[{"data":1,"prerenderedAt":198},["ShallowReactive",2],{"seo-verification":3,"blog-centralizing-authentication-with-authentik-on-vps-ma-en":6,"promo-bar-likely":197},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-centralizing-authentication-with-authentik-on-vps-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":17,"isPinned":18,"noindex":18,"publishedAt":19,"updatedAt":20,"category":21,"categories":27,"featuredImage":29,"bgImage":30,"posterImage":31,"relatedSolution":32,"intro":35,"sections":36,"ctaTitle":136,"ctaBody":137,"ctaButton":138,"ctaUrl":139,"relatedPosts":140},111,"centralizing-authentication-with-authentik-on-vps",{"fr":12,"en":10,"ar":13,"es":14},"sso-authentik-vps","مركزة-المصادقة-باستخدام-authentik-على-خادم-vps","centralizar-autenticacion-con-authentik-en-vps","Centralizing authentication with Authentik on VPS","Centralize the authentication of all your apps with self-hosted Authentik on a VPS: SSO, MFA and forward auth in Docker Compose.",9,false,"2026-03-01T00:00:00+00:00","2026-10-31T01:54:10+00:00",{"id":22,"name":23,"slug":24,"color":25,"icon":26},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[28],{"id":22,"name":23,"slug":24,"color":25,"icon":26},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fsso-authentik-vps-poster.svg",{"categorySlug":33,"appSlug":34},"securite","authentik","Managing one password per application doesn't scale for an agency or a serious homelab. Authentik is an open source identity provider that centralizes SSO, MFA and user management. Deployed on your VPS, it becomes the single authentication point for your entire self-hosted ecosystem.",[37,41,51,54,63,85,88,103,106,115,118,121,124,133],{"type":38,"title":39,"body":40},"h2","Why centralize authentication on your VPS","When you accumulate self-hosted tools (Grafana, Nextcloud, Gitea, an internal dashboard), each brings its own user base and its own password policy. It's a nightmare to maintain and a multiplied attack surface. Authentik solves this by acting as an identity provider (IdP): it supports OAuth2\u002FOIDC, SAML, LDAP and above all forward auth, which lets you protect any application behind a reverse proxy, even those with no notion of login at all. Self-hosting on a VPS guarantees that your credentials never pass through a third-party service and that you stay in control of the user tree and MFA policies.",{"type":42,"title":43,"items":44},"ul","What you gain with Authentik",[45,46,47,48,49,50],"A single set of credentials for all your applications, with centralized sign-out.","MFA (TOTP, WebAuthn\u002FFIDO2 keys, backup codes) applied uniformly through policy.","Forward auth to protect \"login-less\" apps, which is impossible with a classic IdP.","Fully customizable flows (sign-up, recovery, captcha, access conditions).","OAuth2\u002FOIDC, SAML and LDAP connectors to plug in modern and legacy apps alike.","Instant access provisioning and revocation when a team member leaves.",{"type":38,"title":52,"body":53},"Prerequisites, with numbers","The official Authentik documentation asks for at least 2 CPU cores and 2 GB of RAM, with Docker Compose v2 (or Podman). On a real VPS we recommend 2 vCPUs and 4 GB of RAM: the server, the worker and PostgreSQL share the same machine, and 2 GB leaves no margin as soon as a connection spike or an outpost is added. Also plan for about twenty gigabytes of free disk for images, the database and a few local backups (an indicative estimate, not an official figure). Authentik is a guide provided on a VPS template: ServOrbit does not support it, you keep its administration.",{"type":42,"title":55,"items":56},"Checklist before the first docker compose up",[57,58,59,60,61,62],"A 64-bit Linux VPS with Docker Engine and the Compose v2 plugin: 2 vCPUs and 4 GB of RAM recommended, 2 cores and 2 GB as the strict official minimum.","A dedicated subdomain, for example `auth.example.com`, with an A record (and AAAA if you have IPv6) pointing to the VPS IP.","Ports 80 and 443 open to the reverse proxy; ports 9000 and 9443 of the server container never exposed publicly.","A reverse proxy (nginx, Caddy or Traefik) able to obtain a Let's Encrypt certificate.","A way to recover the administrator account if you lose your second factor: backup codes stored in a password manager.","A backup location outside the VPS.",{"type":64,"title":65,"steps":66},"steps","Deploy