Convert step-by-step sections to the steps component
This commit is contained in:
Djeex
@@ -5,15 +5,6 @@ description: Install Authentik as a self-hosted identity provider, configure MFA
|
||||
|
||||
|
||||
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
|
||||
# Authentik
|
||||
|
||||
::note
|
||||
🎯 __Objectives:__
|
||||
|
||||
- Install and expose Authentik
|
||||
- Configure Multi-Factor Authentication (MFA)
|
||||
- Protect a native app or an app behind a reverse proxy
|
||||
::
|
||||
|
||||
[Authentik](https://goauthentik.io) is a single sign-on (SSO) tool that allows you to log in once to all platforms compatible with OpenID. It can also secure access to your exposed services by injecting itself via SWAG into requests to those services.
|
||||
|
||||
@@ -51,12 +42,15 @@ root
|
||||
└── ssh
|
||||
```
|
||||
|
||||
Create the folders:
|
||||
::steps{level="3"}
|
||||
### Create the folders
|
||||
|
||||
```bash [Terminal]
|
||||
sudo mkdir -p /docker/authentik/media /docker/authentik/certs /docker/authentik/custom-template /docker/authentik/ssh
|
||||
```
|
||||
|
||||
### Generate secrets
|
||||
|
||||
Navigate to the `authentik` folder via `cd /docker/authentik` and generate a password and secret key to include in the `.env` file:
|
||||
|
||||
```bash [Terminal]
|
||||
@@ -72,6 +66,8 @@ To generate the keys, we created the folders ahead of deployment using Dockge. D
|
||||
```
|
||||
::
|
||||
|
||||
### Deploy the stack
|
||||
|
||||
Open Dockge and search for "authentik" in the inactive stacks.
|
||||
Name the stack `authentik` and paste the following configuration, replacing `{AUTHENTIK_TAG:-2026.2}`{lang=properties} with [the latest version of Authentik](https://goauthentik.io/docs/releases).
|
||||
|
||||
@@ -189,6 +185,8 @@ volumes:
|
||||
driver: local
|
||||
```
|
||||
|
||||
### Begin the initial setup
|
||||
|
||||
In the `.env` file, the `PG_PASS` and `AUTHENTIK_SECRET_KEY` variables are already set.
|
||||
Deploy the stack.
|
||||
|
||||
@@ -200,6 +198,9 @@ You can then begin the initial setup by visiting:
|
||||
__Warning:__ It’s recommended to create a new admin account and **disable** the default `akadmin` account.
|
||||
::
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
## Exposing Authentik
|
||||
To use Authentik outside your local network, you must expose it.
|
||||
|
||||
@@ -208,6 +209,9 @@ To use Authentik outside your local network, you must expose it.
|
||||
We assume you have already created a subdomain like `auth.mydomain.com` in your [DNS zone](/general/networking/dns), with a CNAME pointing to `mydomain.com`. Also, unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare), you must have already forwarded port `443` from your router to port `443` of your server in your [NAT rules](/general/networking/nat).
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Verify authentik-server.conf
|
||||
|
||||
Open the `authentik-server.conf` file:
|
||||
|
||||
::tip{icon=""}
|
||||
@@ -228,6 +232,8 @@ proxy_pass http://$upstream_authentik:9000;
|
||||
|
||||
If not, make the necessary changes, then save with :kbd{value="Ctrl+O"}, :kbd{value="Enter"}, and exit with :kbd{value="Ctrl+X"}.
|
||||
|
||||
### Create the subdomain.conf file
|
||||
|
||||
Create the `auth.subdomain.conf` file:
|
||||
|
||||
```bash [Terminal]
|
||||
@@ -273,6 +279,8 @@ server {
|
||||
|
||||
Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{value="Ctrl+X"}.
|
||||
|
||||
### Add Authentik's network to SWAG
|
||||
|
||||
Go to Dockge, and edit the SWAG compose file to add the Authentik network:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
@@ -294,18 +302,25 @@ networks: # Define the custom network
|
||||
|
||||
Restart the stack and wait for SWAG to be fully operational.
|
||||
|
||||
Done! You can now access Authentik via `https://auth.mydomain.com`
|
||||
### Done !
|
||||
::
|
||||
|
||||
You can now access Authentik via `https://auth.mydomain.com`
|
||||
|
||||
## Enable Multifactor Authentication
|
||||
The main value of Authentik is using multifactor authentication for all protected apps.
|
||||
|
||||
- Go to `https://auth.mydomain.com`
|
||||
- Log in
|
||||
- Go to _Settings_
|
||||
- Click the _MFA_ section
|
||||
- Click _Register_
|
||||
- Choose a method like _TOTP device_ (you'll need an authenticator app like Google Authenticator)
|
||||
- Follow the steps
|
||||
::steps{level="3"}
|
||||
### Log in to Authentik
|
||||
|
||||
Go to `https://auth.mydomain.com` and log in.
|
||||
|
||||
### Register an MFA method
|
||||
|
||||
Go to _Settings_, click the _MFA_ section, then _Register_. Choose a method like _TOTP device_ (you'll need an authenticator app like Google Authenticator) and follow the steps.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
You’ll now be prompted to enter a one-time code at every login.
