---
type: reference
description: "The three core Authentik containers — database, server and worker — with their units, images, roles and probes."
tags:
  - infrastructure
  - authentik
  - postgres
timestamp: 2026-10-19
---

# Authentik Processes

The three core containers of the [[Authentik]] stack on Dankclaw. The two
outpost units are not covered here — they live on [[Authentik]] and
[[Authentik Outpost Reference]]. Server and worker run the same image; the
`command` selects the role (`server` / `worker`). Data persists under
`/home/dank/Containers/authentik/` as bind mounts (repo policy — no named
volumes), moved from `/home/dank/authentik/` in the 2026-09-01 quadlet
standardization; the retired stubs this page replaces recorded the pre-move
paths `/home/dank/authentik/data` (server and worker) and
`/home/dank/authentik/postgres` (database).

## authentik-postgres

The PostgreSQL 16 database for Authentik — the only stateful store in the stack
(users, flows, sessions, events). Sessions, caching, and WebSockets moved to
PostgreSQL in 2025.10 (Redis removed).

- **Image:** `docker.io/library/postgres:16-alpine`
- **Data:** `/home/dank/Containers/authentik/postgres` (bind mount; no named
  volumes)
- **Health:** `pg_isready -d authentik -U authentik`
- **Retired wording:** the stub called this a "Compose service … in
  `dankclaw/compose.yaml`"; the compose stack is gone and the unit is a quadlet.
- The side-by-side with `gitea-postgres` (network, published ports, secret
  source, boot persistence) is owned by [[Postgres]].

## authentik-server

The Authentik server — the core, the admin API, and the embedded Caddy outpost.
It also serves the login page at `https://auth.franksdank.cloud`.

- **Unit:** `dankclaw/authentik/quadlet/authentik-server.container`
  (`authentik-server.service`)
- **Image:** `ghcr.io/goauthentik/server:2026.8.3` (`command: server`)
- **Port:** `9000` (published) — the outpost, the admin API and the login UI all
  live here
- **Data:** `/home/dank/Containers/authentik/data` (bind mount, shared with the
  worker)
- **Health:** recorded by the retired stub as
  `http://localhost:9000/-/health/`; superseded — [[Authentik]] → Operations
  owns the live probe.
- **Retired wording:** the stub described "the Caddy `forward_auth` vhosts"
  proxying here; the chain Caddy actually runs is [[Authentik]] → Caddy
  integration.

## authentik-worker

The Authentik worker — background tasks: event processing, provider
synchronization, scheduled flows, and certificate renewal.

- **Unit:** `dankclaw/authentik/quadlet/authentik-worker.container`
  (`authentik-worker.service`)
- **Image:** `ghcr.io/goauthentik/server:2026.8.3` (`command: worker`)
- **Runs as:** `0:0` (rootless: container root maps to the host user that owns
  the data dir)
- **Data:** `/home/dank/Containers/authentik/data` (bind mount, shared with the
  server)
- **No port** — the worker has no HTTP endpoint.

## Cross-references

- [[Authentik]] — what the service is, its deployment, wiring, operations and
  failure modes
- [[Authentik Outpost Reference]] — provider, flow and token configuration
- [[Postgres]] — both PostgreSQL clusters on Dankclaw, side by side