The_Zen_Cow_Says_Mu

i’ve been running fedora server for my home stuff for several years. it version upgrades well without issues. The main drawback is the speed of updates, frequent kernel/nvidia reboots required, and having to upgrade the whole system to a new release every 6 months.

Inasmuch as I’ve migrated my entire hosting to rootless podman, I’m seriously planning on installing debian so I can just leave it alone.

authentik.pod
[Pod]
PodName=authentik
PublishPort=9000:9000
PublishPort=9443:9443
PublishPort=3389:3389
PublishPort=6636:6636

authenik_db.container
[Unit]
Description=authentik_db
Wants=network-online.target
After=network-online.target

[Service]
Restart=always


[Container]
EnvironmentFile=.env
Pod=authentik.pod
ContainerName=authentik_db
Image=docker.io/library/postgres:17-alpine
AutoUpdate=registry
Volume=authentik_db.volume:/var/lib/postgresql/data:Z
Environment=POSTGRES_USER=authentik
Environment=POSTGRES_DB=authentik

[Install]
WantedBy=default.target

authentik_server.container
[Unit]
Description=authentik_server
Wants=network-online.target
After=network-online.target

[Service]
Restart=always


[Container]
EnvironmentFile=.env
Pod=authentik.pod
ContainerName=authentik_server
Image=ghcr.io/goauthentik/server:2026.5
Exec=server
AutoUpdate=registry
Environment=AUTHENTIK_POSTGRESQL__HOST=authentik_db
Environment=AUTHENTIK_POSTGRESQL__USER=authentik
Environment=AUTHENTIK_POSTGRESQL__NAME=authentik
Volume=authentik_media.volume:/data/media:U,Z
Volume=authentik_data.volume:/data:U,Z
Volume=authentik_templates.volume:/templates:U,Z


[Install]
WantedBy=default.target

authentik_worker.container
[Unit]
Description=authentik_worker
Wants=network-online.target
After=network-online.target

[Service]
Restart=always


[Container]
EnvironmentFile=.env
Pod=authentik.pod
ContainerName=authentik_worker
Image=ghcr.io/goauthentik/server:2026.5
Exec=worker
AutoUpdate=registry
Environment=AUTHENTIK_POSTGRESQL__HOST=authentik_db
Environment=AUTHENTIK_POSTGRESQL__USER=authentik
Environment=AUTHENTIK_POSTGRESQL__NAME=authentik
Environment=AUTHENTIK_LISTEN__HTTP=[::]:9001
Environment=AUTHENTIK_LISTEN__METRICS=[::]:9301
Volume=authentik_media.volume:/data/media:U,Z
Volume=authentik_data.volume:/data:U,Z
Volume=authentik_templates.volume:/templates:U,Z
Volume=authentik_certs.volume:/certs:U,Z
Volume=/run/user/1000/podman/podman.sock:/var/run/docker.sock:z
[Install]
WantedBy=default.target

authentik_ldap.container
[Unit]
Description=authentik_ldap
Wants=network-online.target
After=network-online.target

[Service]
Restart=always


[Container]
Pod=authentik.pod
ContainerName=authentik_ldap
Image=ghcr.io/goauthentik/ldap:2026.5
AutoUpdate=registry
Environment=AUTHENTIK_HOST=https://authentik.mydomain.com/
Environment=AUTHENTIK_INSECURE="false"
Environment=AUTHENTIK_TOKEN=wowthisisquitethelongandsafetokenthatnoonewilleverhack
[Install]
WantedBy=default.target
````___`

I use authentik. It’s probably fairly easy to set up if you use their docker-compose, but I run it as rootless podman, which took a little work to get it converted to a quadlet pod. But now that it’s set up, it works great and handles a variety of self-hosted apps that use saml, oidc, ldap, and forward-auth. It’s one of the few options that handles all the different authentication types natively. I also set up passkeys and standard two-factor time codes.

There are some very helpful authentik youtube tutorials by Cooptonian.

i run it on opnsense. When my services were on individual subdomains each with their own certificate, they got hit a lot and crowdsec blocked lots of bots and scripts

I ultimately moved all my services to a wildcard sub-subdomain, and poof all the bots went away and now crowdsec doesn’t do much other than block port scanners which the firewall does anyway.

it’s not worth the hassle to uninstall though.

I’m currently testing out jellyfin. Have it through my reverse proxy and using the ldap authentication with authentik. Works fine and nice having two-factor authentication.

the only linuxserver containers I run are nextcloud and plex. both are running as rootful containers. I also tried their calibre-web container (no longer using it), which didn’t work as rootless, but worked fine as a rootful container.

many of the linuxserver containers don’t work rootless. i didn’t have luck when i tried it as a user service

I run nextcloud in a podman pod because I’m coocoo bananas that way. It uses authentik as an SSO provider using the nextcloud OIDC plugin. And I use the linuxserver.io container rather than the official nextcloud one because gosh darn it , it actually works

[Pod]
PodName=nextcloud
PublishPort=10443:443
PublishPort=9980:9980

Nextcloud-db.container

Description=db
Wants=network-online.target
After=network-online.target

[Service]
Restart=always

[Container]
Pod=nextcloud.pod
ContainerName=nextcloud-db
Image=docker.io/library/mariadb:11
AutoUpdate=registry
Volume=nextcloud-db.volume:/var/lib/mysql:Z
Environment=MARIADB_HOST=nextcloud
Environment=MARIADB_DATABASE=nextcloud
Environment=MARIADB_USER=nextcloud
Environment=MARIADB_PASSWORD=nextcloud
Environment=MARIADB_ROOT_PASSWORD=nextcloud

[Install]
WantedBy=default.target

Nextcloud-app.container

[Unit]
Description=Nextcloud
Wants=network-online.target
After=network-online.target

[Service]
Restart=always

[Container]
#Label=app=nextcloud
ContainerName=nextcloud-app
Pod=nextcloud.pod
Image=lscr.io/linuxserver/nextcloud:latest
AutoUpdate=registry
Volume=nextcloud-config.volume:/config:Z
#Volume=nextcloud-data.volume:/data:Z
Volume=/home/nextcloud/:/data:Z
Environment=TZ=America/New_York
Environment=PUID=1000
Environment=PGID=1000
#PublishPort=10443:443

[Install]
WantedBy=default.target

Nextcloud-office.container

[Unit]
Description=Nextcloud-office
Wants=network-online.target
After=network-online.target

[Service]
Restart=always

[Container]
#Label=app=nextcloud
ContainerName=nextcloud-office
Pod=nextcloud.pod
Image=docker.io/collabora/code:latest
AutoUpdate=registry
Environment=server_name=office.app.myserver.org
Environment=aliasgroup1="https://nextcloud.app.myserver.org/"
[Install]
WantedBy=default.target