Production setup.

[Roiki11]

I've been evaluating authentik for a while but all the setups in the documentation are just single container setups.
And single containers do not a production setup make so my question is what is the recommended method for building a production grade, highly available system? Also seeing as authentik releases quite frequently, is the way to update always to go from version to version in sequence or can you take jumps?

Any documentation for this would be appreciated.

[rissson]

We are already looking into improving the documentation regarding this, but in short:

• upgrades should be done to the latest patch version of the next release. So if you are on 2024.12.3, upgrade to 2024.12.5, then 2025.2.4 and then 2025.4.1 (latest as of today).
• the authentik-server and authentik-worker containers are stateless, so you can scale those horizontally as necessary, thus making them highly available. The state is then stored in postgres and redis, I would refer you to those tools respective documentation for how to run production setups.

[Roiki11]

Yes, I know the containers themselves are stateless but how about redis and postgres? I saw multiple issues regarding redis HA and no documentation or information regarding what's supported and what's not.

And also according to this(#12041 (comment)) you're slowly moving away from redis? So how long will that be a requirement requirement?

Also is postgres the only supported database now and in the future? I see your aws example uses RDS, so how about other cloud databases like Azure database for Postgresql, edb and Google cloud sql will also work? How about other "postgres compatible" databases like Aurora, alloydb or yugabyte?

Some form of reference implementation would be nice. If only for demonstration purposes.

[rissson]

So how long will that be a requirement requirement?

Probably about 6-12 months. Internally we're using https://github.com/DandyDeveloper/charts/tree/master/charts/redis-ha

Also is postgres the only supported database now and in the future?

That's correct. We have customers using GCP SQL. Supported features we currently require are adivsory locks, NOTIFY and triggers

[Roiki11]

Thank you for the information.

I'm trying to understand how a potential redis outage would affect a deployment and since you're moving away from it, how extensively it is used. You have a configuration options for session storage backend. What about channel layer and broker settings? They have url settings but what can be used here?

[rissson]

In the latest version it's used for tasks and websocket channels. We don't support any fancy redis protocol like sentinel, and we are not spending time on it as redis is going away.