Replace Auth0 / Clerk with Self-Hosted authentik

# Production Docker Compose: authentik (Replaces Auth0 / Clerk)
services:
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
    networks:
      - stack_net

  authentik:
    image: ghcr.io/goauthentik/server:latest
    container_name: stack-authentik
    restart: unless-stopped
    environment:
      - "AUTHENTIK_REDIS__HOST=redis"
      - "AUTHENTIK_POSTGRESQL__HOST=postgres"
      - "AUTHENTIK_POSTGRESQL__USER=postgres"
      - "AUTHENTIK_POSTGRESQL__NAME=authentik"
      - "AUTHENTIK_POSTGRESQL__PASSWORD=${POSTGRES_PASSWORD:-strongpassword}"
      - "AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET:-generate_50_char_secret_key}"
    volumes:
      - authentik_data:/data
    networks:
      - stack_net

  postgres:
    image: pgvector/pgvector:pg16
    container_name: stack-postgres
    restart: unless-stopped
    environment:
      - "POSTGRES_USER=postgres"
      - "POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-strongpassword}"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - stack_net

  redis:
    image: redis:7-alpine
    container_name: stack-redis
    restart: unless-stopped
    volumes:
      - redis_data:/data
    networks:
      - stack_net

networks:
  stack_net:
    driver: bridge

volumes:
  caddy_data:
  authentik_data:
  postgres_data:
  redis_data:

# Automatic Let's Encrypt HTTPS for authentik
authentik.{$DOMAIN:yourdomain.com} {
  encode zstd gzip
  reverse_proxy authentik:9000
}

Why Teams Switch to authentik

• ✓Put SSO in front of any self-hosted app with Caddy/Traefik
• ✓Unlimited MAUs & Enterprise SAML for $0
• ✓Visual flow designer for signup & MFA

Deploy authentik in 60 Seconds

Sized automatically for authentik (1024MB container RAM + OS overhead).