mirror of
https://github.com/goauthentik/authentik
synced 2026-04-25 17:15:26 +02:00
99 lines
4.0 KiB
Plaintext
99 lines
4.0 KiB
Plaintext
---
|
|
title: Automated install
|
|
---
|
|
|
|
To install authentik automatically (skipping the Out-of-box experience), you can use the following environment variables on the worker container:
|
|
|
|
:::info
|
|
These can't be defined using the file-based syntax (`file://`), so you can't pass them in as secrets in a Docker Compose installation.
|
|
:::
|
|
|
|
### `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`
|
|
|
|
Configure the default password for the `akadmin` user using a pre-hashed Django password value. Only read on the first startup.
|
|
|
|
This stores the hash directly as authentik's local password verifier. Because authentik never sees the raw password, hashed-password imports do not propagate the password to LDAP or Kerberos integrations, even when password writeback is enabled.
|
|
|
|
To generate a hash, run this command before your initial deployment:
|
|
|
|
```bash
|
|
docker compose run --rm server hash_password 'your-password'
|
|
```
|
|
|
|
The generated hash includes a random salt, so running the command multiple times for the same password produces different output. Use the complete output as the value of `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`.
|
|
|
|
:::warning Escaping `$` in Docker Compose
|
|
Password hashes contain `$` characters which Docker Compose interprets as variable references.
|
|
|
|
**In `.env` files**, use single quotes to prevent interpolation:
|
|
|
|
```bash
|
|
AUTHENTIK_BOOTSTRAP_PASSWORD_HASH='pbkdf2_sha256$1000000$xKKFuYtJEE27km09BD49x2$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM='
|
|
```
|
|
|
|
**In `docker-compose.yml`** (inline environment), escape each `$` with `$$`:
|
|
|
|
```yaml
|
|
services:
|
|
worker:
|
|
environment:
|
|
AUTHENTIK_BOOTSTRAP_PASSWORD_HASH: "pbkdf2_sha256$$1000000$$xKKFuYtJEE27km09BD49x2$$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM="
|
|
```
|
|
|
|
See the Docker Compose documentation on [`.env` file interpolation](https://docs.docker.com/compose/how-tos/environment-variables/variable-interpolation/) and [Compose file interpolation](https://docs.docker.com/reference/compose-file/interpolation/) for details.
|
|
:::
|
|
|
|
### `AUTHENTIK_BOOTSTRAP_PASSWORD`
|
|
|
|
:::warning
|
|
This option stores plaintext passwords in environment variables. Use [`AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`](#authentik_bootstrap_password_hash) instead.
|
|
:::
|
|
|
|
Configure the default password for the `akadmin` user. Only read on the first startup.
|
|
|
|
Setting both `AUTHENTIK_BOOTSTRAP_PASSWORD` and `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH` will result in an error.
|
|
|
|
### Other hashed-password import paths
|
|
|
|
For post-install automation, hashed passwords can also be set via blueprints with the `password_hash` user attribute, or via the `/api/v3/core/users/<id>/set_password_hash/` API endpoint with the hash provided in the `password` field. The API endpoint requires the `authentik_core.set_user_password_hash` permission and can target regular users or service accounts.
|
|
|
|
These paths share the same local-verifier-only behavior as `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`.
|
|
|
|
### `AUTHENTIK_BOOTSTRAP_TOKEN`
|
|
|
|
Create a token for the default `akadmin` user. Only read on the first startup. The string you specify for this variable is the token key you can use to authenticate yourself to the API.
|
|
|
|
### `AUTHENTIK_BOOTSTRAP_EMAIL`
|
|
|
|
Set the email address for the default `akadmin` user.
|
|
|
|
## Kubernetes
|
|
|
|
In the Helm values, set the `akadmin` user password hash and token:
|
|
|
|
```yaml
|
|
authentik:
|
|
bootstrap_password_hash: "pbkdf2_sha256$1000000$xKKFuYtJEE27km09BD49x2$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM="
|
|
bootstrap_token: "your-token-here"
|
|
bootstrap_email: "admin@authentik.company"
|
|
```
|
|
|
|
:::note Helm escaping
|
|
When using password hashes in quoted YAML strings as shown above, no escaping of `$` characters is required. The `$` character only needs escaping when:
|
|
|
|
- Using Helm templating syntax (e.g., `{{ .Values.something }}`) where `$` has special meaning
|
|
- Referencing values from environment variable substitution in your values file
|
|
|
|
:::
|
|
|
|
Or store the password hash in a secret and reference it via `envFrom`:
|
|
|
|
```yaml
|
|
global:
|
|
envFrom:
|
|
- secretRef:
|
|
name: _some-secret_
|
|
```
|
|
|
|
where _some-secret_ contains the environment variables as documented above.
|