Authentik with Docker Compose",[67,70,73,76,79,82],{"title":68,"body":69},"Create the folder and fetch the official compose file","Create a dedicated folder (`mkdir -p \u002Fopt\u002Fauthentik && cd \u002Fopt\u002Fauthentik`) then download the reference file with `wget https:\u002F\u002Fdocs.goauthentik.io\u002Fcompose.yml`. The current file declares three services: `postgresql`, `server` and `worker`. It references the version available at download time, so you must download it again at each upgrade.",{"title":71,"body":72},"Generate the secrets in the .env file","Run `echo \"PG_PASS=$(openssl rand -base64 36 | tr -d '\\n')\" >> .env` then `echo \"AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\\n')\" >> .env`. The documentation states that PostgreSQL passwords longer than 99 characters are not supported. Protect the file (`chmod 600 .env`), never commit it and never reuse an example key.",{"title":74,"body":75},"Bind the ports to localhost only","By default the compose file publishes 9000 (HTTP) and 9443 (HTTPS) on all interfaces. Add `COMPOSE_PORT_HTTP=127.0.0.1:9000` and `COMPOSE_PORT_HTTPS=127.0.0.1:9443` to `.env`: only your local reverse proxy can reach them, and public traffic necessarily goes through HTTPS.",{"title":77,"body":78},"Start the stack","Run `docker compose pull` then `docker compose up -d`. Check with `docker compose ps` that the three containers are up and that `postgresql` is `healthy`, then follow initialization with `docker compose logs -f server`. Database migrations can take a few minutes on first launch.",{"title":80,"body":81},"Finish the install through \u002Fif\u002Fflow\u002Finitial-setup\u002F","On first launch, open `https:\u002F\u002Fauth.example.com\u002Fif\u002Fflow\u002Finitial-setup\u002F` to set the password of the `akadmin` account. It is your super-administrator: protect it with MFA immediately, then create a named administrator account for daily use.",{"title":83,"body":84},"Create a provider and an application","In the admin, create a Provider (OIDC for a modern app, or Proxy for forward auth) then the matching Application. For OIDC, grab the `client_id` \u002F `client_secret` and the `.well-known\u002Fopenid-configuration` URL to paste into the client app.",{"type":38,"title":86,"body":87},"Reverse proxy and TLS","Authentik must be served over HTTPS for session cookies and WebAuthn to work. With nginx, the `auth.example.com` vhost does a `proxy_pass http:\u002F\u002F127.0.0.1:9000;` and forwards the `Host`, `X-Forwarded-For` and `X-Forwarded-Proto` headers, plus `Upgrade` and `Connection` for WebSockets. The certificate comes from `certbot --nginx -d auth.example.com`; Caddy and Traefik do it automatically. If the domain goes through Cloudflare in proxied mode, set the zone's SSL\u002FTLS mode to Full (strict): in Flexible, nginx redirects HTTP to HTTPS and you get an infinite redirect loop.",{"type":64,"title":89,"steps":90},"Protect an application with forward auth on nginx",[91,94,97,100],{"title":92,"body":93},"Create the Proxy Provider","Create a Proxy Provider in single-application forward auth mode, with the app's public URL (`https:\u002F\u002Fapp.example.com`) as External host. Attach it to an Application, then to the embedded outpost in the Outposts section.",{"title":95,"body":96},"Wire auth_request into the app's vhost","In `location \u002F`, add `auth_request \u002Foutpost.goauthentik.io\u002Fauth\u002Fnginx;`, then `error_page 401 = @goauthentik_proxy_signin;`. Also copy the outpost cookies with `auth_request_set $auth_cookie $upstream_http_set_cookie;` and `add_header Set-Cookie $auth_cookie;`. Copy the full block from the nginx page of the documentation matching your version.",{"title":98,"body":99},"Expose the outpost path without authentication","Add a `location \u002Foutpost.goauthentik.io` that does a `proxy_pass` to `http:\u002F\u002F127.0.0.1:9000`, with `Host` set to the original host, `X-Original-URL` set to the full URL, `proxy_pass_request_body off;` and an empty `Content-Length`. This path must stay reachable without login, otherwise the redirect never works.",{"title":101,"body":102},"Handle the redirect and large headers","Declare a `location @goauthentik_proxy_signin` marked `internal` that returns a 302 to `\u002Foutpost.goauthentik.io\u002Fstart?rd=` followed by the original URL. If you see the \"upstream sent too