Authentik - Revision history

Writer: Consolidate example domains

2026-07-19T11:48:16Z

Consolidate example domains

← Older revision		Revision as of 11:48, 19 July 2026
Line 24:		Line 24:
	=== Preresiquites ===		=== Preresiquites ===

	# This example suggest to use https://auth.example~~.com~~ as the URL of authentik. Add the DNS records (A and AAAA) for <code>auth</code> to the DNS configuration of your domain. If you change the <code>domain</code> option, you can use any other subdomain.		# This example suggest to use https://auth.yourdomain.example as the URL of authentik. Add the DNS records (A and AAAA) for <code>auth</code> to the DNS configuration of your domain. If you change the <code>domain</code> option, you can use any other subdomain.
	# Create an agenix secret file named <code>authentik-secret-key.age</code> and add a secret key using <code>openssl rand -base64 60 \| tr -d '\n'</code><ref>[https://docs.goauthentik.io/install-config/install/docker-compose/#generate-postgresql-password-and-secret-key authentik's Docker Compose installation documentation]</ref>		# Create an agenix secret file named <code>authentik-secret-key.age</code> and add a secret key using <code>openssl rand -base64 60 \| tr -d '\n'</code><ref>[https://docs.goauthentik.io/install-config/install/docker-compose/#generate-postgresql-password-and-secret-key authentik's Docker Compose installation documentation]</ref>

Writer: Fix capitalization of env vars

2026-07-19T11:43:18Z

Fix capitalization of env vars

← Older revision		Revision as of 11:43, 19 July 2026
Line 61:		Line 61:
	# Configuration that is common to authentik's server and worker processes		# Configuration that is common to authentik's server and worker processes
	commonEnvironment = {		commonEnvironment = {
	~~authentik_POSTGRESQL__HOST~~ = "/run/postgresql";		AUTHENTIK_POSTGRESQL__HOST = "/run/postgresql";
	~~authentik_POSTGRESQL__NAME~~ = "authentik";		AUTHENTIK_POSTGRESQL__NAME = "authentik";
	~~authentik_POSTGRESQL__USER~~ = "authentik";		AUTHENTIK_POSTGRESQL__USER = "authentik";

	~~authentik_LISTEN__TRUSTED_PROXY_CIDRS~~ = "127.0.0.0/8,::1/128";		AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS = "127.0.0.0/8,::1/128";

	~~authentik_STORAGE__FILE__PATH~~ = authentikStateDir;		AUTHENTIK_STORAGE__FILE__PATH = authentikStateDir;

	~~authentik_SECRET_KEY~~ = "file://${config.age.secrets.authentik-secret-key.path}";		AUTHENTIK_SECRET_KEY = "file://${config.age.secrets.authentik-secret-key.path}";

	~~authentik_LOG_LEVEL~~ = "info";		AUTHENTIK_LOG_LEVEL = "info";
	};		};

	serverEnvironment = commonEnvironment // {		serverEnvironment = commonEnvironment // {
	~~authentik_LISTEN__HTTP~~ = "127.0.0.1:${toString serverHttpPort}";		AUTHENTIK_LISTEN__HTTP = "127.0.0.1:${toString serverHttpPort}";
	~~authentik_LISTEN__METRICS~~ = "127.0.0.1:${toString serverMetricsPort}";		AUTHENTIK_LISTEN__METRICS = "127.0.0.1:${toString serverMetricsPort}";
	};		};

	workerEnvironment = commonEnvironment // {		workerEnvironment = commonEnvironment // {
	~~authentik_LISTEN__HTTP~~ = "127.0.0.1:${toString workerHttpPort}";		AUTHENTIK_LISTEN__HTTP = "127.0.0.1:${toString workerHttpPort}";
	~~authentik_LISTEN__METRICS~~ = "127.0.0.1:${toString workerMetricsPort}";		AUTHENTIK_LISTEN__METRICS = "127.0.0.1:${toString workerMetricsPort}";
	};		};

Writer: Fix file name

2026-07-19T11:41:26Z

Fix file name

← Older revision		Revision as of 11:41, 19 July 2026
Line 39:		Line 39:
	</nowiki>}}		</nowiki>}}
	{{File		{{File
	\|name=/etc/nixos/~~configuration~~.nix		\|name=/etc/nixos/authentik.nix
	\|lang=nix		\|lang=nix
	\|3={ config, pkgs, lib, ... }:		\|3={ config, pkgs, lib, ... }:

