certyiknofetch/aeusio repository overview

Aeusio is a hardened, privacy-focused identity provider built for teams and organizations that need complete control over authentication and access management — without exposing internal software fingerprints.

⁠Features

• Single Sign-On (SSO) — SAML 2.0, OAuth2 / OpenID Connect, LDAP, SCIM, and forward-auth proxy support.
• Multi-Factor Authentication — TOTP, WebAuthn / FIDO2, SMS, Email OTP, and Duo.
• Flows & Stages — Fully customizable login, enrollment, recovery, and consent workflows via a visual editor.
• Application Proxy — Built-in reverse-auth proxy for protecting legacy apps that don't natively support SSO.
• Directory Sync — Inbound and outbound sync with Microsoft Entra ID (Azure AD), LDAP, Google Workspace, and more.
• Microsoft Graph Email — Send transactional emails (password resets, OTP codes, notifications) via Microsoft Graph API with OAuth2 client credentials — no SMTP relay required.
• Blueprints — Declarative YAML-based configuration for reproducible, version-controlled deployments.
• Branding & Theming — Fully white-label: custom logos, colors, email templates, and branded flows.
• Security Hardened — Version fingerprinting mitigated (no version in static assets, HTTP headers, or console logs), timing-safe secret comparison, atomic token operations, and strict signature validation.
• Enterprise Ready — RBAC, audit logging, event notifications, and high-availability support.

⁠Quick Start

⁠Docker Compose

services:
  server:
    image: certyiknofetch/authentik:1.3.1
    command: server
    ports:
      - "9000:9000"
      - "9443:9443"
    environment:
      AUTHENTIK_SECRET_KEY: <your-secret-key>
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: <db-password>
    volumes:
      - ./data:/data
      - ./custom-templates:/templates
    depends_on:
      postgresql:
        condition: service_healthy

  worker:
    image: certyiknofetch/authentik:1.3.1
    command: worker
    environment:
      AUTHENTIK_SECRET_KEY: <your-secret-key>
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: <db-password>
    volumes:
      - ./data:/data
      - ./custom-templates:/templates
    depends_on:
      postgresql:
        condition: service_healthy

  postgresql:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: authentik
      POSTGRES_USER: authentik
      POSTGRES_PASSWORD: <db-password>
    volumes:
      - database:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

volumes:
  database:

⁠Tags

⁠Architectures

⁠Environment Variables

⁠Volumes

⁠Ports

⁠Security

• No version information exposed in HTTP headers, static asset filenames, or browser console
• Content-hash-based static asset filenames to prevent version fingerprinting
• Timing-safe secret comparison for OAuth2 flows
• Atomic database transactions for token operations
• Strict SAML assertion signature verification
• Secure file permissions for TLS and SSH key material

⁠License || Source

Based on Authentik⁠ with security hardening and enhancements. This image is distributed under the same license terms as the upstream project.