2026-10-30 19:24:01 +01:00
{
"schema_version" : "0.5.0" ,
"kind" : "proxmenux.oci-template" ,
"id" : "image-authentik" ,
"status" : "generated-unvalidated" ,
"catalog_ui" : {
"title" : {
"en_US" : "Authentik"
},
"tagline" : {
"en_US" : "Identity provider for single sign-on and access control"
},
"description" : {
"en_US" : "Authentik is an open-source identity provider and access platform. This recipe follows the official three-service deployment with PostgreSQL, the server and a worker, each in its own Proxmox OCI LXC."
},
"category" : "security" ,
"category_label" : "Authentication & Security" ,
"author" : "Authentik" ,
"developer" : "Authentik" ,
"icon" : "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/authentik.webp" ,
"thumbnail" : null ,
"screenshots" : [],
"architectures" : [
"amd64" ,
"arm64"
],
"launch" : {
"scheme" : "http" ,
"port" : 9000 ,
"path" : "/"
},
"website" : "https://goauthentik.io/" ,
"documentation" : "https://docs.goauthentik.io/install-config/install/docker-compose/" ,
"repository" : "https://github.com/goauthentik/authentik" ,
"tips" : [
"The server and worker share /data and /templates through host directories; those directories are not included in Proxmox CT backups." ,
2026-10-31 09:00:46 +01:00
"The worker Docker-socket mount is omitted. Use the embedded outpost or deploy and manage a separate outpost manually." ,
"The worker gets an interface on the selected Proxmox bridge for outbound access; PostgreSQL stays on the private stack network."
2026-10-30 19:24:01 +01:00
],
"mini_changelog" : [],
"display_version" : "2026.8.5" ,
"updated_at" : "2026-10-21"
},
"source" : {
"provider" : "goauthentik" ,
"repository" : "https://github.com/goauthentik/authentik" ,
"default_branch" : "main" ,
"revision" : "4ec0d19b98da3c329781894cd550da95d3033954" ,
"readme_raw_url" : "https://goauthentik.io/version/2026.8/lifecycle/container/compose.yml" ,
"image_repository_url" : "https://github.com/goauthentik/authentik/pkgs/container/server" ,
"readme_pushed_at" : "2026-10-21T12:57:59Z" ,
"compose_sha256" : "a3e138b5a85844d15c4a7ba6339997e43c0479d9d198582c67dd19523aadc694" ,
"generated_at" : "2026-10-30T18:09:01+00:00"
},
"container_contract" : {
"service_name" : "server" ,
"container_name" : "authentik-server" ,
"image" : {
"reference" : "ghcr.io/goauthentik/server:2026.8.5" ,
"registry" : "ghcr.io" ,
"repository" : "ghcr.io/goauthentik/server" ,
"tag" : "2026.8.5" ,
"digest" : null ,
"pull_policy" : "resolve-written-reference-to-architecture-digest-at-install"
},
"environment" : [
{
"name" : "AUTHENTIK_POSTGRESQL__HOST" ,
"example" : "postgresql" ,
"required" : true ,
"sensitive" : false ,
"source" : "docker-compose"
},
{
"name" : "AUTHENTIK_POSTGRESQL__NAME" ,
"example" : "authentik" ,
"required" : true ,
"sensitive" : false ,
"source" : "docker-compose"
},
{
"name" : "AUTHENTIK_POSTGRESQL__PASSWORD" ,
"example" : "${GENERATED_GENERATED_PG_PASS}" ,
"required" : true ,
"sensitive" : true ,
"source" : "docker-compose"
},
{
"name" : "AUTHENTIK_POSTGRESQL__USER" ,
"example" : "authentik" ,
"required" : true ,
"sensitive" : false ,
"source" : "docker-compose"
},
{
"name" : "AUTHENTIK_SECRET_KEY" ,
"example" : "${GENERATED_GENERATED_AUTHENTIK_SECRET_KEY}" ,
"required" : true ,
"sensitive" : true ,
