Research-Stack/4-Infrastructure/docs/authentik-setup.md

Authentik Setup Guide — Research Stack

Status: 2026-05-21

Authentik is deployed in LXC 100 with local PostgreSQL 16 and Redis.

Current State

• URL: https://auth.researchstack.info (Caddy reverse proxy -> 192.168.100.100:9000)
• Default admin: akadmin / authentik (CHANGE THIS IMMEDIATELY)
• Backend: PostgreSQL 16 in Docker (authentik-postgresql)

Step 1: First Login & Bootstrap

1. Open https://auth.researchstack.info (use SSH tunnel if netcup ports blocked)
2. Login with akadmin / authentik
3. Go to Admin Interface (top right)
4. Navigate to Directory -> Users -> akadmin
5. Change password to a strong unique password
6. (Optional) Add your email for recovery

Step 2: Create Forward Auth Provider (for Caddy)

This protects vault.researchstack.info and future ARR services.

1. In Admin Interface, go to Applications -> Providers
2. Click Create
3. Select Proxy Provider
4. Fill in:
   • Name: caddy-forward-auth
   • Authorization flow: default-provider-authorization-implicit-consent
   • Internal host: http://192.168.100.100:9100 (vault service)
   • External host: https://vault.researchstack.info
   • Mode: Forward domain
5. Save

Step 3: Create Application

1. Go to Applications -> Applications
2. Click Create
3. Fill in:
   • Name: Credential Vault
   • Slug: vault
   • Provider: caddy-forward-auth
4. Save

Step 4: Configure Outpost

1. Go to Applications -> Outposts
2. The authentik Embedded Outpost is already running
3. Edit it, add Credential Vault to the list of applications
4. Save

The outpost listens on 192.168.100.100:9000 (same as Authentik).

Step 5: Update Caddy Forward Auth

On the VPS, edit /opt/caddy/Caddyfile:

vault.researchstack.info {
    tls {
        dns porkbun { ... }
    }
    forward_auth 192.168.100.100:9000 {
        uri /outpost.goauthentik.io/auth/caddy
        copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name
    }
    reverse_proxy 192.168.100.100:9100
}

Then reload:

/opt/caddy/caddy reload --config /opt/caddy/Caddyfile

Step 6: Test

1. Open https://vault.researchstack.info in an incognito window
2. You should be redirected to Authentik login
3. After logging in, you should see the credential vault JSON response

Step 7: Add Users

1. Go to Directory -> Users
2. Create users for anyone who needs access
3. (Optional) Add users to Directory -> Groups for role-based access

Next: ARR Stack Apps

For each ARR service, repeat Steps 2-5:

Service	Internal Host	External Host	Provider Name
Sonarr	http://192.168.100.100:8989	https://sonarr.researchstack.info	sonarr-forward-auth
Radarr	http://192.168.100.100:7878	https://radarr.researchstack.info	radarr-forward-auth
Lidarr	http://192.168.100.100:8686	https://lidarr.researchstack.info	lidarr-forward-auth
Readarr	http://192.168.100.100:8787	https://readarr.researchstack.info	readarr-forward-auth
Prowlarr	http://192.168.100.100:9696	https://prowlarr.researchstack.info	prowlarr-forward-auth
Bazarr	http://192.168.100.100:6767	https://bazarr.researchstack.info	bazarr-forward-auth

All can use the same embedded outpost.

Chat Subdomain (chat.researchstack.info)

Status: Caddy configured, placeholder deployed. Authentik provider+app pending.

Provider setup (repeat Steps 2-4 above):

Field	Value
Provider name	research-stack-chat
Authorization flow	default-provider-authorization-implicit-consent
Internal host	http://100.101.247.127 (placeholder; will become Steam Deck Open WebUI)
External host	https://chat.researchstack.info
Mode	Forward domain

Application setup:

Field	Value
Name	Research Stack Chat
Slug	research-stack-chat
Provider	research-stack-chat

Outpost: Add Research Stack Chat to the authentik Embedded Outpost.

Caddy (already deployed on microvm-racknerd):

chat.researchstack.info {
    forward_auth * http://100.119.165.120:9000 {
        uri /outpost.goauthentik.io/auth/caddy
        copy_headers X-Authentik-Username X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwt X-Authentik-Meta-App X-Authentik-Meta-Version
    }
    root * /var/www/researchstack/chat
    file_server
    try_files {path} /index.html
}

When Steam Deck is onboarded: Change the Caddy site block from file_server to reverse_proxy <steam-deck-tailscale-ip>:8080.

Dashboard Subdomain (dash.researchstack.info)

Status: Deployed. Homer static files on microvm-racknerd. DNS pending.

Provider setup:

Field	Value
Provider name	research-stack-dash
Authorization flow	default-provider-authorization-implicit-consent
Internal host	http://100.101.247.127
External host	https://dash.researchstack.info
Mode	Forward domain

Application setup:

Field	Value
Name	Research Stack Dashboard
Slug	research-stack-dash
Provider	research-stack-dash

Caddy:

dash.researchstack.info {
    forward_auth * http://100.119.165.120:9000 {
        uri /outpost.goauthentik.io/auth/caddy
        copy_headers ...
    }
    root * /var/www/researchstack/dash
    file_server
    try_files {path} /index.html
}

Status Monitoring Subdomain (status.researchstack.info)

Status: Deployed. Uptime Kuma on nixos-laptop via podman. DNS pending.

Provider setup:

Field	Value
Provider name	research-stack-status
Authorization flow	default-provider-authorization-implicit-consent
Internal host	http://100.119.165.120:3001
External host	https://status.researchstack.info
Mode	Forward domain

Application setup:

Field	Value
Name	Research Stack Status
Slug	research-stack-status
Provider	research-stack-status

Caddy:

status.researchstack.info {
    forward_auth * http://100.119.165.120:9000 {
        uri /outpost.goauthentik.io/auth/caddy
        copy_headers ...
    }
    reverse_proxy http://100.119.165.120:3001
}

Auth Alias (auth.researchstack.info)

Status: Deployed. Clean alias redirect to main Authentik interface.

Provider setup:

Field	Value
Provider name	research-stack-auth
Authorization flow	default-provider-authorization-implicit-consent
Internal host	http://100.119.165.120:9000
External host	https://auth.researchstack.info
Mode	Forward domain

Application setup:

Field	Value
Name	Research Stack Auth
Slug	research-stack-auth
Provider	research-stack-auth

Caddy:

auth.researchstack.info {
    forward_auth * http://100.119.165.120:9000 {
        uri /outpost.goauthentik.io/auth/caddy
        copy_headers ...
    }
    redir / https://researchstack.info/ permanent
}

Behavior: Visiting https://auth.researchstack.info triggers Authentik login (if not authenticated), then redirects to https://researchstack.info/.

Troubleshooting

Certificate errors?

• Check journalctl -u caddy on the VPS

Authentik not reachable?

• Verify Docker containers in LXC 100: pct exec 100 -- docker ps
• Check Authentik logs: pct exec 100 -- docker logs authentik-server

Forward auth not working?

• Verify outpost application assignment
• Check Caddy logs for forward_auth errors
• Ensure auth.researchstack.info is accessible (the outpost needs to redirect there)