Skip to content
Autentico

Docker Compose

Minimal setup

Section titled “Minimal setup”
services:
  autentico:
    image: ghcr.io/eugenioenko/autentico:latest
    command: ["start", "--auto-setup"]
    restart: unless-stopped
    ports:
      - "9999:9999"
    volumes:
      - autentico-data:/app/data


volumes:
  autentico-data:

On first start, --auto-setup generates a .env with fresh secrets (RSA key, CSRF, token signing) and persists it on the volume alongside the database. On subsequent starts, the existing configuration is reused.

Terminal window
docker compose up -d

Open http://localhost:9999/onboard to create your admin account.

Production setup

Section titled “Production setup”

For production, set your public URL and bind to localhost only (let a reverse proxy handle TLS):

services:
  autentico:
    image: ghcr.io/eugenioenko/autentico:latest
    command: ["start", "--auto-setup", "--url", "https://auth.example.com"]
    restart: unless-stopped
    ports:
      - "127.0.0.1:9999:9999"
    volumes:
      - autentico-data:/app/data


volumes:
  autentico-data:

With a pre-generated .env

Section titled “With a pre-generated .env”

If you prefer to manage secrets explicitly, generate a .env first and pass it to the container:

Terminal window
# Generate .env locally (requires the binary)
autentico init --url https://auth.example.com
services:
  autentico:
    image: ghcr.io/eugenioenko/autentico:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:9999:9999"
    volumes:
      - autentico-data:/app/data
    env_file:
      - .env


volumes:
  autentico-data:

Add .env to .gitignore to avoid committing secrets.

Caddy reverse proxy

Section titled “Caddy reverse proxy”

Add a Caddy service for automatic HTTPS via Let’s Encrypt:

services:
  autentico:
    image: ghcr.io/eugenioenko/autentico:latest
    command: ["start", "--auto-setup", "--url", "https://auth.example.com"]
    restart: unless-stopped
    expose:
      - "9999"
    volumes:
      - autentico-data:/app/data


  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy-data:/data
    depends_on:
      - autentico


volumes:
  autentico-data:
  caddy-data:

Caddyfile:

auth.example.com {
    reverse_proxy autentico:9999
}

Upgrading

Section titled “Upgrading”
Terminal window
docker compose pull
docker compose up -d

Migrations are applied automatically on startup. Back up your data volume before upgrading.