# Verified compose for authentik, tested 2026-10-20 by the SelfHostBench lab (3 runs; the figures are the median).
# Lab host: AMD EPYC 7763 64-Core Processor, 2 vCPU, 7.8 GiB RAM, x86_64, Docker 28.0.4.
# Floating image tags below were replaced by the version resolved at test time;
# the registry digest is in the comment on each image line.
# Measurements: authentik.json (schema 3).
# Companion env file: authentik.env (save it as .env next to this file).
# Secrets are not published: the lab's values are public. In authentik.env:
#   PG_PASS is commented out. Uncomment it and set your own value (the comment above it explains how).
#   AUTHENTIK_SECRET_KEY is commented out. Uncomment it and set your own value (the comment above it explains how).
#   AUTHENTIK_BOOTSTRAP_PASSWORD is commented out. Uncomment it and set your own value (the comment above it explains how).
#   AUTHENTIK_BOOTSTRAP_TOKEN is commented out. Uncomment it and set your own value (the comment above it explains how).

# authentik 2026.8.4 (identity provider and SSO): PostgreSQL, the server and the worker. No Redis.
# This is the official compose file for 2026.8 (https://docs.goauthentik.io/compose.yml, which pins 2026.8.4 as the default of
# AUTHENTIK_TAG; install guide https://docs.goauthentik.io/install-config/install/docker-compose/), with these differences, all marked below:
#   - PostgreSQL is pinned to 16.15-alpine (the official file says 16-alpine, which today is the same image);
#   - ./data, ./certs and ./custom-templates are named volumes here (the official file bind-mounts folders next to the compose file);
#   - the .env file has first-start values for the admin account (AUTHENTIK_BOOTSTRAP_*), so the first start needs no browser.
# Redis: authentik "no longer uses Redis at all" since 2025.10 (https://docs.goauthentik.io/releases/2025.10/), so there is no redis service.
# There is no TLS and no reverse proxy in this file. Put one in front before you expose it.
name: authentik

services:
  postgresql:
    env_file:
      - .env
    environment:
      POSTGRES_DB: ${PG_DB:-authentik}
      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
      POSTGRES_USER: ${PG_USER:-authentik}
    healthcheck:
      interval: 30s
      retries: 5
      start_period: 20s
      test:
        - CMD-SHELL
        - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
      timeout: 5s
    # Official file: postgres:16-alpine (a floating tag). 16.15-alpine is the same image today (same digest), pinned so a re-test uses the same PostgreSQL.
    image: docker.io/library/postgres:16.15-alpine  # sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea  (version 16.15, from exec)
    restart: unless-stopped
    volumes:
      - database:/var/lib/postgresql/data

  server:
    command: server
    depends_on:
      postgresql:
        condition: service_healthy
    env_file:
      - .env
    environment:
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
    image: ghcr.io/goauthentik/server:2026.8.4  # sha256:e7226ae116dac5aa0a5643803e735b010038f492c401e08e16b3bf1ac54c090c  (version 2026.8.4, from exec)
    ports:
      - ${COMPOSE_PORT_HTTP:-9000}:9000
      - ${COMPOSE_PORT_HTTPS:-9443}:9443
    restart: unless-stopped
    shm_size: 512mb
    volumes:
      # Official file: ./data:/data and ./custom-templates:/templates (folders next to the compose file).
      - data:/data
      - custom-templates:/templates

  worker:
    command: worker
    depends_on:
      postgresql:
        condition: service_healthy
    env_file:
      - .env
    environment:
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
    image: ghcr.io/goauthentik/server:2026.8.4  # sha256:e7226ae116dac5aa0a5643803e735b010038f492c401e08e16b3bf1ac54c090c  (version 2026.8.4, from exec)
    restart: unless-stopped
    shm_size: 512mb
    user: root
    volumes:
      # Lets the worker manage Docker outposts. The install guide says to remove this mount (or put a Docker socket proxy
      # in front of it) if you do not want authentik to control Docker.
      - /var/run/docker.sock:/var/run/docker.sock
      # Official file: ./data, ./certs and ./custom-templates.
      - data:/data
      - certs:/certs
      - custom-templates:/templates

volumes:
  database:
    driver: local
  data:
  certs:
  custom-templates: