Configuration

These are all the configuration options you can set via environment variables.

Append any of the following keys to your .env file, and run docker-compose up -d to apply them.

Info
The double-underscores are intentional, as all these settings are translated to yaml internally, a double-underscore indicates the next level.

All of these variables can be set to values, but you can also use a URI-like format to load values from other places:

Checking settings

To check if your config has been applied correctly, you can run the following command to output the full config:

docker-compose run --rm worker dump_config
# Or for kubernetes
kubectl exec -it deployment/authentik-worker -c authentik -- ak dump_config

PostgreSQL Settings

Redis Settings

Listen Setting

authentik Settings

AUTHENTIK_SECRET_KEY

Secret key used for cookie signing and unique user IDs, don't change this after the first install.

AUTHENTIK_LOG_LEVEL

Log level for the server and worker containers. Possible values: debug, info, warning, error

Starting with 2021.12.3, you can also set the log level to trace. This has no affect on the core authentik server, but shows additional messages for the embedded outpost.

DANGER
Setting the log level to trace will include sensitive details in logs, so it shouldn't be used in most cases.

Logs generated with trace should be treated with care as they can give others access to your instance, and can potentially include things like session cookies to authentik and other pages.

Defaults to info.

Which domain the session cookie should be set to. By default, the cookie is set to the domain authentik is accessed under.

AUTHENTIK_GEOIP

Path to the GeoIP database. Defaults to /geoip/GeoLite2-City.mmdb. If the file is not found, authentik will skip GeoIP support.

AUTHENTIK_DISABLE_UPDATE_CHECK

Disable the inbuilt update-checker. Defaults to false.

AUTHENTIK_ERROR_REPORTING

AUTHENTIK_EMAIL

AUTHENTIK_OUTPOSTS

AUTHENTIK_AVATARS

Configure how authentik should show avatars for users. Following values can be set:

Default: gravatar,initials

Starting with authentik 2022.8, you can also use an attribute path like attributes.something.avatar, which can be used in combination with the file field to allow users to upload custom avatars for themselves.

Starting with authentik 2023.2, multiple modes can be set, and authentik will fallback to the next mode when no avatar could be found. For example, setting this to gravatar,initials will attempt to get an avatar from Gravatar, and if the user has not configured on there, it will fallback to a generated avatar.

AUTHENTIK_DEFAULT_USER_CHANGE_NAME

INFO
Requires authentik 2021.12.5

Enable the ability for users to change their name, defaults to true.

AUTHENTIK_DEFAULT_USER_CHANGE_EMAIL

INFO
Requires authentik 2021.12.1

Enable the ability for users to change their Email address, defaults to false.

AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME

Info
Requires authentik 2021.12.1

Enable the ability for users to change their Usernames, defaults to false.

AUTHENTIK_GDPR_COMPLIANCE

Info
Requires authentik 2021.12.1

When enabled, all the events caused by a user will be deleted upon the user's deletion. Defaults to true.

AUTHENTIK_DEFAULT_TOKEN_LENGTH

Info
Requires authentik 2022.4.1

Configure the length of generated tokens. Defaults to 60.

AUTHENTIK_IMPERSONATION

Info
Requires authentik 2022.4.2

Globally enable/disable impersonation. Defaults to true.

Info
Requires authentik 2021.12.1

This option configures the footer links on the flow executor pages.

The setting can be used as follows:


AUTHENTIK_LDAP__TASK_TIMEOUT_HOURS

INFO
Requires authentik 2023.1

Timeout in hours for LDAP synchronization tasks.

Defaults to 2.

AUTHENTIK_LDAP__PAGE_SIZE

INFO
Requires authentik 2023.6.1

Page size for LDAP synchronization. Controls the number of objects created in a single task.

Defaults to 50.

AUTHENTIK_LDAP__TLS__CIPHERS 

INFO
Requires authentik 2022.7

Allows configuration of TLS Cliphers for LDAP connections used by LDAP sources. Setting applies to all sources.

Defaults to null.

AUTHENTIK_WEB__WORKERS

INFO
Requires authentik 2022.9

Configure how many gunicorn worker processes should be started (see https://docs.gunicorn.org/en/stable/design.html).

If running in Kubernetes, the default value is set to 2 and should in most cases not be changed, as scaling can be done with multiple pods running the web server. Otherwise, authentik will use 1 worker for each 4 CPU cores + 1 as a value below 2 workers is not recommended.

AUTHENTIK_WEB__THREADS

INFO
Requires authentik 2022.9

Configure how many gunicorn threads a worker processes should have (see
 https://docs.gunicorn.org/en/stable/design.html).

Defaults to 4.

Custom python settings

To modify additional settings further than the options above allow, you can create a custom python file and mount it to /data/user_settings.py. This file will be loaded on startup by both the server and the worker. All default settings are here

CAUTION
Using these custom settings is not supported and can prevent your authentik instance from starting. Use with caution.


Revision #2
Created 20 August 2023 00:23:13
Updated 19 January 2024 18:19:58