Add section summary pages and make single-link admonitions clickable

content/en/3.serveex/91.advanced/1.authentik.md

@@ -6,6 +6,11 @@ description: Install Authentik as a self-hosted identity provider, configure MFA
 
 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
 
+::note
+
+This is an advanced alternative to [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id): a single application handling both the forward-auth proxy and the OIDC provider roles, with built-in LDAP, SAML, and RBAC-style access policies (restricting who can reach which app, not just whether they're logged in) on top of its own admin UI for users, groups, and outposts. TinyAuth and Pocket ID stay lighter and simpler for a small homelab; Authentik is worth the extra setup once you need finer-grained access control or broader protocol support than OIDC alone.
+::
+
 [Authentik](https://goauthentik.io) is a single sign-on (SSO) tool that allows you to log in once to all platforms compatible with OpenID. It can also secure access to your exposed services by injecting itself via SWAG into requests to those services.
 
 For example, if you're exposing Dockge online at `dockge.mydomain.com`, you’ll first land on an Authentik login page when accessing it. If you've already authenticated with another Authentik-protected service, you won’t need to log in again. This allows you to authenticate only once per day for all protected services.
@@ -14,8 +19,6 @@ Authentik also supports multi-factor authentication, including TOTP (a code gene
 
 It's a great alternative to VPNs for securely exposing services, especially ones that lack MFA or login protection (e.g., the SWAG dashboard).
 
-Compared to the [TinyAuth](/serveex/security/tinyauth) + [Pocket ID](/serveex/security/pocket-id) combo used elsewhere on this site, Authentik is a heavier, more professional-grade platform: a single application handling both the forward-auth proxy and the OIDC provider roles, with built-in support for LDAP, SAML, and RBAC-style access policies (restricting who can reach which app, not just whether they're logged in), on top of its own admin UI for managing users, groups, and outposts. TinyAuth and Pocket ID stay lighter and simpler for a small homelab; Authentik is worth the extra setup once you need finer-grained access control or a broader protocol support than OIDC alone.
-
 Authentik has [extensive documentation](https://docs.goauthentik.io/docs/installation/docker-compose) and [great tutorials from Cooptonian](https://www.youtube.com/@cooptonian). Here, we’ll cover the basics using Dockge as an example.
 
 There are two main modes you should know:
@@ -207,9 +210,9 @@ We assume you have already created a subdomain like `auth.mydomain.com` in your
 
 Open the `authentik-server.conf` file:
 
-::tip{icon=""}
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
 ✨ __Tip for those who dislike terminals:__
-You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands.
+You can use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
 ::
 
 ```bash [Terminal]
@@ -440,9 +443,9 @@ If you haven’t installed [Dockge](/serveex/core/docker/#installer-dockge-pour-
 sudo mkdir -P /docker/authentik-outpost
 ```
 
-::tip{icon=""}
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
 ✨ __Tip for terminal-averse users:__
-You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands.
+You can use **File Browser Quantum** to navigate and edit your files instead of using terminal commands.
 ::
 
 ### Create the compose file
@@ -584,22 +587,28 @@ Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{val
 Then configure the applications to protect as you did on your main server, whether they are [native](/serveex/advanced/authentik/#protecting-a-native-app) or protected via [reverse proxy](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
 
 ## Migrating an Authentik Database
+
+::note
+
+The commands below assume the Postgres container is named `authentik-postgresql`, matching the [Installation](#installation) section above. Adjust it if you renamed yours.
+::
+
 On the source machine, dump the database:
 
 ```bash [Terminal]
-sudo docker exec authentik-postgres pg_dump -U authentik -F t authentik > /path/to/mydb.tar
+sudo docker exec authentik-postgresql pg_dump -U authentik -F t authentik > /path/to/mydb.tar
 ```
 
 Then transfer it to the target machine. On the target machine, copy the file into the Docker container:
 
 ```bash [Terminal]
-cp /path/to/mydb.tar authentik-postgres:/path/to/wherever
+cp /path/to/mydb.tar authentik-postgresql:/path/to/wherever
 ```
 
 (Optional) Purge existing tables:
 
 ```bash [Terminal]
-sudo docker exec -i authentik-postgres psql -U authentik -c "SELECT pg_terminate_backend(pg_stat_activity.pid) FROM pg_stat_activity WHERE pg_stat_activity.datname = 'authentik' AND pid <> pg_backend_pid();" && sudo docker exec -i authentik-postgres psql -U authentik -d postgres -c "DROP DATABASE IF EXISTS authentik;" && sudo docker exec -i authentik-postgres psql -U authentik -d postgres -c "CREATE DATABASE authentik;"
+sudo docker exec -i authentik-postgresql psql -U authentik -c "SELECT pg_terminate_backend(pg_stat_activity.pid) FROM pg_stat_activity WHERE pg_stat_activity.datname = 'authentik' AND pid <> pg_backend_pid();" && sudo docker exec -i authentik-postgresql psql -U authentik -d postgres -c "DROP DATABASE IF EXISTS authentik;" && sudo docker exec -i authentik-postgresql psql -U authentik -d postgres -c "CREATE DATABASE authentik;"
 ```
 
 Restore the database: