How to Self-Host Authentik on a VPS (Complete Guide)

Self-hosting applications has become increasingly popular among developers and tech enthusiasts. Authentik is an open-source Identity Provider and Access Management tool that simplifies user authentication for various applications. If you want to self-host Authentik on a VPS, this guide will walk you through the entire process.

Prerequisites

Before you begin, ensure you have:

A VPS provider. Recommended options include:
- Contabo VPS - 5.99 EUR/month
- Hetzner Cloud - 4.15 EUR/month
- DigitalOcean - 6 USD/month
- Vultr - 6 USD/month
- Linode (Akamai Cloud) - 5 USD/month For a detailed comparison, check our full VPS comparison.
A basic understanding of Docker and command-line operations.
A domain name pointed to your VPS (optional, but recommended).

Step 1: Set Up Your VPS

Once you’ve chosen a VPS provider, follow these steps to set up your environment:

Choose an OS: Most people opt for Ubuntu Server (20.04 LTS or later) for its community support and ease of use.
Access Your VPS: Use SSH to connect to your server:
```
ssh root@your-vps-ip
```
Update the Package Lists:
```
sudo apt update && sudo apt upgrade -y
```

Install Docker: Run the following commands to install Docker:

sudo apt install apt-transport-https ca-certificates curl software-properties-common -y
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
sudo apt update
sudo apt install docker-ce -y

Install Docker Compose: To facilitate the multi-container application setup, install Docker Compose:

sudo curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose

Step 2: Create a Directory for Authentik

Organize your files by creating a directory for Authentik:

mkdir -p ~/authentik
cd ~/authentik

Step 3: Create the Docker Compose File

You need to create a docker-compose.yml file for Authentik. Open a text editor to create this file:

nano docker-compose.yml

Insert the following configuration:

version: '3.7'

services:
  authentik:
    image: ghcr.io/goauthentik/server
    restart: always
    environment:
      - DATABASE_URL=sqlite:authentik.db
      - REDIS_URL=redis://redis:6379
    volumes:
      - ./authentik:/authentik
    ports:
      - "8000:9000"

  redis:
    image: redis:alpine
    restart: always

Save and exit (in nano, use CTRL + X, then Y, and Enter).

Step 4: Start Authentik

Run the following command to start Authentik:

docker-compose up -d

To check if everything is working, you can list your running containers:

docker ps

Step 5: Access Authentik

Navigate to http://your-vps-ip:8000 in your web browser. The Authentik setup screen should load. Follow the prompts to create an administrative account.

Configuring Authentik

After setting up Authentik, you will want to configure various authentication sources, connectors, and an interface for users. This setup will depend on your specific use cases, so refer to the Authentik documentation for more details.

Optional: Use a Reverse Proxy

Setting up a reverse proxy with Nginx or Traefik is advisable for production use. A reverse proxy can help with SSL termination and cleaner URLs. Here’s a basic configuration example for Nginx:

Install Nginx:
```
sudo apt install nginx -y
```

Set Up Nginx for Authentik:

sudo nano /etc/nginx/sites-available/authentik

Add the following configuration:

server {
    listen 80;
    server_name your-domain.com;

    location / {
        proxy_pass http://localhost:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable the Configuration:

sudo ln -s /etc/nginx/sites-available/authentik /etc/nginx/sites-enabled/
sudo systemctl restart nginx

FAQs

1. What is Authentik and why should I self-host it?

Authentik is an open-source identity provider and access management solution designed to streamline user authentication across various applications. Self-hosting Authentik gives you complete control over your data, customization options, and the ability to integrate it with your existing applications seamlessly, ensuring that user data privacy is maintained.

2. Can I install Authentik on a VPS with limited resources?

Yes, Authentik can run on a VPS with limited resources, especially when using a Docker setup. However, it is recommended to have at least 1GB of RAM and 1 CPU core for optimal performance. Providers like Hetzner or Contabo offer VPS starting at low monthly prices, making them suitable for basic installations.

3. How does Docker support my Authentik installation?

Using Docker to install Authentik simplifies the deployment process. Docker containers encapsulate all dependencies and runtime requirements, ensuring that your application runs uniformly across different environments. This approach makes it easier to manage updates and scale your application without affecting the underlying system.

By following this guide, you can set up Authentik on your VPS quickly and efficiently. Happy self-hosting! For more resources, check out r/selfhosted or the awesome-selfhosted repository for inspiration on other applications to run on your server.