Writer: Remove superfluous >

2026-07-19T11:37:40Z

Remove superfluous >

← Older revision		Revision as of 11:37, 19 July 2026
Line 24:		Line 24:
	=== Preresiquites ===		=== Preresiquites ===

	# This example suggest to use https://auth.example.com as the URL of authentik. Add the DNS records (A and AAAA) for <code>auth</code> to the DNS configuration of your domain. If you change the <code>domain></code> option, you can use any other subdomain.		# This example suggest to use https://auth.example.com as the URL of authentik. Add the DNS records (A and AAAA) for <code>auth</code> to the DNS configuration of your domain. If you change the <code>domain</code> option, you can use any other subdomain.
	# Create an agenix secret file named <code>authentik-secret-key.age</code> and add a secret key using <code>openssl rand -base64 60 \| tr -d '\n'</code><ref>[https://docs.goauthentik.io/install-config/install/docker-compose/#generate-postgresql-password-and-secret-key authentik's Docker Compose installation documentation]</ref>		# Create an agenix secret file named <code>authentik-secret-key.age</code> and add a secret key using <code>openssl rand -base64 60 \| tr -d '\n'</code><ref>[https://docs.goauthentik.io/install-config/install/docker-compose/#generate-postgresql-password-and-secret-key authentik's Docker Compose installation documentation]</ref>

Writer: Add security category

2026-07-19T11:31:00Z

Add security category

← Older revision		Revision as of 11:31, 19 July 2026
Line 168:		Line 168:
	[[Category:Applications]]		[[Category:Applications]]
	[[Category:Web Applications]]		[[Category:Web Applications]]
			<references />
			[[Category:Security]]

Writer: Created page with "[https://goauthentik.io/ authentik] is an identity provider supporting protocols such as OAuth 2.0, OpenID Connect, SAML, and LDAP. It provides a free open-source edition and a paid Enterprise edition with additional features and support. It is an alternative to Keycloak. There are currently three ways to use authentik on NixOS: # the official [https://docs.goauthentik.io/install-config/install/docker-compose/ docker-compose] # unofficial [https://github.com/nix-co..."

2026-07-19T11:29:35Z

Created page with "[https://goauthentik.io/ authentik] is an identity provider supporting protocols such as OAuth 2.0, OpenID Connect, SAML, and LDAP. It provides a free open-source edition and a paid Enterprise edition with additional features and support. It is an alternative to Keycloak. There are currently three ways to use authentik on NixOS: # the official [https://docs.goauthentik.io/install-config/install/docker-compose/ docker-compose] # unofficial [https://github.com/nix-co..."

New page

[https://goauthentik.io/ authentik] is an identity provider supporting protocols such as OAuth 2.0, OpenID Connect, SAML, and LDAP. It provides a free open-source edition and a paid Enterprise edition with additional features and support. It is an alternative to [[Keycloak]].

There are currently three ways to use authentik on NixOS:

# the official [https://docs.goauthentik.io/install-config/install/docker-compose/ docker-compose]
# unofficial [https://github.com/nix-community/authentik-nix flake]
# your own NixOS module

As of NixOS 26.05 there is no module in nixpkgs which would start the service with something like <code>services.authentik.enable = true;</code>. Therefore, if you don't want to use docker containers or flakes, writing your own modules is the only way to run authentik, currently.

== Your own NixOS module ==

Advantages of this option are not having to use flakes and having more integration and less indirection than with containers.

The example configuration below

# creates two systemd services: authentik server and authentik worker (this is analog to the to containers in the official docker-compose solution)
# reuses an existing PostgreSQL instance (the official docker-compose solution creates its own instance)
# uses [[Agenix]] for storing the authentik sercret key
# uses nginx as a reverse proxy
# does not store authentik's configuration such as users, groups, policies declaratively
# uses the unstable version of authentik. authentik version 2026 introduced several configuration option changes and therefore, for a new installation, it is advisable to use the unstable nixpkgs package which is already on 2026.x.y. This reduces future required configuration changes.