big header\" error, add `proxy_buffers 8 16k;` and `proxy_buffer_size 32k;`. Identities then reach the app in the `X-authentik-username`, `X-authentik-groups` and `X-authentik-email` headers.",{"type":38,"title":104,"body":105},"Back up and restore Authentik","The PostgreSQL database is the most important part of a backup: it holds users, policies, flows and configuration. With the compose defaults (user and database `authentik`), a dump is made with `docker compose exec -T postgresql pg_dump -U authentik -d authentik -Fc > \u002Fvar\u002Fbackups\u002Fauthentik-$(date +%F).dump`. To restore, first stop the application containers with `docker compose stop server worker`, then run `docker compose exec -T postgresql pg_restore -U authentik -d authentik --clean --if-exists \u003C file.dump`, and restart. The order recommended by the documentation is: database first, verification, static directories, then start. A backup that was never restored is only a hypothesis: test on a throwaway machine.",{"type":42,"title":107,"items":108},"What to back up",[109,110,111,112,113,114],"The PostgreSQL database: essential, without it Authentik cannot be brought back.","The `.\u002Fdata` directory (icons, flow backgrounds, uploaded files, CSV reports), unless you use S3 storage.","The `.\u002Fcerts` directory if you rely on filesystem certificates; certificates already imported live in the database.","The `.\u002Fcustom-templates` directory if you changed the look and feel, and custom blueprints if any.","The `.env` file (secret key and PostgreSQL password), encrypted and kept outside the VPS.","A copy of the dumps on remote storage, never only on the machine hosting the database.",{"type":38,"title":116,"body":117},"Upgrade without breaking SSO","Authentik does not support downgrading: back up the database before each upgrade and read the release notes of the target. Upgrade sequentially, going through the latest patch of each major.minor version without skipping any. Download the compose file again (`wget -O compose.yml https:\u002F\u002Fdocs.goauthentik.io\u002Fcompose.yml`), then `docker compose pull` and `docker compose up -d`. Upgrade all outposts at the same time: their version must match the server's. Then check the version under Dashboards > Overview; if it did not change and the logs contain `migration inconsistency`, restore the backup and move up version by version.",{"type":38,"title":119,"body":120},"Redis is no longer part of the stack","Many older tutorials, including the first version of this article, describe a four-container stack with Redis. The 2025.10 release notes state that Authentik no longer uses Redis at all: cache, embedded outpost and WebSockets moved to PostgreSQL, tasks having already moved in 2025.8. The current compose file therefore contains only `postgresql`, `server` and `worker`. Two consequences: expect roughly 50% more PostgreSQL connections, and if your PostgreSQL requires TLS, Authentik requires TLS 1.3 or the Extended Master Secret extension. Remove any Redis settings left in your configuration.",{"type":38,"title":122,"body":123},"Troubleshooting: restart loop with AUTHENTIK_POSTGRESQL__USE_POOL","Symptom reported in goauthentik\u002Fauthentik issue 14320, opened in May 2025 on version 2025.4.0: with `AUTHENTIK_POSTGRESQL__USE_POOL=true`, the server restarts in a loop, with SSL errors such as \"decryption failed or bad record mac\" or \"SSL SYSCALL error: EOF detected\", then a gunicorn worker exiting with code 3 (\"Worker failed to boot\"). Release 2025.4.1, published in May 2025, disabled the option as a precaution, since the root cause had not been found. Actual state of the issue as read on October 30, 2026: still open, labeled confirmed bug, with no linked fix PR, and a 2026.11.0 milestone marked Required since October 23, 2026. A maintainer's hypothesis: the async SSL context shared across threads, although it is not thread-safe. Reported, unofficial lead: a user stated in September 2026 that `AUTHENTIK_WEB__WORKERS=1` and `AUTHENTIK_WEB__THREADS=1` removed the problem; in a maintainer's tests, 1 worker and 1 thread are fine, while 2 or more workers reproduce it. This is neither a fix nor a guarantee, and it limits the interface's capacity. The safest course is not to enable the pool (remove the variable from `.env`) and to reread the issue before any