Authentik

Minimal Authentik + nginx edge stack for local / Podman. Shared infra (not ArcaneDemesne/) — reusable across clients/projects.

Networks: authentik-proxy / postgres on gateway-hub. authentik-server also joins authentik-net so app APIs (not on the hub) can reach OIDC backchannel at authentik-server:9000.

Ports and hostnames: Gateway/PORT_MATRIX.md

This stack: edge nginx host 8082 → authentik-proxy; server direct 9000 → authentik-server.

Public hostname: auth.arcanedemesne.com (routed by Gateway hub).

Runtime (not in git): Postgres in Podman volume authentik-database; ./data and ./certs are bind-mount dirs for Authentik state and worker certs.

Compose

cp .env.example .env   # set PG_PASS and AUTHENTIK_SECRET_KEY
podman network create gateway-hub    # once, from Gateway
podman network create authentik-net  # once, from Gateway
podman compose up -d

Database (dev)

Postgres is internal-only in the default compose. To connect DataGrip (or other host tools), start with the dev overlay:

make up-dev
# or: podman compose -f compose.yml -f compose.dev.yml up -d

Field	Value
Host	localhost
Port	15432 (or $PG_PORT_PUBLISH from .env)
Database	PG_DB (default authentik)
User / Password	PG_USER / PG_PASS from .env
SSL	disabled

The container name postgresql only resolves inside gateway-hub, not from the host.

Do not use compose.dev.yml on production hosts exposed to the internet.

Verify the port: ss -ltnp | grep 15432 or podman ps --filter name=postgresql.

OAuth / OIDC (app providers)

Each ArcaneDemesne app gets its own OAuth2 provider in Authentik.

Doc	Purpose
docs/oauth-providers.md	Setup guide — redirect URI types (2026.2+), invalidation flow
docs/apps/	Per-app URI checklists (HomeLab, SeedSlinger, …)
Tools/AuthentikSync	authentiksync CLI — sync redirect URIs from app authentik.sync.yaml

Quick reference: docs/apps/homelab.md. Sync URIs: make -C ../Tools/AuthentikSync sync-homelab.