Authentik provides the identity and forward-auth layer for the Smithflix admin-gateway MVP. As of 2026-04-08, it protects manage.better-than.tv through the embedded outpost and a single proxy provider for that hostname.
This page documents the authentik-postgresql, authentik-server, and authentik-worker services that live in the Server Stack, plus the embedded outpost state that now serves manage.better-than.tv.
authentik-postgresql, authentik-server, authentik-workerghcr.io/goauthentik/server/opt/stacks/server/compose.yamlhttp://127.0.0.1:9000/api/v3authentik Embedded Outpostmanagemanage.better-than.tv/srv/docker/authentik/data/srv/docker/authentik/postgresql/srv/docker/authentik/certs/srv/docker/authentik/custom-templates/opt/stacks/server/.env/home/adam/scripts/setup-authentik-mvp.sh/home/adam/scripts/configure-authentik-manage-mvp.pyhttp://192.168.0.113:90009000 -> 9000https://manage.better-than.tv/ redirect into https://manage.better-than.tv/outpost.goauthentik.io/start?...manage proxy must also carry Authentik browser routes on the same host: /application/, /if/, /static/, /api/v3/, and /flows/https://manage.better-than.tv/smokeping/ and relies on an HTML base-path rewrite there so Smokeping's relative assets stay under /smokeping/manage at /smokeping/css/, /smokeping/js/, and /smokeping/cache/ because those requests were returning 404 through the authenticated subpath routeauth.better-than.tv proxy host was required for the MVP flow on 2026-04-08/opt/stacks/server/.env:
AUTHENTIK_PG_PASSAUTHENTIK_SECRET_KEYAUTHENTIK_BOOTSTRAP_EMAILAUTHENTIK_BOOTSTRAP_PASSWORDAUTHENTIK_BOOTSTRAP_TOKENAUTHENTIK_TAGakadmin with the bootstrap email from the stack envcurl -I http://127.0.0.1:9000/if/flow/initial-setup//home/adam/scripts/configure-authentik-manage-mvp.py/home/adam/scripts/configure-authentik-manage-mvp.py --apply/home/adam/scripts/configure-manage-authentik-mvp.sh --applydefault-authentication-flowdefault-provider-authorization-implicit-consentdefault-provider-invalidation-flowjson-filedocker logs authentik-server is the fastest first check for provider/outpost or startup issuesdocker logs authentik-worker is useful when background tasks or managed objects fail to converge/srv/docker/authentik is within the documented /srv/docker backup scope/opt/stacks/server/.env is required to preserve the Authentik bootstrap secrets and image tagauthentik-server is healthy on :9000manage provider existsmanage provider attachment, manage.better-than.tv can redirect into a dead outpost flowexternal_host=https://manage.better-than.tv, redirects can land on the wrong host or loopconfigure-manage-authentik-mvp.sh is removed but the Authentik provider remains, the outpost flow can exist while NPM no longer proxies it correctly2026-04-08