authentik - Self-Hosted SSO That Actually Works

authentik replaces expensive SSO vendors like Okta, Auth0, and Azure AD. I run it on a $40/month DigitalOcean droplet for our 25-person startup and it handles everything Okta was charging us $375/month to do. That's a 90% cost reduction that goes straight to our bottom line.

The Setup Reality Check

The Docker Compose setup is straightforward if you follow their docs exactly. Don't try to get clever with the database config - just use their PostgreSQL defaults or you'll spend hours debugging connection timeouts.

Key gotchas from my deployment:

• Memory: Needs minimum 2GB RAM. I tried 1GB initially and it swapped itself to death
• PostgreSQL version: Version 2025.4+ requires PostgreSQL 16+. The upgrade breaks things if you don't follow their migration guide
• Initial admin: Save the recovery key or you'll be locked out. I learned this the hard way

The official Docker images are updated regularly, and their security guide covers hardening practices you'll actually need.

Protocol Support That Actually Works

It supports OAuth2/OIDC, SAML, LDAP, and RADIUS. OAuth2 is plug-and-play with modern apps. SAML works but the config is fiddly - expect to spend time tweaking XML attributes for legacy enterprise apps.

The outpost system is clever - you can run auth components where you need them instead of proxying everything through one chokepoint. Saved my ass when dealing with geographically distributed services. The proxy provider handles forward auth beautifully with Traefik or nginx.

MFA and Security Features

MFA works great - I use Google Authenticator and my YubiKey. WebAuthn/Passkeys were a pain to set up initially but work flawlessly once configured. The security keys documentation is actually helpful.

The flow system lets you customize auth workflows. It's powerful but overcomplicated for basic SSO - I spent way too much time in the flow designer when simple defaults would've worked fine. The default flows cover most use cases without customization.

That said, you're probably wondering how authentik actually compares to the big commercial players. Let me break down the real differences.

authentik is built on Python/Django, which means it's pretty standard to deploy and debug. The outpost system is actually clever - you can run auth components where you need them instead of proxying everything through one bottleneck.

Resource Requirements (Don't Cheap Out)

Minimum specs from their docs: 2 CPU cores, 2GB RAM. I tried running it on a 1GB VPS initially - huge mistake. It'll swap itself to death and you'll get random 503 errors.

For production, budget at least:

• 4GB RAM (8GB if you're running multiple outposts)
• 50GB storage for logs and database growth
• Decent I/O - PostgreSQL gets chatty under load

The system requirements page has realistic numbers, not the marketing bullshit you see elsewhere.

Database Headaches You'll Encounter

PostgreSQL 16+ is required for authentik 2025.4+. The upgrade process will break your shit if you don't follow it exactly. I learned this during a Friday evening "quick update" that turned into a weekend recovery mission.

Common database fuckups:

• Connection pooling: Default settings assume development load
• Shared memory: Needs tuning for larger user counts
• Backup strategy: You WILL lose data if you don't have proper backups

The PostgreSQL troubleshooting guide covers the shit that actually breaks in production.

Deployment Options That Actually Work

Docker Compose (recommended for < 100 users):

## Use their official compose file - don't get creative
wget https://goauthentik.io/docker-compose.yml
## Modify .env file for your environment
## Don't try to optimize container settings

The Docker Compose guide walks through everything including environment variables and reverse proxy setup.

Kubernetes (production scale):
Use the Helm chart but expect to spend time configuring ingress, storage classes, and resource limits. The default values assume unlimited resources. The Kubernetes troubleshooting guide covers the common gotchas.

Integration Pain Points (The Real Story)

The integration guides are actually pretty good, which surprised me. OAuth2 works out of the box for most modern apps - Grafana, Nextcloud, GitLab all connected within minutes. SAML is where you'll lose your sanity, especially with enterprise software that implements SAML "creatively."

Recent additions include Stripe, Tailscale, and Atlassian Cloud - the community actually contributes useful integration guides instead of just complaining. Check the full integration list for your specific apps before you commit.

Maintenance Burden (Plan for This)

Plan to update monthly. Security patches come frequently and breaking changes happen. The release notes are actually detailed enough to plan upgrades. Subscribe to their security announcements or you'll miss critical patches.

Monitor these or you'll get surprise outages:

• Container logs (they're verbose by default)
• PostgreSQL connections and query performance
• Redis memory usage (sessions pile up)
• Outpost connectivity (they fail silently sometimes)

After running authentik for months, these are the questions people actually ask me about the real deployment experience.