Installing Authentik on VPS: SSO,

Configuration

After installing Authentik, we need to configure access to it via the web interface, ensure traffic encryption with HTTPS, and verify its functionality. For these purposes, we will use Caddy — a powerful and easy-to-configure web server that automatically manages Let's Encrypt certificates.

1. Installing and Configuring Caddy

Caddy significantly simplifies HTTPS setup by automatically obtaining and renewing SSL certificates. We will install it on the VPS.

# 1. Install necessary dependencies to add the Caddy repository
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https

# 2. Add Caddy's GPG key
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg

# 3. Add Caddy repository
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list

# 4. Update APT package index and install Caddy
sudo apt update
sudo apt install caddy -y

# 5. Check Caddy status (it should be running automatically)
sudo systemctl status caddy

If Caddy is not running, use sudo systemctl start caddy.

2. Configuring Caddyfile for Authentik

Create or edit the Caddy configuration file (Caddyfile) to act as a reverse proxy for Authentik.

sudo nano /etc/caddy/Caddyfile

Remove existing content and add the following:

your.domain.com {
    # Replace 'your.domain.com' with your actual domain name (e.g., auth.example.com)

    # Enable GZIP compression
    encode gzip

    # Reverse proxy settings for Authentik
    reverse_proxy authentik:9000 {
        # Headers for correct proxying
        header_up Host {host}
        header_up X-Real-IP {remote_ip}
        header_up X-Forwarded-For {remote_ip}
        header_up X-Forwarded-Proto {scheme}
    }

    # Log settings (optional, but useful for debugging)
    log {
        output file /var/log/caddy/access.log
    }
}

Important: replace your.domain.com with your actual domain that you specified in the Authentik .env file (e.g., auth.example.com). Ensure that the DNS A-record for this domain points to your VPS's IP address.

Save changes (Ctrl+O, Enter, Ctrl+X) and validate the Caddy configuration:

sudo caddy validate --config /etc/caddy/Caddyfile

If the configuration is correct, reload Caddy to apply the changes:

sudo systemctl reload caddy

Caddy will automatically obtain SSL/TLS certificates from Let's Encrypt for your domain. To do this, ensure that ports 80 and 443 are open in the firewall (we did this during server preparation).

3. Working with Secrets

As shown previously, all sensitive data, such as the Authentik secret key (AUTHENTIK_SECRET_KEY) and database passwords, are stored in the .env file. This is standard practice for Docker applications. Never store this data directly in docker-compose.yml or in public repositories.

Ensure that the .env file has restricted permissions so that only the owner can read it:

chmod 600 ~/authentik/.env

4. Verifying Functionality

After configuring all components, we will perform several checks to ensure that Authentik is working correctly.

• Check Docker container status:

docker compose ps

All containers (authentik_server, authentik_worker, redis) should be in running status.

• Check Authentik logs:

docker compose logs authentik_server
docker compose logs authentik_worker

Look for errors or warnings. Normal logs should show successful startup and initialization.

• Check Caddy status:

sudo systemctl status caddy
sudo journalctl -u caddy --no-pager

Ensure that Caddy is running and there are no errors in the logs related to certificate acquisition or proxying.

• Check access via curl:

curl -I https://your.domain.com/

You should receive an HTTP status of 200 OK or 302 Found (redirect to the Authentik login page), which indicates a successful connection and HTTPS operation.

• Access via browser:

Open https://your.domain.com/ in your web browser. You should see the Authentik login page. Use the superuser credentials created earlier for the first login.

Congratulations! Authentik is successfully installed and configured on your VPS with HTTPS. You can now proceed to integrate your applications.

Troubleshooting + FAQ

In this section, we will cover typical problems that may arise during Authentik installation and operation, and answer frequently asked questions.

Authentik containers are not starting.

What to check: First, check the Docker Compose logs. Go to the Authentik directory (~/authentik) and run docker compose logs. This will show the output of all containers. If the problem is with a specific container (e.g., authentik_server), you can view its logs separately: docker compose logs authentik_server.

How to fix: Look for error messages in the logs. Common causes: incorrect parameters in the .env file (especially AUTHENTIK_SECRET_KEY or DB parameters), PostgreSQL database unavailability (check if PostgreSQL is running: sudo systemctl status postgresql), port conflicts (if another service is already using port 9000), or insufficient resources (RAM/CPU) on the VPS.

Cannot connect to Authentik via browser (502 Bad Gateway or Connection Refused).

What to check:

• DNS A-record: Make sure your domain name (e.g., auth.example.com) correctly points to your VPS's IP address. Use dig your.domain.com or nslookup your.domain.com.
• Caddy/Nginx status: Check if your reverse proxy server is running: sudo systemctl status caddy (or nginx).
• Caddy/Nginx logs: Examine the proxy server logs. For Caddy, this is sudo journalctl -u caddy --no-pager or the file specified in Caddyfile (e.g., /var/log/caddy/access.log). For Nginx, it's usually /var/log/nginx/error.log.
• Firewall: Make sure ports 80 and 443 are open in UFW: sudo ufw status verbose.
• Authentik internal accessibility: Try running curl http://localhost:9000 on the VPS itself. If this works, the problem is with the proxy server or its configuration.

How to fix: If the problem is with DNS, update the A-record with your domain name registrar. If Caddy is not running, try starting it: sudo systemctl start caddy and check the Caddyfile for syntax errors. Make sure the Caddyfile specifies the correct address for proxying (authentik:9000 or localhost:9000, depending on the Docker network configuration).

TLS issues (Let's Encrypt certificates).

What to check: Caddy automatically obtains certificates. The main reason for problems is Caddy's inability to contact Let's Encrypt servers. Make sure that:

• Your domain is accessible from the internet on ports 80 and 443.
• No other services are occupying these ports.
• The DNS A-record for the domain is configured correctly.

How to fix: Check Caddy logs for error messages when obtaining certificates. Make sure UFW allows incoming traffic on ports 80 and 443. If you have just updated DNS, give it time to propagate (up to several hours).

What is the minimum suitable VPS configuration?

For a small team (up to 50 users) and basic authentication scenarios, a VPS with 2 vCPU, 4 GB RAM, and 80 GB NVMe SSD will be minimally suitable. This will ensure stable operation of Authentik and PostgreSQL, but without much room for growth or high load.

What to choose — VPS or dedicated for this task?

For most scenarios, especially for teams of up to several hundred users, a VPS will be an optimal and cost-effective solution. A dedicated server should be considered for very high loads (thousands of active users, intensive requests), strict performance requirements, or the need for full control over hardware. A VPS offers sufficient flexibility and power for most centralized authentication needs.

How to update Authentik?

To update Authentik, you need to update its Docker images. Go to the Authentik installation directory (~/authentik), then run: docker compose pull (to download new images), docker compose down (to stop current containers), and docker compose up -d (to start new containers). Always check the official Authentik documentation before major updates for database migrations or configuration changes to avoid compatibility issues.

How to change the Authentik superuser password?

If you forgot the superuser password, you can reset it by running a command inside the Authentik container: docker compose exec authentik sh -c "python3 manage.py changepassword admin" (replace admin with your superuser's name). The system will prompt you to enter a new password.