Technology newsroom
Install Authentik on UGREEN NAS: Create a Private Single Sign-On (SSO) System with Docker 🔐
Learn how to install Authentik, an open-source Identity Provider, on UGREEN NAS to create a private Single Sign-On (SSO) system for managing access to various applications via Docker and Dockhand.
📌 Key Highlights:
- Authentik is an open-source Identity Provider system for Single Sign-On (SSO) to centralize authentication for all applications.
- This article will provide a detailed, step-by-step guide on installing Authentik on UGREEN NAS using Docker and the Dockhand tool.
- The installation requires several basic configurations, such as DDNS, Reverse Proxy (Nginx Proxy Manager), and SMTP, for the system to function completely.
UGREEN NAS is no longer just a storage device; it can also be a powerful server for running various services. Today, we will look at how to install Authentik, an open-source Identity Provider, which will help us create our own private Single Sign-On (SSO) system, making logging into our various applications easy and secure in one place.
Authentik acts as a central hub for identity verification and access management (Authorization), supporting numerous modern standards such as OpenID Connect, SAML, LDAP, and RADIUS. This allows it to connect with a wide range of systems, making it suitable for those who wish to control their own data and privacy without relying on services from major providers.
⚙️ Preparation Before Installation
Before you begin installing Authentik on your UGREEN NAS, there are several preparations needed. These include installing Dockhand, a Docker management tool on UGREEN NAS, enabling HTTPS for security, setting up DDNS (e.g., via No-IP) to access the NAS externally, and configuring Read & Write permissions for the Docker folder.
Next, create a folder for Authentik within the Docker folder, and then create 5 subfolders: certs, data, db, redis, and templates, to store various system data. Additionally, configuring SMTP (e.g., using Gmail SMTP) is essential for Authentik to send various email notifications.
🚀 Installation Steps via Dockhand
The installation will be performed by creating a new Stack in Dockhand using the Docker Compose Code provided by MariusHosting. This code includes 4 essential services: db (PostgreSQL), redis, server (Authentik Backend), and worker (Authentik Background Tasks).
The most crucial step here is to modify various values in the Compose code to match your own information 🔧, including the user's UID and GID, the Redis password, the AUTHENTIK_SECRET_KEY which must be newly generated, AUTHENTIK_BOOTSTRAP_PASSWORD for the first login, your SMTP details, and importantly, AUTHENTIK_HOST (your DDNS domain name) and AUTHENTIK_WEB__BASE_URL (the full URL with https://). Once all values are modified, you can click Create & Start to begin the installation.
🔐 Reverse Proxy Configuration and Initial Use
After all containers are running, the next step is to configure a Reverse Proxy via Nginx Proxy Manager to link your created domain with Authentik's IP and Port (Port 9700), and to request an SSL Certificate to ensure HTTPS connection, which is an indispensable step for security.
Once the proxy setup is complete, you can access the Authentik web interface via your domain. Use the default Username 'akadmin' and the password set as AUTHENTIK_BOOTSTRAP_PASSWORD in your Compose file. The system will then prompt you to configure basic settings in the Admin Interface, such as changing the Username, Email, and setting the correct Base URL. With these steps, your Authentik system on UGREEN NAS is ready for use.
💬 Is anyone looking for a self-hosted SSO system to use with various services running on their NAS? Please share which applications you are interested in using it with.