=== Preresiquites ===

# This example suggest to use https://auth.example.com as the URL of authentik. Add the DNS records (A and AAAA) for <code>auth</code> to the DNS configuration of your domain. If you change the <code>domain></code> option, you can use any other subdomain.
# Create an agenix secret file named <code>authentik-secret-key.age</code> and add a secret key using <code>openssl rand -base64 60 | tr -d '\n'</code><ref>[https://docs.goauthentik.io/install-config/install/docker-compose/#generate-postgresql-password-and-secret-key authentik's Docker Compose installation documentation]</ref>

=== Configuration ===

You can import the authentik module below to your main configuration using <code>imports</code>. For example:
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
...
imports = [
./hardware-configuration.nix
./authentik.nix
];
...
</nowiki>}}
{{File
|name=/etc/nixos/configuration.nix
|lang=nix
|3={ config, pkgs, lib, ... }:
let
unstable-pkgs = import <nixpkgs-unstable> { };

# TODO: Change this to your domain
domain = "auth.yourdomain.example";

authentikStateDirName = "authentik";
authentikStateDir = "/var/lib/${authentikStateDirName}";
authentikUser = "authentik";
authentikGroup = "authentik";
authentikPackage = unstable-pkgs.authentik;

serverHttpPort = 9000;
serverMetricsPort = 9300;
workerHttpPort = 9001;
workerMetricsPort = 9301;

# Configuration that is common to authentik's server and worker processes
commonEnvironment = {
authentik_POSTGRESQL__HOST = "/run/postgresql";
authentik_POSTGRESQL__NAME = "authentik";
authentik_POSTGRESQL__USER = "authentik";

authentik_LISTEN__TRUSTED_PROXY_CIDRS = "127.0.0.0/8,::1/128";

authentik_STORAGE__FILE__PATH = authentikStateDir;

authentik_SECRET_KEY = "file://${config.age.secrets.authentik-secret-key.path}";

authentik_LOG_LEVEL = "info";
};

serverEnvironment = commonEnvironment // {
authentik_LISTEN__HTTP = "127.0.0.1:${toString serverHttpPort}";
authentik_LISTEN__METRICS = "127.0.0.1:${toString serverMetricsPort}";
};

workerEnvironment = commonEnvironment // {
authentik_LISTEN__HTTP = "127.0.0.1:${toString workerHttpPort}";
authentik_LISTEN__METRICS = "127.0.0.1:${toString workerMetricsPort}";
};

# Function to generate the systemd configuration for each role (server or worker).
authentikSystemdService = role: environment: {
description = "authentik ${role}";
wantedBy = [ "multi-user.target" ];
after = [ "postgresql.service" ];
requires = [ "postgresql.service" ];

# `environment` is both the argument name of this function and the NixOS option name to set a
# systemd services environemnt. Thus, here we simply set the option's value to the argument's value.
inherit environment;

# postgresql.service may be started before the database is ready to accept connections. Therefore,
# check the latter explicitly.
preStart = ''
${config.services.postgresql.package}/bin/pg_isready -h /run/postgresql -d authentik -U authentik
'';

serviceConfig = {
Type = "simple";
User = authentikUser;
Group = authentikGroup;
WorkingDirectory = authentikStateDir;
StateDirectory = authentikStateDirName;
StateDirectoryMode = "0750";
ExecStart = "${authentikPackage}/bin/ak ${role}";
Restart = "on-failure";
RestartSec = "10s";
};
};
in
{
age.secrets.authentik-secret-key = {
# TODO: adjust this to your path
file = ../../secrets/authentik-secret-key.age;
owner = authentikUser;
group = authentikGroup;
mode = "0400";
};

users.groups.${authentikGroup} = { };

users.users.${authentikUser} = {
isSystemUser = true;
group = authentikGroup;
home = authentikStateDir;
};

services.postgresql = {
ensureDatabases = [ "authentik" ];
ensureUsers = [
{
name = "authentik";
ensureDBOwnership = true;
}
];
authentication = lib.mkAfter ''
local authentik authentik peer
'';
};

systemd.services = {
authentik-server = authentikSystemdService "server" serverEnvironment;
authentik-worker = authentikSystemdService "worker" workerEnvironment;
};

services.nginx.virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;

locations."/" = {
proxyPass = "http://127.0.0.1:${toString serverHttpPort}";
recommendedProxySettings = true;
proxyWebsockets = true;
};
};
}
}}

Search for all <code>TODO</code>s and set your system's values accordingly.

[[Category:Server]]
[[Category:Applications]]
[[Category:Web Applications]]