|
||||
|
||||
@@ -320,6 +335,7 @@ SWAG lets you insert Authentik’s login page between a request and access to yo
|
||||
|
||||
Why do this when Dockge already has authentication? Because Dockge uses weak HTTP authentication. With Authentik, you get strong MFA authentication and automatic login to all apps protected by Authentik. This secures access to Dockge and other apps without needing a VPN.
|
||||
|
||||
::steps{level="3"}
|
||||
### Configuring Authentik
|
||||
|
||||
- Go to Authentik
|
||||
@@ -351,12 +367,15 @@ Uncomment the two lines `#include /config/nginx/authentik-server.conf;`
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||||
|
||||
Done! Now when accessing `https://dockge.mydomain.com`, you’ll be redirected to the Authentik login screen.
|
||||
|
||||
::tip{icon=""}
|
||||
✨ __Tip:__ In Dockge's settings, you can disable Dockge's authentication to avoid double login. **Warning**: this means if the port is open on your local network, there will be no authentication at all.
|
||||
::
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
Now when accessing `https://dockge.mydomain.com`, you’ll be redirected to the Authentik login screen.
|
||||
|
||||
::note
|
||||
|
||||
Repeat this process for each app you want to protect (unless it has native integration with Authentik).
|
||||
@@ -382,6 +401,7 @@ This container will forward requests to your main [Authentik](/serveex/advanced/
|
||||
|
||||
|
||||
|
||||
::steps{level="3"}
|
||||
### Configuring Authentik
|
||||
|
||||
Create your [providers and applications](/serveex/advanced/authentik/#protecting-a-native-app) as shown earlier.
|
||||
@@ -415,9 +435,9 @@ Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{val
|
||||
|
||||
On the list of created outposts, locate the new one and click _Show details_ at the end of the line. Carefully copy the access token.
|
||||
|
||||
### Configuring the Remote Machine
|
||||
We assume you’ve already installed [Docker](/serveex/core/docker) and [SWAG](/serveex/core/swag) on this remote machine. Here's how to configure it:
|
||||
|
||||
We assume you’ve already installed [Docker](/serveex/core/docker) and [SWAG](/serveex/core/swag) on this remote machine.
|
||||
### Create the stack folder
|
||||
|
||||
On your remote machine, use [Dockge](/serveex/core/docker/#installer-dockge-pour-gérer-et-déployer-les-conteneurs) to create a stack named `authentik-outpost`.
|
||||
|
||||
@@ -432,6 +452,8 @@ sudo mkdir -P /docker/authentik-outpost
|
||||
You can use [File Browser](/serveex/files/file-browser) to navigate and edit your files instead of using terminal commands.
|
||||
::
|
||||
|
||||
### Create the compose file
|
||||
|
||||
Create the `compose.yaml` file or paste the configuration directly into Dockge if installed.
|
||||
|
||||
Via command line:
|
||||
@@ -463,6 +485,8 @@ services:
|
||||
AUTHENTIK_TOKEN: ${TOKEN}
|
||||
```
|
||||
|
||||
### Add the outpost network to SWAG
|
||||
|
||||
Go to the SWAG stack on the remote machine (or edit directly using Dockge) and add the authentik-outpost network in the configuration file like this (see `networks` section):
|
||||
|
||||
```bash [Terminal]
|
||||
@@ -492,6 +516,8 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
|
||||
We assume the Dockge network name is `authentik-outpost_default`.
|
||||
::
|
||||
|
||||
### Restart SWAG
|
||||
|
||||
If using [Dockge](/serveex/core/docker/#installer-dockge-pour-gérer-et-déployer-les-conteneurs), restart SWAG.
|
||||
|
||||
Otherwise, via terminal:
|
||||
@@ -501,6 +527,8 @@ cd /docker/swag/
|
||||
sudo docker compose up -d
|
||||
```
|
||||
|
||||
### Set your environment variables
|
||||
|
||||
Create (or fill using Dockge) the `.env` file in the `authentik-outpost` directory:
|
||||
|
||||
Via command line:
|
||||
@@ -525,6 +553,8 @@ Fill in the values:
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||||
|
||||
### Deploy the stack
|
||||
|
||||
If using Dockge, deploy the stack.
|
||||
|
||||
Otherwise, via terminal:
|
||||
@@ -536,6 +566,8 @@ sudo docker compose up -d
|
||||
|
||||
The container is now running. You can verify its status from your Authentik instance admin panel under _Applications > Outposts_.
|
||||
|
||||
### Point SWAG at the outpost
|
||||
|
||||
Now, let’s configure SWAG.
|
||||
|
||||
Open the `authentik-server.conf` file:
|
||||
@@ -553,6 +585,9 @@ proxy_pass http://$upstream_authentik:9000;
|
||||
|
||||
Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{value="Ctrl+X"}.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
Then configure the applications to protect as you did on your main server, whether they are [native](/serveex/advanced/authentik/#protecting-a-native-app) or protected via [reverse proxy](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
|
||||
|
||||
## Migrating an Authentik Database
|
||||
|
||||
Reference in New Issue
Block a user