92 lines
2.7 KiB
Markdown
92 lines
2.7 KiB
Markdown
# Authentik — manual bootstrap
|
|
|
|
Run these steps once after the first `docker compose up -d` in the `deploy/` directory.
|
|
|
|
---
|
|
|
|
## 1. Set the admin password
|
|
|
|
Visit `https://auth.yourdomain.com/if/flow/initial-setup/` and set the **akadmin** password.
|
|
|
|
---
|
|
|
|
## 2. Create the OIDC provider
|
|
|
|
1. Log in to the Authentik Admin UI at `https://auth.yourdomain.com/if/admin/`.
|
|
2. Go to **Applications → Providers → Create**.
|
|
3. Choose **OAuth2/OpenID Provider**.
|
|
4. Configure:
|
|
- **Name:** `famapp`
|
|
- **Authorization flow:** `default-provider-authorization-explicit-consent`
|
|
- **Client type:** `Confidential`
|
|
- **Client ID:** (auto-generated — copy this)
|
|
- **Client Secret:** (auto-generated — copy this)
|
|
- **Redirect URIs:** `https://fam.yourdomain.com/api/auth/callback/authentik`
|
|
- **Signing Key:** `authentik Self-signed Certificate`
|
|
- **Token validity:** 24 hours (or your preference)
|
|
5. Save and note the **Issuer URL** shown on the provider detail page.
|
|
|
|
The issuer URL will look like:
|
|
|
|
```
|
|
https://auth.yourdomain.com/application/o/famapp/
|
|
```
|
|
|
|
Set this (and the client ID/secret) in famapp's `.env` / production secrets:
|
|
|
|
```env
|
|
AUTH_OIDC_ISSUER=https://auth.yourdomain.com/application/o/famapp/
|
|
AUTH_OIDC_CLIENT_ID=<client-id>
|
|
AUTH_OIDC_CLIENT_SECRET=<client-secret>
|
|
```
|
|
|
|
---
|
|
|
|
## 3. Create the Application
|
|
|
|
1. Go to **Applications → Applications → Create**.
|
|
2. Configure:
|
|
- **Name:** `famapp`
|
|
- **Slug:** `famapp`
|
|
- **Provider:** select the `famapp` provider created above
|
|
- **Launch URL:** `https://fam.yourdomain.com`
|
|
3. Save.
|
|
|
|
---
|
|
|
|
## 4. Create user accounts
|
|
|
|
1. Go to **Directory → Users → Create**.
|
|
2. Create accounts for Matt and wife. Recommended fields:
|
|
- **Username / Email:** use real email addresses (famapp uses email as the identity key)
|
|
- **Name:** display name shown in the app
|
|
3. Optionally invite them via email to set their own passwords.
|
|
|
|
---
|
|
|
|
## 5. Set up passkeys (optional but recommended)
|
|
|
|
Each user can enroll a passkey from their Authentik profile:
|
|
|
|
1. Sign in as the user at `https://auth.yourdomain.com`.
|
|
2. Go to **Settings → MFA Devices → Add → WebAuthn Device**.
|
|
3. Follow the browser prompt to register a Touch ID / Face ID / hardware key.
|
|
|
|
---
|
|
|
|
## 6. Generate AUTH_SECRET
|
|
|
|
Run this locally and put the output in your `.env` / production secrets:
|
|
|
|
```sh
|
|
openssl rand -base64 32
|
|
```
|
|
|
|
---
|
|
|
|
## Notes
|
|
|
|
- The Authentik image in `compose.yaml` is currently pinned to `latest`. Before production, pin to a specific version tag (e.g. `ghcr.io/goauthentik/server:2024.12.3`).
|
|
- famapp uses **database sessions** (Auth.js). Sessions are stored in the `sessions` table and expire according to Auth.js defaults (30 days).
|
|
- The forward-auth / Outpost wiring for other services (Sonarr, Radarr, etc.) is a separate future task.
|