"source" : "docker-compose"
}
],
"volumes" : [
{
"id" : "volume-0" ,
"container_path" : "/data" ,
"compose_source_example" : "./data" ,
"read_only" : false ,
"required" : true ,
"installation_choice" : [
"host-bind"
],
"default" : "host-bind" ,
"managed_volume" : {
"backup" : false ,
"default_size_gb" : 8
}
},
{
"id" : "volume-1" ,
"container_path" : "/templates" ,
"compose_source_example" : "./custom-templates" ,
"read_only" : false ,
"required" : true ,
"installation_choice" : [
"host-bind"
],
"default" : "host-bind" ,
"managed_volume" : {
"backup" : false ,
"default_size_gb" : 8
}
}
],
"ports" : [
{
"container_port" : 9000 ,
"published_example" : 9000 ,
"protocol" : "tcp" ,
"required" : true ,
"proxmox_behavior" : "listener-on-dedicated-lxc-address-no-nat"
},
{
"container_port" : 9443 ,
"published_example" : 9443 ,
"protocol" : "tcp" ,
"required" : true ,
"proxmox_behavior" : "listener-on-dedicated-lxc-address-no-nat"
}
],
"related_services" : [
{
"name" : "postgresql" ,
"image" : "docker.io/library/postgres:16-alpine"
},
{
"name" : "worker" ,
"image" : "ghcr.io/goauthentik/server:2026.8.5"
}
],
"restart" : "unless-stopped" ,
"stop_grace_period" : null ,
"original_compose" : "name: authentik\nservices:\n postgresql:\n environment:\n POSTGRES_DB: authentik\n POSTGRES_PASSWORD: ${GENERATED_PG_PASS}\n POSTGRES_USER: authentik\n healthcheck:\n interval: 30s\n retries: 5\n start_period: 20s\n test:\n - CMD-SHELL\n - pg_isready -h 127.0.0.1 -d authentik -U authentik\n timeout: 5s\n image: docker.io/library/postgres:16-alpine\n restart: unless-stopped\n volumes:\n - read_only: false\n source: database\n target: /var/lib/postgresql/data\n server:\n command: server\n depends_on:\n postgresql:\n condition: service_healthy\n environment:\n AUTHENTIK_POSTGRESQL__HOST: postgresql\n AUTHENTIK_POSTGRESQL__NAME: authentik\n AUTHENTIK_POSTGRESQL__PASSWORD: ${GENERATED_PG_PASS}\n AUTHENTIK_POSTGRESQL__USER: authentik\n AUTHENTIK_SECRET_KEY: ${GENERATED_AUTHENTIK_SECRET_KEY}\n image: ghcr.io/goauthentik/server:2026.8.5\n ports:\n - 9000:9000\n - 9443:9443\n restart: unless-stopped\n shm_size: 512mb\n volumes:\n - read_only: false\n source: ./data\n target: /data\n - read_only: false\n source: ./custom-templates\n target: /templates\n worker:\n command: worker\n depends_on:\n postgresql:\n condition: service_healthy\n environment:\n AUTHENTIK_POSTGRESQL__HOST: postgresql\n AUTHENTIK_POSTGRESQL__NAME: authentik\n AUTHENTIK_POSTGRESQL__PASSWORD: ${GENERATED_PG_PASS}\n AUTHENTIK_POSTGRESQL__USER: authentik\n AUTHENTIK_SECRET_KEY: ${GENERATED_AUTHENTIK_SECRET_KEY}\n image: ghcr.io/goauthentik/server:2026.8.5\n restart: unless-stopped\n shm_size: 512mb\n user: root\n volumes:\n - read_only: false\n source: ./data\n target: /data\n - read_only: false\n source: ./certs\n target: /certs\n - read_only: false\n source: ./custom-templates\n target: /templates\nvolumes:\n database: {}\n"
},
"compose_stack" : {
"project_name" : "authentik" ,
"deployment_model" : "one-native-oci-lxc-per-compose-service" ,
"user_experience" : "single-application-install" ,
"main_service" : "server" ,
"service_count" : 3 ,
"services" : [
{
"name" : "postgresql" ,
"image" : "docker.io/library/postgres:16-alpine" ,
"is_main" : false ,
"role" : "dependency" ,
"vmid_offset" : 1 ,
"depends_on" : [],
"frontend_network" : false ,
"private_network" : true ,
"compose" : {
"environment" : {
"POSTGRES_DB" : "authentik" ,
"POSTGRES_PASSWORD" : "${GENERATED_PG_PASS}" ,
"POSTGRES_USER" : "authentik"
},
"healthcheck" : {
"interval" : "30s" ,
"retries" : 5 ,
"start_period" : "20s" ,
"test" : [
"CMD-SHELL" ,
"pg_isready -h 127.0.0.1 -d authentik -U authentik"
],
"timeout" : "5s"
},
"image" : "docker.io/library/postgres:16-alpine" ,
"restart" : "unless-stopped" ,
"volumes" : [
{
"source" : "database" ,
"target" : "/var/lib/postgresql/data" ,
"read_only" : false
}
]
}
},
{
"name" : "worker" ,
"image" : "ghcr.io/goauthentik/server:2026.8.5" ,
"is_main" : false ,
"role" : "dependency" ,
"vmid_offset" : 2 ,
"depends_on" : [
"postgresql"
],
2026-10-31 09:00:46 +01:00
"frontend_network" : true ,
2026-10-30 19:24:01 +01:00
"private_network" : true ,
"compose" : {
"command" : "worker" ,
"depends_on" : {
"postgresql" : {
"condition" : "service_healthy"
}
},
"environment" : {
"AUTHENTIK_POSTGRESQL__HOST" : "postgresql" ,
"AUTHENTIK_POSTGRESQL__NAME" : "authentik" ,
"AUTHENTIK_POSTGRESQL__PASSWORD" : "${GENERATED_PG_PASS}" ,
"AUTHENTIK_POSTGRESQL__USER" : "authentik" ,
"AUTHENTIK_SECRET_KEY" : "${GENERATED_AUTHENTIK_SECRET_KEY}"
},
"image" : "ghcr.io/goauthentik/server:2026.8.5" ,
"restart" : "unless-stopped" ,
"shm_size" : "512mb" ,
"user" : "root" ,
"volumes" : [
{
"source" : "./data" ,
"target" : "/data" ,
"read_only" : false
},
{
"source" : "./certs" ,
"target" : "/certs" ,
"read_only" : false
},
{
"source" : "./custom-templates" ,
"target" : "/templates" ,
"read_only" : false
}
]
}
},
{
"name" : "server" ,
"image" : "ghcr.io/goauthentik/server:2026.8.5" ,
"is_main" : true ,
"role" : "frontend" ,
"vmid_offset" : 0 ,
"depends_on" : [
"postgresql"
],
"frontend_network" : true ,
"private_network" : true ,
"compose" : {
"command" : "server" ,
"depends_on" : {
"postgresql" : {
"condition" : "service_healthy"
}
},
"environment" : {
"AUTHENTIK_POSTGRESQL__HOST" : "postgresql" ,
"AUTHENTIK_POSTGRESQL__NAME" : "authentik" ,
"AUTHENTIK_POSTGRESQL__PASSWORD" : "${GENERATED_PG_PASS}" ,
"AUTHENTIK_POSTGRESQL__USER" : "authentik" ,
"AUTHENTIK_SECRET_KEY" : "${GENERATED_AUTHENTIK_SECRET_KEY}"
},
"image" : "ghcr.io/goauthentik/server:2026.8.5" ,
"ports" : [
"9000:9000" ,
"9443:9443"
],
"restart" : "unless-stopped" ,
"shm_size" : "512mb" ,
"volumes" : [
{
"source" : "./data" ,
"target" : "/data" ,
"read_only" : false
},
{
"source" : "./custom-templates" ,
"target" : "/templates" ,
"read_only" : false
}
]
}
}
],
"top_level" : {
"name" : "authentik" ,
"volumes" : {
"database" : {}
}
},
"networking" : {
"frontend" : "selected-proxmox-bridge" ,
"private_required" : true ,
"private_creation" : "automatic-create-if-missing" ,
"private_address_allocation" : "automatic-static-address-per-service" ,
"service_discovery" : "private-addresses-with-compose-service-host-aliases" ,
2026-10-31 09:00:46 +01:00
"dependency_external_access" : "worker-through-selected-proxmox-bridge; postgresql-private-only" ,
2026-10-30 19:24:01 +01:00
"prompt_user_for_private_network" : false
},
"storage" : [
{
"id" : "postgresql-volume-0" ,
"service" : "postgresql" ,
"container_path" : "/var/lib/postgresql/data" ,
"mode" : "managed-volume" ,
