16,"slug":17,"color":18,"icon":19},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fsso-authentik-vps-poster.svg",{"categorySlug":26,"appSlug":27},"securite","authentik","Managing one password per application doesn't scale for an agency or a serious homelab. Authentik is an open source identity provider that centralizes SSO, MFA and user management. Deployed on your VPS, it becomes the single authentication point for your entire self-hosted ecosystem.",[30,34,44,47,69],{"type":31,"title":32,"body":33},"h2","Why centralize authentication on your VPS","When you accumulate self-hosted tools (Grafana, Nextcloud, Gitea, an internal dashboard), each brings its own user base and its own password policy. It's a nightmare to maintain and a multiplied attack surface. Authentik solves this by acting as an identity provider (IdP): it supports OAuth2\u002FOIDC, SAML, LDAP and above all forward auth, which lets you protect any application behind a reverse proxy, even those with no notion of login at all. Self-hosting on a VPS guarantees that your credentials never pass through a third-party service and that you remain in control of the user tree and the MFA policies.",{"type":35,"title":36,"items":37},"ul","What you gain with Authentik",[38,39,40,41,42,43],"A single set of credentials for all your applications, with centralized logout.","MFA (TOTP, WebAuthn\u002FFIDO2 keys, backup codes) applied uniformly by policy.","Forward auth to protect \"login-less\" apps, impossible with a classic IdP.","Fully customizable flows (registration, recovery, captcha, access conditions).","OAuth2\u002FOIDC, SAML and LDAP connectors to plug in both modern and legacy apps.","Immediate access provisioning and revocation when a collaborator leaves.",{"type":31,"title":45,"body":46},"Requirements for this deployment","Authentik is more demanding than a simple service: the stack includes the server, a worker, PostgreSQL and Redis. Count on a VPS with at least 2 vCPU and 4 GB of RAM for comfortable operation, 2 GB being a strict minimum that can struggle under load. Docker and Docker Compose are required, as well as a dedicated domain name (`auth.mydomain.com`) with an A record. A reverse proxy (Traefik, Nginx Proxy Manager or Caddy) is indispensable to handle SSL and forward auth to your other applications.",{"type":48,"title":49,"steps":50},"steps","Deploy Authentik with Docker Compose",[51,54,57,60,63,66],{"title":52,"body":53},"Get the official compose file and generate the secrets","Download Authentik's reference `docker-compose.yml`. Generate the sensitive values in a `.env` file: `PG_PASS` and `AUTHENTIK_SECRET_KEY` via `openssl rand -base64 60`. Never reuse an example key.",{"title":55,"body":56},"Start the stack","Run `docker compose up -d`. Four containers come up: `server`, `worker`, `postgresql` and `redis`. Monitor the initialization with `docker compose logs -f server` until you see the server ready to listen.",{"title":58,"body":59},"Finalize the installation via \u002Fif\u002Fflow\u002Finitial-setup\u002F","On first launch, go to `https:\u002F\u002Fauth.mydomain.com\u002Fif\u002Fflow\u002Finitial-setup\u002F` to set the password for the `akadmin` account. This is your super-administrator: protect it immediately with MFA.",{"title":61,"body":62},"Configure the reverse proxy and SSL","Route `auth.mydomain.com` to port `9000` (HTTP) or `9443` (HTTPS) of the server container via your reverse proxy, with a Let's Encrypt certificate. Authentik absolutely must be served over HTTPS for session cookies and WebAuthn to work.",{"title":64,"body":65},"Create a provider and an application","In the admin, create a Provider (OIDC for a modern app, or Proxy for forward auth) then the associated Application. For OIDC, retrieve the `client_id` \u002F `client_secret` and the `.well-known\u002Fopenid-configuration` URL to paste into the client app.",{"title":67,"body":68},"Protect an app with forward auth","For an application without native login, create a Proxy Provider and declare an authentication middleware in your reverse proxy pointing to the `\u002Foutpost.goauthentik.io\u002Fauth\u002F` endpoint. Any unauthenticated request is then redirected to Authentik before reaching the app.",{"type":70,"body":71},"tip","Enable an integrated Outpost and leverage \"property mappings\" to inject headers (`X-authentik-username`, `X-authentik-groups`) into your forward auth applications: many apps (Grafana, for example) can read these headers to do user auto-provisioning and role assignment. You thus get not only SSO, but also a fully automated group-to-role mapping, without manual configuration in each tool.","Centralize your access on your own VPS","The ServOrbit Cloud VPS with a preconfigured Docker template offers the RAM and storage needed for the Authentik stack (server, worker, PostgreSQL, Redis) ready to receive your applications.","Deploy my Authentik VPS","\u002Fvps-cloud",[77,91,105],{"id":78,"slug":79,"title":80,"excerpt":81,"readTime":82,"views":83,"isPinned":13,"publishedAt":84,"category":85,"categories":86,"featuredImage":22,"bgImage":23,"posterImage":88,"relatedSolution":89},105,"superviser-vps-uptime-kuma","Monitoring your VPS with Uptime Kuma","Deploy Uptime Kuma on your VPS to monitor your sites and services self-hosted, with alerts and a public status page.",6,1520,"2026-03-07T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},[87],{"id":11,"name":16,"slug":17,"color":18,"icon":19},"\u002Fblog\u002Fcovers\u002Fsuperviser-vps-uptime-kuma-poster.svg",{"categorySlug":26,"appSlug":90},"uptime-kuma",{"id":92,"slug":93,"title":94,"excerpt":95,"readTime":96,"views":97,"isPinned":13,"publishedAt":98,"category":99,"categories":100,"featuredImage":22,"bgImage":23,"posterImage":102,"relatedSolution":103},106,"monitoring-vps-grafana-prometheus","VPS Monitoring with Grafana and Prometheus","Set up a Grafana + Prometheus stack on your VPS to collect, store and visualize your system and application metrics.",9,522,"2026-03-06T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},[101],{"id":11,"name":16,"slug":17,"color":18,"icon":19},"\u002Fblog\u002Fcovers\u002Fmonitoring-vps-grafana-prometheus-poster.svg",{"categorySlug":26,"appSlug":104},"grafana",{"id":106,"slug":107,"title":108,"excerpt":109,"readTime":82,"views":110,"isPinned":13,"publishedAt":111,"category":112,"categories":113,"featuredImage":22,"bgImage":23,"posterImage":115,"relatedSolution":116},107,"monitorer-vps-netdata","Monitor your VPS in real time with Netdata","Install Netdata on your VPS for per-second real-time monitoring: thousands of metrics, zero configuration, alerts included.",559,"2026-03-05T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},[114],{"id":11,"name":16,"slug":17,"color":18,"icon":19},"\u002Fblog\u002Fcovers\u002Fmonitorer-vps-netdata-poster.svg",{"categorySlug":26,"appSlug":117},"netdata",1785628462162]