How to deploy a Self-Hosted OAuth2 Provider on Vultr Using Authentik and Docker Compose
Authentik is an open-source identity provider (IdP) that implements OAuth 2.0, OpenID Connect (OIDC), and SAML. Deploying Authentik on a Vultr Cloud Compute instance gives you full control over authentication, enables single sign-on (SSO) across internal tools, and keeps user data on your own infrastructure.
In this guide, you deploy Authentik with Docker Compose, secure it behind a reverse proxy (Caddy or NGINX) with HTTPS, harden the server, and register an OAuth 2.0 client to protect a sample web application. When you finish, you’ll have a production-ready, self-hosted authentication service running on Vultr.
Prerequisites
Before you begin,
- Have access to an Ubuntu 24.04 server as a non-root user with
sudoprivileges. - Create a DNS A record pointing to your server's IP address, such as
auth.example.com. Replace all occurrences ofauth.example.comin this guide with your actual domain. - Install Docker and Docker Compose.
Deploy Authentik Using Docker Compose
Create a dedicated project directory for Authentik in your home directory.
CONSOLEGenerate a 64-character hexadecimal secret key for Authentik.
CONSOLECopy the generated key for use in the next step.
Create a
.envfile to store the secrets.CONSOLEAdd the following content in the
.envfile:INIReplace
<POSTGRES_USER_PASSWORD>and<64_CHAR_SECRET_KEY>with the alphanumeric password and the secret key you generated earlier, respectively.Save and exit the file.
Download the official
docker-compose.ymlmanifest for Authentik.CONSOLEStart the stack in detached mode.
CONSOLEList the running services and verify that all services are healthy.
CONSOLEOutput:
Configure NGINX or Caddy with HTTPS
Ensure your domain resolves to the public IP of your Vultr instance that runs Authentik. TLS issuance will fail if DNS is wrong or ports are closed.
View the
ufwstatus.CONSOLEIf the status of
ufwdisplaysinactivethen run the below command.CONSOLE
Allow the required HTTP and HTTPS ports.
CONSOLEView the
ufwstatus.CONSOLE
Install the Caddy web server using
apt.CONSOLECreate and configure the
Caddyfileto reverse proxy to Authentik.CONSOLERemove the existing content and add the following:
INISave and exit the file.
Format the
Caddyfileconfiguration file.CONSOLEValidate the configuration and reload the Caddy service.
CONSOLECaddy automatically issues and renews TLS certificates when DNS is correctly configured and ports 80/443 are accessible.
Open the Initial Setup flow to create the first administrator account.
On the setup page, enter your email and a strong password to complete the admin account setup.
If the application is not reachable, check the Caddy web server logs.
CONSOLE
Connect a Sample App to Authentik
In this section, you’ll register an OAuth 2.0 client in Authentik, then run a minimal Node.js app that uses it to validate authentication.
Register an OAuth2 Client
Sign in to the Authentik Admin UI.
Create an OAuth2/OpenID Provider for the sample application.
- Navigate: Applications > Providers > Create > OAuth2/OpenID Provider
- At the top, set:
- Name:
Sample App Provider - Authorization flow:
default-provider-authorization-explicit-consent
- Name:
- Under Protocol settings:
- Client type:
Confidential - Redirect URIs/Origins (RegEx):
https://app.example.com/auth/callback - Generate and save the Client ID and Client Secret
- Client type:
- Under Advanced flow settings:
- Authentication flow:
default-authentication-flow - Invalidation flow: leave default (optional)
- Authentication flow:
- Under Advanced protocol settings:
- Subject mode:
Based on the User's hashed ID
- Subject mode:
Create the application and link it to the provider you just created.
- Navigate: Applications > Applications > Create
- Name:
Sample Web App - Slug:
sample-web-app - Provider: select
Sample App Provider - Policy engine mode:
ANY - Under UI settings:
- Launch URL:
https://auth.example.com
- Launch URL:
Sample Node.js OAuth2 Integration Application
Follow the steps below to provision a minimal web application and validate the Authorization Code flow against Authentik.
Clone the sample repository and enter the project directory.
CONSOLEInstall
npm.CONSOLEInstall runtime dependencies.
CONSOLEGenerate a session secret.
CONSOLEConfigure environment variables.
CONSOLEPaste the following and set the values precisely:
INIIn the above file:
- Replace
https://auth.example.comwith the URL of your Authentik instance. - Replace
https://app.example.comwith the URL where your sample app will run. - Replace
<CLIENT_ID_FROM_AUTHENTIK_PROVIDER>and<CLIENT_SECRET_FROM_AUTHENTIK_PROVIDER>with the values generated when you created the OAuth2/OpenID Provider in Authentik. - Replace
<RANDOM_SESSION_SECRET_GENERATED_ABOVE>with the session secret you generated in the previous step.
Make sure all values are set correctly before starting the application.
- Replace
Start the application.
CONSOLEEnsure that you configure a reverse proxy and SSL for the app, similar to how you configured
auth.example.combut for port3000.Navigate to
https://app.example.comand click Login with Authentik.Enter your OAuth2 user credentials.
After authentication, the app exchanges the authorization code for tokens and redirects to
/protected.
Troubleshooting
If you encounter issues while connecting your sample app to Authentik, follow these steps:
Check the OAuth2 Provider and Application settings,eEnsure that your Authentik Provider and Application are configured correctly, particularly the Redirect URI.
Authentik server logs can provide insight into errors during login or token exchange. Use the following command to view the logs in real-time.
CONSOLELook for any warnings or errors related to OAuth2 flows, redirect URIs, or authentication failures.
Confirm that your reverse proxy (Caddy or NGINX) forwards requests correctly to
127.0.0.1:9000and that HTTPS is properly configured. Misconfigured proxy settings can prevent callback URLs from reaching Authentik.OAuth2 state mismatches may occur due to stale sessions. Try logging in using a private or incognito browser window to ensure a clean session.
Conclusion
You successfully deployed a self-hosted Authentik instance on Vultr with Docker Compose, secured it behind HTTPS, and verified OAuth2 SSO with a sample Node.js app. With this foundation, you can now onboard additional applications, enable email flows, and scale your authentication infrastructure while keeping full control over user data.
0 Comments
Be the first to comment and share your perspective with the community.