"user_selectable" : false ,
"backup" : true ,
"shared_with_other_lxc" : false ,
"source_path" : null ,
"source_path_prompt" : null
},
{
"id" : "server-volume-0" ,
"service" : "server" ,
"container_path" : "/data" ,
"mode" : "host-bind" ,
"user_selectable" : true ,
"backup" : false ,
"shared_with_other_lxc" : true ,
"source_path" : null ,
"source_path_prompt" : "Host directory for authentik:/data"
},
{
"id" : "server-volume-1" ,
"service" : "server" ,
"container_path" : "/templates" ,
"mode" : "host-bind" ,
"user_selectable" : true ,
"backup" : false ,
"shared_with_other_lxc" : true ,
"source_path" : null ,
"source_path_prompt" : "Host directory for authentik:/templates"
},
{
"id" : "worker-volume-0" ,
"service" : "worker" ,
"container_path" : "/data" ,
"mode" : "host-bind" ,
"user_selectable" : true ,
"backup" : false ,
"shared_with_other_lxc" : true ,
"source_path" : null ,
"source_path_prompt" : "Host directory for authentik:/data"
},
{
"id" : "worker-volume-1" ,
"service" : "worker" ,
"container_path" : "/certs" ,
"mode" : "managed-volume" ,
"user_selectable" : false ,
"backup" : true ,
"shared_with_other_lxc" : false ,
"source_path" : null ,
"source_path_prompt" : null
},
{
"id" : "worker-volume-2" ,
"service" : "worker" ,
"container_path" : "/templates" ,
"mode" : "host-bind" ,
"user_selectable" : true ,
"backup" : false ,
"shared_with_other_lxc" : true ,
"source_path" : null ,
"source_path_prompt" : "Host directory for authentik:/templates"
}
],
"orchestration" : {
"reserve_vmids_atomically" : 3 ,
"start_order" : [
"postgresql" ,
"worker" ,
"server"
],
"stop_order" : [
"server" ,
"worker" ,
"postgresql"
],
"dependency_readiness" : "compose-healthcheck-then-port-or-process-fallback" ,
"rollback_on_failure" : "remove-new-rootfs-preserve-created-persistent-volumes"
},
"installer_inputs" : {
"prompted" : [
"stack_name" ,
"base_vmid" ,
"rootfs_storage" ,
"persistent_data_destinations" ,
"frontend_bridge" ,
"frontend_ipv4_mode"
],
"automatic" : [
"dependent_vmids" ,
"private_bridge" ,
"private_subnet" ,
"private_service_addresses" ,
"compose_service_aliases" ,
"generated_secrets" ,
"dependency_start_and_stop_order"
],
"generated_secrets" : [
{
"id" : "pg-pass" ,
"strategy" : "generate-cryptographically-random-at-install" ,
"bindings" : [
{
"service" : "postgresql" ,
"environment_variable" : "POSTGRES_PASSWORD"
},
{
"service" : "server" ,
"environment_variable" : "AUTHENTIK_POSTGRESQL__PASSWORD"
},
{
"service" : "worker" ,
"environment_variable" : "AUTHENTIK_POSTGRESQL__PASSWORD"
}
]
},
{
"id" : "authentik-secret-key" ,
"strategy" : "generate-cryptographically-random-at-install" ,
"bindings" : [
{
"service" : "server" ,
"environment_variable" : "AUTHENTIK_SECRET_KEY"
},
{
"service" : "worker" ,
"environment_variable" : "AUTHENTIK_SECRET_KEY"
}
]
}
]
}
},
"first_run" : {
"endpoints" : [
{
"label" : "Web interface" ,
"scheme" : "http" ,
"port" : 9000 ,
"path" : "/" ,
"source" : "official-compose"
}
],
2026-10-31 09:45:27 +01:00
"credentials" : []
2026-10-30 19:24:01 +01:00
},
"proxmox" : {
"runtime" : "native-oci-lxc" ,
"technology_status" : "proxmox-technology-preview" ,
"defaults" : {
"unprivileged" : true ,
"ostype" : "auto-from-image" ,
"cores" : 2 ,
"memory_mb" : 1024 ,
"swap_mb" : 512 ,
"rootfs_size_gb" : 8 ,
"rootfs_storage" : "local-lvm" ,
"volume_storage" : "local-lvm" ,
"template_storage" : "local" ,
"bridge" : "vmbr0" ,
"ipv4" : "dhcp" ,
"firewall" : true ,
"host_managed_network" : true ,
"onboot" : true ,
"features" : [
"nesting=1"
],
"shutdown_timeout_seconds" : 30
},
"image_metadata_policy" : {
"entrypoint" : "import-from-oci-image" ,
"cmd" : "import-from-oci-image" ,
"environment" : "import-image-env-then-apply-compose-overrides" ,
"user" : "import-from-oci-image" ,
"working_dir" : "import-from-oci-image" ,
"stop_signal" : "import-from-oci-image"
},
"installer_profile" : {
"stack_driver" : "generic-multi-lxc-stack" ,
"volume_preparations" : [
{
"container_path" : "/data" ,
"remove_lost_found" : true ,
"owner_strategy" : "mapped-application-user" ,
"only_when_mount_type" : "managed-volume"
},
{
"container_path" : "/templates" ,
"remove_lost_found" : true ,
"owner_strategy" : "mapped-application-user" ,
"only_when_mount_type" : "managed-volume"
},
{
"container_path" : "/certs" ,
"remove_lost_found" : true ,
"owner_strategy" : "mapped-application-user" ,
"only_when_mount_type" : "managed-volume"
},
{
"container_path" : "/var/lib/postgresql/data" ,
"remove_lost_found" : true ,
"owner_strategy" : "mapped-application-user" ,
"only_when_mount_type" : "managed-volume"
}
]
},
"adaptations" : [
{
"id" : "worker-docker-socket-removed" ,
"upstream_behavior" : "The official Compose mounts the Docker socket into the worker for automatic deployment and management of separate outposts." ,
"native_lxc_behavior" : "The Docker socket mount is omitted. Authentik itself runs as server, PostgreSQL and worker in native OCI LXCs." ,
"reason" : "The ProxMenux native OCI stack does not run Docker Engine or provide a Docker daemon socket." ,
"behavioral_impact" : "Use the embedded outpost for a simple proxy-provider deployment, or deploy and manage an outpost separately." ,
"validation" : "passed-ms03-2026-10-30"
},
{
"id" : "postgres-healthcheck-normalized" ,
"upstream_behavior" : "The official PostgreSQL healthcheck expands Compose environment variables in its command." ,
"native_lxc_behavior" : "The check uses the recipe’ ,
"reason" : "The native stack healthcheck runs in the database LXC and does not evaluate Compose variable interpolation." ,
"behavioral_impact" : "It checks the same local database readiness before dependent services start." ,
"validation" : "passed-ms03-postgresql-readiness-2026-10-30"
},
{
"id" : "server-worker-shared-data" ,
"upstream_behavior" : "Authentik server and worker both mount /data and /templates from the same Compose source directories." ,
"native_lxc_behavior" : "ProxMenux uses shared host directories for these two paths across the server and worker LXCs." ,
"reason" : "The same data and custom templates must be visible to both services; the stack driver shares named Compose sources through host paths." ,
"behavioral_impact" : "These shared host directories are not included in native LXC backups and need a separate backup." ,
"validation" : "passed-ms03-2026-10-30"
}
],
"custom_compose_stack" : true ,
"custom_compose_interpolated" : false ,
2026-10-31 09:45:27 +01:00
"stack_image_entrypoints" : {},
"stack_completion_notes" : [
"Open the web address and create the password of the akadmin user in the first-run setup."
]
2026-10-30 19:24:01 +01:00
},
"compatibility" : {
"automatic_install_candidate" : true ,
"validated" : false ,
"supported_compose_keys" : [
"cap_add" ,
"command" ,
"container_name" ,
"cpu_shares" ,
"deploy" ,
"devices" ,
"entrypoint" ,
"environment" ,
"extra_hosts" ,
"group_add" ,
"healthcheck" ,
"hostname" ,
"image" ,
"init" ,
"ipc" ,
"labels" ,
"logging" ,
"mac_address" ,
"mem_limit" ,
"network_mode" ,
"networks" ,
"ports" ,
"privileged" ,
"restart" ,
"runtime" ,
"security_opt" ,
"shm_size" ,
"stdin_open" ,
"stop_grace_period" ,
"stop_signal" ,
"sysctls" ,
"tty" ,
"ulimits" ,
"user" ,
"volumes" ,
"working_dir"
],
"untranslated_blockers" : [],
"policy" : "Official Authentik Compose translated to three native OCI LXCs. The Docker socket mount is deliberately removed; the embedded outpost remains available."
},
"validation" : {
"schema" : "passed-local-2026-10-30" ,
"image_pull" : "passed-ms03-skopeo-and-OCI-integrity-server-worker-postgresql-2026-10-30" ,
"default_install" : "passed-ms03-three-LXCs-started-PostgreSQL-healthy-2026-10-30" ,
"advanced_install" : "pending" ,
"credentials" : "pending-user-first-run-and-login" ,
"web_ui" : "pending-user-first-run-and-login" ,
"storage_modes" : "pending" ,
"restart_persistence" : "pending" ,
"backup_restore" : "pending" ,
"update_preserves_data" : "pending" ,
"rollback" : "pending" ,
"modification" : "pending" ,
"removal" : "pending" ,
"oci_engine_tests" : "pending" ,
"offline_i18n_tests" : "pending" ,
"runtime_architecture" : "amd64-ms03; Skopeo manifests include amd64-and-arm64" ,
"database_health" : "passed-pg_isready-2026-10-30"
},
"lifecycle" : {
"update_strategy" : "resolve-selected-tag-and-architecture-digest-then-apply-reviewed-native-lxc-update" ,
"registry_state" : {
"resolved_architecture" : null ,
"resolved_digest" : null ,
"image_version_label" : "2026.8.5" ,
"image_created" : null
},
"change_detection" : "compare-compose-sha256-and-resolved-image-digest" ,
"automatic_unattended_updates" : false ,
"dependency_lifecycle" : {
"implementation" : "proxmox-hookscript" ,
"trigger" : "main-lxc-pre-start" ,
"waits_for_dependency_healthchecks" : true ,
"stops_dependencies_with_main" : false
}
}
}
