Authentik Identity Platform

Purpose

Authentik sits in front of self-hosted applications as the authentication boundary — handling login, TOTP, and (in progress) Duo Push MFA, then passing trusted identity through to the applications behind it.

Environment

• Hosted as an LXC container on the Proxmox platform.
• Published over HTTPS via Nginx Proxy Manager, using a corrected browser-facing URL (previously HTTP, fixed to HTTPS).
• Uses an embedded outpost for proxy-provider applications — i.e. apps that don't natively speak an SSO protocol get authentication injected at the proxy layer.

Demonstrated integrations

• Radarr and Sonarr — media automation apps sitting behind the proxy provider.
• OpenClaw — migrated from a shared gateway token to trusted-proxy identity headers issued by Authentik.
• Nginx Proxy Manager — the HTTPS entry point for all of the above.
• Duo Push MFA — partially configured, running alongside TOTP during rollout.

Completed work

• Established a repeatable proxy-provider pattern for apps that don't support native SSO.
• Corrected the outpost's browser-facing URL from HTTP to HTTPS.
• Used Authentik-issued identity headers for OpenClaw's trusted-proxy authentication, replacing a shared token.
• Retained TOTP as a working fallback while designing Duo Push enrollment, avoiding any lockout risk during the transition.

Next documentation

• Full application/provider inventory.
• Groups and access policies.
• Enrollment and account-recovery process.
• Break-glass access for when Authentik itself is unavailable.
• Backup and upgrade process for the Authentik container.

Related projects