---
title: "Authentik — Homelab Trade-offs and When to Remove It"
aliases: [authentik-homelab, authentik-sso, authentik-removal, authentik-npm-auth]
tags: [authentik, homelab, sso, npm, proxmox, lxc, selfhosted, security, oidc]
sources:
  - "daily/2026-04-27.md"
  - "daily/2026-05-03.md"
created: 2026-04-27
updated: 2026-05-03
---

# Authentik — Homelab Trade-offs and When to Remove It

Authentik is an open-source identity provider that adds SSO, OAuth2, and forward-proxy authentication to self-hosted services. In a homelab context it requires ~500 MB RAM and has a complex multi-container stack (server + worker + PostgreSQL + Redis). It is only worth running if SSO is genuinely configured for each service it protects — if services fall back to their native login pages, Authentik adds overhead without meaningful security benefit.

## Key Points

- **Authentik v2026.2.2 broke on migration `0056`** — the field `Role.filter(group_id=...)` was renamed; upgrading from an older version triggers this migration failure and prevents the stack from starting
- **RAM overhead: ~500 MB** per running instance — significant in a homelab with limited RAM (6–8 GB total)
- **Authentik is only justified if SSO is configured per service** — if protected services still show their own login form via NPM's `auth_request`, Authentik provides minimal protection
- **NPM `auth_request` removal** is the critical step when decommissioning — every proxy host that had Authentik auth must be individually updated; forget one and it blocks the service
- **Native service logins (Dozzle, AdGuard, Backrest, IT-Tools, Uptime Kuma) are sufficient** for homelab services accessible only via VPN or internal DNS

## Details

### The Migration Failure (v2026.2.2)

Authentik 2026.2.2 introduced an ORM change that renamed a Role filter field. On first startup after upgrade, Django migrations run automatically — migration `0056` fails because the old field name no longer exists in the codebase, but the migration assumes it does.

```
authentik-server | django.db.utils.ProgrammingError: column "group_id" does not exist
authentik-server | Error occurred during database migration — aborting startup
```

The stack cannot start in this state. Options:
1. Downgrade Authentik to the last working version before `0056`
2. Restore from a database backup taken before the upgrade
3. Remove Authentik entirely if the SSO value doesn't justify the repair effort

### Decision Criteria: Keep vs Remove

| Condition | Keep Authentik | Remove Authentik |
|-----------|---------------|-----------------|
| SSO configured in each protected service | ✓ | — |
| Services support OIDC natively | ✓ | — |
| Multiple users with different access levels | ✓ | — |
| Services fall back to native login via `auth_request` | — | ✓ |
| Only 1–2 users (homelab owner) | — | ✓ |
| RAM is constrained (<8 GB total) | — | ✓ |
| Services accessible only via VPN/internal DNS | — | ✓ |

For a single-user homelab where services are accessible only via Tailscale VPN or internal DNS, native service logins provide adequate security without the complexity of an identity provider.

### NPM `auth_request` Removal

When Authentik protects services via Nginx Proxy Manager's forward-proxy auth feature, each proxy host has an extra configuration block pointing to Authentik's outpost URL. Removing Authentik requires visiting each protected proxy host in NPM and disabling `auth_request`:

**NPM Proxy Host → Advanced Tab → Custom Nginx Configuration** — remove the block similar to:
```nginx
auth_request /akprox/auth/nginx;
error_page 401 = @akprox-signin;
location @akprox-signin {
    return 302 https://auth.internal.domain/akprox/sign_in?rd=$scheme://$http_host$request_uri;
}
```

This must be done for every protected proxy host — if missed, NPM attempts to reach Authentik's outpost (which no longer exists) and returns 401 for all requests to that service. Services affected in the 2026-04-27 removal: AdGuard, Backrest, Actual Budget, IT-Tools, Uptime Kuma — 5 services across 9 NPM proxy hosts with the configuration.

### Dozzle Native Auth Fallback

Dozzle (a Docker container log viewer) was previously behind Authentik forward-proxy auth without its own login. When Authentik is removed, Dozzle becomes unauthenticated. The fix: enable Dozzle's built-in user authentication.

In Dozzle's Docker Compose environment:
```yaml
services:
  dozzle:
    environment:
      DOZZLE_AUTH_PROVIDER: simple
    volumes:
      - ./users.yml:/data/users.yml
```

`users.yml` defines users and bcrypt-hashed passwords. This replaces the Authentik forward-proxy with Dozzle's own session management.

### OIDC Configuration Cleanup After Removal

Apps that were configured to use Authentik as an OIDC provider (OAuth2/OpenID Connect) keep their OIDC configuration even after Authentik is deleted. Unlike NPM's `auth_request` (which fails loudly with 401), OIDC misconfiguration typically manifests as a broken login flow — the app redirects to `auth.ai-impress.com` which no longer exists, and the user sees a connection error.

**Apps that need OIDC cleanup after Authentik removal:**

| App | Where to disable OIDC |
|-----|----------------------|
| Vaultwarden | Admin Panel → General Settings → OIDC section → disable or clear provider URL |
| Paperless-ngx | `docker-compose.yml` → remove `PAPERLESS_SOCIALACCOUNT_PROVIDERS` env var |
| Karakeep | Settings → Authentication → SSO/OIDC → disable |

**Signs that OIDC cleanup is needed:**
- Login page shows a "Sign in with SSO" button that errors
- App redirects to `auth.ai-impress.com` on login attempt
- Error: "failed to fetch OIDC discovery document" in app logs

After removing OIDC config, restart the container so the app re-reads its config. Users previously created via OIDC (with no local password) may need a password reset or manual re-creation.

### Authentik vs Simpler Alternatives

For homelab SSO that is lighter than Authentik:

| Solution | RAM | Complexity | OIDC | Forward Proxy |
|----------|-----|------------|------|---------------|
| Authentik | ~500 MB | High | ✓ | ✓ |
| Authelia | ~50 MB | Medium | ✓ | ✓ |
| Pocket ID | ~20 MB | Low | ✓ (limited) | ✗ |
| Native logins | 0 MB overhead | None | — | — |

Authelia is the recommended replacement if centralized auth is still needed — significantly lighter RAM footprint, simpler stack (no separate worker process), and still supports forward-proxy authentication with NPM.

## Related Concepts

- [[wiki/concepts/homarr-proxmox-integration]] — Homarr and NPM configuration in the same homelab
- [[wiki/concepts/adguard-dns-rewrites-homelab]] — internal DNS for homelab services that Authentik was protecting
- [[wiki/concepts/proxmox-container-502-misdiagnosis]] — 502 errors from NPM are similar to what happens when auth_request misconfigured
- [[wiki/concepts/tailscale-dns-homelab]] — the VPN layer that provides access control without an identity provider

## Sources

- [[daily/2026-04-27.md]] — Authentik 2026.2.2 failed on migration `0056`; decided to remove rather than repair; `auth_request` removed from all 9 NPM proxy hosts; Dozzle switched to native simple auth; 5 services now use their own logins
- [[daily/2026-05-03.md]] — After Authentik removal, Vaultwarden, Paperless, and Karakeep still had OIDC config pointing to `auth.ai-impress.com`; apps must be manually cleaned up after the identity provider is gone