upgrade.",{"type":42,"title":125,"items":126},"Other common failures",[127,128,129,130,131,132],"Redirect loop behind Cloudflare: the zone's SSL\u002FTLS mode is Flexible; switch to Full (strict) and check that `X-Forwarded-Proto` is forwarded.","WebAuthn or cookies refused: the interface is served over HTTP or under another hostname; enforce HTTPS on Authentik's exact domain.","502 error on the protected app: look for \"upstream sent too big header\" in the nginx logs and increase `proxy_buffer_size`.","`server` and `worker` do not start: `postgresql` is not `healthy`; read `docker compose logs postgresql`, and remember that `PG_PASS` and `AUTHENTIK_SECRET_KEY` are mandatory.","Outpost unreachable after an upgrade: its version no longer matches the server's; upgrade it.","Containers killed without a message: on 2 GB of RAM the OOM killer strikes; check with `dmesg | grep -i oom` and move to 4 GB.",{"type":134,"body":135},"tip","Enable an embedded Outpost and use \"property mappings\" to inject headers (`X-authentik-username`, `X-authentik-groups`) into your forward-auth applications: many apps (Grafana, for example) can read these headers to auto-provision users and assign roles. You get not just SSO but a fully automated group-to-role mapping, with no manual configuration in each tool.","Centralize your access on your own VPS","The ServOrbit Cloud VPS with a preconfigured Docker template offers the RAM and storage needed for the Authentik stack (server, worker, PostgreSQL, Redis) ready to receive your applications.","Deploy my Authentik VPS","\u002Fvps-cloud",[141,160,179],{"id":142,"slug":143,"slugs":144,"title":148,"excerpt":149,"readTime":22,"views":150,"isPinned":18,"noindex":18,"publishedAt":151,"updatedAt":152,"category":153,"categories":154,"featuredImage":29,"bgImage":30,"posterImage":156,"relatedSolution":157},105,"monitoring-your-vps-with-uptime-kuma",{"fr":145,"en":143,"ar":146,"es":147},"superviser-vps-uptime-kuma","مراقبة-خادمك-الافتراضي-vps-باستخدام-uptime-kuma","supervisar-vps-con-uptime-kuma","Monitoring your VPS with Uptime Kuma","Deploy Uptime Kuma on your VPS to monitor your sites and services self-hosted, with alerts and a public status page.",0,"2026-03-07T00:00:00+00:00","2026-11-09T20:55:19+00:00",{"id":22,"name":23,"slug":24,"color":25,"icon":26},[155],{"id":22,"name":23,"slug":24,"color":25,"icon":26},"\u002Fblog\u002Fcovers\u002Fsuperviser-vps-uptime-kuma-poster.svg",{"categorySlug":158,"appSlug":159},"monitoring-observability","uptime-kuma",{"id":161,"slug":162,"slugs":163,"title":167,"excerpt":168,"readTime":169,"views":170,"isPinned":18,"noindex":18,"publishedAt":171,"updatedAt":172,"category":173,"categories":174,"featuredImage":29,"bgImage":30,"posterImage":176,"relatedSolution":177},106,"vps-monitoring-with-grafana-and-prometheus",{"fr":164,"en":162,"ar":165,"es":166},"monitoring-vps-grafana-prometheus","مراقبة-الخادم-الافتراضي-vps-باستخدام-grafana-و-prometheus","monitorizacion-vps-grafana-prometheus","VPS Monitoring with Grafana and Prometheus","Deploy Prometheus 3.x, Grafana 13.x, Node Exporter and Alertmanager on your VPS with Docker Compose. Dashboards, alerts and hardening.",11,1,"2026-03-06T00:00:00+00:00","2026-10-05T14:05:27+00:00",{"id":22,"name":23,"slug":24,"color":25,"icon":26},[175],{"id":22,"name":23,"slug":24,"color":25,"icon":26},"\u002Fblog\u002Fcovers\u002Fmonitoring-vps-grafana-prometheus-poster.svg",{"categorySlug":158,"appSlug":178},"grafana",{"id":180,"slug":181,"slugs":182,"title":186,"excerpt":187,"readTime":188,"views":170,"isPinned":18,"noindex":18,"publishedAt":189,"updatedAt":190,"category":191,"categories":192,"featuredImage":29,"bgImage":30,"posterImage":194,"relatedSolution":195},107,"monitor-your-vps-in-real-time-with-netdata",{"fr":183,"en":181,"ar":184,"es":185},"monitorer-vps-netdata","راقب-خادمك-الافتراضي-vps-في-الوقت-الفعلي-باستخدام-netdata","monitorizar-vps-en-tiempo-real-con-netdata","Monitor your VPS in real time with Netdata","Install Netdata on your VPS for per-second real-time monitoring: thousands of metrics, zero configuration, alerts included.",3,"2026-03-05T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":22,"name":23,"slug":24,"color":25,"icon":26},[193],{"id":22,"name":23,"slug":24,"color":25,"icon":26},"\u002Fblog\u002Fcovers\u002Fmonitorer-vps-netdata-poster.svg",{"categorySlug":158,"appSlug":196},"netdata",true,1794270371697]