Docker Compose

Minimal setup

services:
  autentico:
    image: ghcr.io/eugenioenko/autentico:latest
    command: ["start", "--auto-setup"]
    restart: unless-stopped
    ports:
      - "9999:9999"
    volumes:
      - autentico-data:/app/data

volumes:
  autentico-data:

On first start, --auto-setup generates a .env with fresh secrets (RSA key, CSRF, token signing) and persists it on the volume alongside the database. On subsequent starts, the existing configuration is reused.

docker compose up -d

Open http://localhost:9999/onboard to create your admin account.

Production setup

For production, set your public URL and bind to localhost only (let a reverse proxy handle TLS):

services:
  autentico:
    image: ghcr.io/eugenioenko/autentico:latest
    command: ["start", "--auto-setup", "--url", "https://auth.example.com"]
    restart: unless-stopped
    ports:
      - "127.0.0.1:9999:9999"
    volumes:
      - autentico-data:/app/data

volumes:
  autentico-data:

With a pre-generated .env

If you prefer to manage secrets explicitly, generate a .env first and pass it to the container:

# Generate .env locally (requires the binary)
autentico init --url https://auth.example.com

services:
  autentico:
    image: ghcr.io/eugenioenko/autentico:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:9999:9999"
    volumes:
      - autentico-data:/app/data
    env_file:
      - .env

volumes:
  autentico-data:

Add .env to .gitignore to avoid committing secrets.

Caddy reverse proxy

Add a Caddy service for automatic HTTPS via Let’s Encrypt:

services:
  autentico:
    image: ghcr.io/eugenioenko/autentico:latest
    command: ["start", "--auto-setup", "--url", "https://auth.example.com"]
    restart: unless-stopped
    expose:
      - "9999"
    volumes:
      - autentico-data:/app/data

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy-data:/data
    depends_on:
      - autentico

volumes:
  autentico-data:
  caddy-data:

Caddyfile:

auth.example.com {
    reverse_proxy autentico:9999
}

Upgrading

docker compose pull
docker compose up -d

Migrations are applied automatically on startup. Back up your data volume before upgrading.

URL mismatch

Changing AUTENTICO_APP_URL after first run leaves the admin client registered with the old callback URL. Delete the volume and start fresh to fix: docker compose down -v && docker compose up -d.

Trusted proxy addresses

Set AUTENTICO_TRUSTED_PROXIES in Autentico’s environment to the proxy address or a dedicated proxy network as seen inside the Autentico container. Loopback CIDRs apply only when the proxy connects over the same network namespace.

For example, with a dedicated Docker network containing only Autentico and a proxy at 172.30.0.2:

environment:
  AUTENTICO_TRUSTED_PROXIES: "172.30.0.2/32"

Use the address assigned in your Compose network configuration; this example address is not a Docker default. Keep untrusted containers off the trusted network and restrict direct access to Autentico’s internal port. For multiple proxies, include each trusted hop’s CIDR. See Reverse Proxy.

On upgrade, the empty default uses the connecting peer for rate limits, audit logs and session records. Configure proxy trust to restore per-user client IPs behind your proxy.