Skip to main content

Docker Compose

Minimal setup​

services:
  autentico:
    image: ghcr.io/eugenioenko/autentico:latest
    command: ["start", "--auto-setup"]
    restart: unless-stopped
    ports:
      - "9999:9999"
    volumes:
      - autentico-data:/app/data

volumes:
  autentico-data:

On first start, --auto-setup generates a .env with fresh secrets (RSA key, CSRF, token signing) and persists it on the volume alongside the database. On subsequent starts, the existing configuration is reused.

docker compose up -d

Open http://localhost:9999/onboard to create your admin account.

Production setup​

For production, set your public URL and bind to localhost only (let a reverse proxy handle TLS):

services:
  autentico:
    image: ghcr.io/eugenioenko/autentico:latest
    command: ["start", "--auto-setup", "--url", "https://auth.example.com"]
    restart: unless-stopped
    ports:
      - "127.0.0.1:9999:9999"
    volumes:
      - autentico-data:/app/data

volumes:
  autentico-data:

With a pre-generated .env​

If you prefer to manage secrets explicitly, generate a .env first and pass it to the container:

# Generate .env locally (requires the binary)
autentico init --url https://auth.example.com
services:
  autentico:
    image: ghcr.io/eugenioenko/autentico:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:9999:9999"
    volumes:
      - autentico-data:/app/data
    env_file:
      - .env

volumes:
  autentico-data:

Add .env to .gitignore to avoid committing secrets.

Caddy reverse proxy​

Add a Caddy service for automatic HTTPS via Let's Encrypt:

services:
  autentico:
    image: ghcr.io/eugenioenko/autentico:latest
    command: ["start", "--auto-setup", "--url", "https://auth.example.com"]
    restart: unless-stopped
    expose:
      - "9999"
    volumes:
      - autentico-data:/app/data

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy-data:/data
    depends_on:
      - autentico

volumes:
  autentico-data:
  caddy-data:

Caddyfile:

auth.example.com {
    reverse_proxy autentico:9999
}

Upgrading​

docker compose pull
docker compose up -d

Migrations are applied automatically on startup. Back up your data volume before upgrading.

Changing AUTENTICO_APP_URL after first run leaves the admin client registered with the old callback URL. Delete the volume and start fresh to fix: docker compose down -v && docker compose up -d.