mirror of
https://github.com/goauthentik/authentik
synced 2026-04-25 17:15:26 +02:00
122 lines
4.9 KiB
Plaintext
122 lines
4.9 KiB
Plaintext
---
|
|
title: Compose installation
|
|
---
|
|
|
|
This installation method is for test setups and small-scale production setups.
|
|
|
|
## Requirements
|
|
|
|
- A host with at least 2 CPU cores and 2 GB of RAM
|
|
- Podman or Docker
|
|
- Podman or Docker Compose (Compose v2, see [instructions for upgrade](https://docs.docker.com/compose/migrate/))
|
|
|
|
## Video
|
|
|
|
<iframe
|
|
width="560"
|
|
height="315"
|
|
src="https://www.youtube.com/embed/O1qUbrk4Yc8?si=HiSBjmJYhE_oJhB1&start=22"
|
|
title="YouTube video player"
|
|
frameBorder="0"
|
|
allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"
|
|
allowFullScreen
|
|
></iframe>
|
|
|
|
## Preparation
|
|
|
|
To download the latest `compose.yml` open your terminal and navigate to the directory of your choice.
|
|
Run the following command:
|
|
|
|
import TabItem from "@theme/TabItem";
|
|
import Tabs from "@theme/Tabs";
|
|
|
|
{/* prettier-ignore */}
|
|
<Tabs groupId="OS">
|
|
<TabItem value="Linux" label="Linux" default>
|
|
```shell
|
|
wget https://docs.goauthentik.io/compose.yml
|
|
```
|
|
</TabItem>
|
|
<TabItem value="macOS" label="macOS">
|
|
```shell
|
|
curl -O https://docs.goauthentik.io/compose.yml
|
|
```
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
If this is a fresh authentik installation, you need to generate a password and a secret key. Use a secure password generator of your choice such as pwgen, or you can use `openssl` as below.
|
|
|
|
Run the following commands to generate a password and secret key and write them to your `.env` file:
|
|
|
|
{/* prettier-ignore */}
|
|
```shell
|
|
echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
|
|
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env
|
|
```
|
|
|
|
:::info
|
|
Because of a PostgreSQL limitation, only passwords up to 99 chars are supported. See: https://www.postgresql.org/message-id/09512C4F-8CB9-4021-B455-EF4C4F0D55A0@amazon.com
|
|
:::
|
|
|
|
To enable error reporting, run the following command:
|
|
|
|
```shell
|
|
echo "AUTHENTIK_ERROR_REPORTING__ENABLED=true" >> .env
|
|
```
|
|
|
|
## Email configuration (optional but recommended)
|
|
|
|
It is also recommended to configure global email settings. These are used by authentik to notify administrators about alerts, configuration issues and new releases. They can also be used by [Email stages](../../add-secure-apps/flows-stages/stages/email/index.mdx) to send verification/recovery emails.
|
|
|
|
For more information, refer to our [Email configuration](../email.mdx) documentation.
|
|
|
|
## Startup
|
|
|
|
:::warning
|
|
All internal operations use UTC. Times displayed in the UI are automatically localized for the user. Do not update or mount `/etc/timezone` or `/etc/localtime` in the authentik containers; it will cause problems with OAuth and SAML authentication, as seen this [GitHub issue](https://github.com/goauthentik/authentik/issues/3005).
|
|
:::
|
|
|
|
Afterward, run these commands to finish:
|
|
|
|
```shell
|
|
docker compose pull
|
|
docker compose up -d
|
|
```
|
|
|
|
The `compose.yml` file statically references the latest version available at the time of downloading the compose file. Each time you upgrade to a newer version of authentik, you download a new `compose.yml` file, which points to the latest available version. For more information, refer to the **Upgrading** section in the [Release Notes](../../../releases/).
|
|
|
|
To start the initial setup, navigate to `http://<your server's IP or hostname>:9000/if/flow/initial-setup/`.
|
|
|
|
:::info
|
|
You will get a `Not Found` error if initial setup URL doesn't include the trailing forward slash `/`. Make sure you use the complete url (`http://<your server's IP or hostname>:9000/if/flow/initial-setup/`) including the trailing forward slash.
|
|
:::
|
|
|
|
There you are prompted to set a password for the `akadmin` user (the default user).
|
|
|
|
For an explanation about what each service in the docker compose file does, see [Architecture](../../core/architecture.md).
|
|
|
|
## Configure custom ports
|
|
|
|
By default, authentik listens internally on port 9000 for HTTP and 9443 for HTTPS. To use different exposed ports such as 80 and 443, you can set the following variables in `.env`:
|
|
|
|
```shell
|
|
COMPOSE_PORT_HTTP=80
|
|
COMPOSE_PORT_HTTPS=443
|
|
```
|
|
|
|
See [Configuration](../configuration/configuration.mdx) to change the internal ports. Be sure to run `docker compose up -d` to rebuild with the new port numbers.
|
|
|
|
## Docker socket
|
|
|
|
By default, the authentik Docker Compose file mounts the Docker socket to the authentik worker container:
|
|
|
|
```yaml
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
```
|
|
|
|
This is used for [automatic deployment and management of authentik Outposts](../../add-secure-apps/outposts/integrations/docker.md).
|
|
|
|
Mounting the Docker socket to a container comes with some inherent security risks. To reduce these risks, you can utilize a [Docker Socket Proxy](../../add-secure-apps/outposts/integrations/docker.md#docker-socket-proxy) as an additional layer of protection.
|
|
|
|
Alternatively, you can remove this mount and instead [manually deploy and manage outposts](../../add-secure-apps/outposts/manual-deploy-docker-compose.md).
|