Air-gapped environments

authentik can operate without internet access, including with an air-gapped Enterprise license. License installation and validation are performed locally and do not require an internet connection.

If you require an air-gapped authentik license, please let us know during the purchasing process.

Use this guide alongside the Docker Compose or Kubernetes installation instructions. Prepare the resources on a connected system, transfer them into your environment, and configure authentik before starting it.

Prepare installation resources

Choose an authentik release and obtain its deployment files and container images on a system with internet access. Use the same authentik version for the server, worker, and outposts, and choose images that support your hosts' CPU architecture.

Container images

Mirror the images into an internal registry, or transfer image archives and load them onto the hosts that will run them.

Component	Image	When needed
Server and worker	ghcr.io/goauthentik/server	Every installation; both services use the same image
PostgreSQL	The image specified by your Compose file or database deployment	When deploying PostgreSQL in a container
LDAP outpost	ghcr.io/goauthentik/ldap	When using an LDAP outpost
Proxy outpost	ghcr.io/goauthentik/proxy	When using a separate proxy outpost; the embedded outpost runs in the server
RAC outpost	ghcr.io/goauthentik/rac	When using Remote Access Control
RADIUS outpost	ghcr.io/goauthentik/radius	When using a RADIUS outpost

The authentik images are also available on Docker Hub under authentik/. Include any additional images used by your deployment, such as an ingress controller or a database operator.

Docker Compose file

Download the target release's compose.yml file using the installation guide or release notes. Transfer it into the air-gapped environment. Check every service's image value, including PostgreSQL, when preparing your mirrors.

Helm chart

Download the chart from https://charts.goauthentik.io on a connected system:

helm repo add authentik https://charts.goauthentik.io
helm repo update
helm pull authentik/authentik --version <chart-version>

Replace <chart-version> with the chart version for your chosen release. Transfer the resulting authentik-<chart-version>.tgz archive into the air-gapped environment, or publish it to an internal chart repository. Include the images required by any enabled chart dependencies, such as PostgreSQL.

Configure authentik

Complete the secrets, database, and networking settings in your installation guide, then apply the settings below before the first startup. The examples use registry.company as an internal registry; replace it with your registry and replace <authentik-version> with the exact image tag you mirrored.

Docker Compose

Add these settings to .env:

AUTHENTIK_IMAGE=registry.company/authentik/server
AUTHENTIK_TAG=<authentik-version>
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=registry.company/authentik/%(type)s:%(version)s
AUTHENTIK_DISABLE_STARTUP_ANALYTICS=true
AUTHENTIK_DISABLE_UPDATE_CHECK=true
AUTHENTIK_ERROR_REPORTING__ENABLED=false

AUTHENTIK_IMAGE changes the server and worker image. Update the PostgreSQL service's image in compose.yml to its mirrored location as well.

Kubernetes

Merge these settings into your values.yaml file, keeping the secrets, database, and ingress settings from the installation guide:

global:
    image:
        repository: registry.company/authentik/server
        tag: "<authentik-version>"

authentik:
    outposts:
        container_image_base: registry.company/authentik/%(type)s:%(version)s
    disable_startup_analytics: true
    disable_update_check: true
    error_reporting:
        enabled: false

Configure mirrored images for any enabled chart dependencies separately. Ensure that all cluster nodes can pull from your internal registry.

For managed Docker outposts, use an internal registry that the Docker host can pull from. The outpost controller pulls images when creating containers; preloading an archive alone is not sufficient. If you distribute images only as archives, deploy the outposts manually.

The container_image_base setting controls images for managed outposts. An outpost's own container_image setting overrides it. Check existing overrides, and configure manually deployed outposts to use the mirrored images too. See outpost configuration.

Outbound connections

The settings above disable update checks, startup analytics, and error reporting. Avatars require a separate change in the Admin interface after installation.

Destination	Purpose	How to disable
https://version.goauthentik.io	Periodic update checks	Set disable_update_check to true
https://goauthentik.io	Anonymous startup analytics	Set disable_startup_analytics to true
https://authentik.error-reporting.a7k.io	Error reporting, when enabled	Set error_reporting.enabled to false; it is opt-in, but the installation guides enable it
https://www.gravatar.com	Avatar checks by authentik and image loads by the browser	Set Avatars to initials in System settings

The events map includes a bundled basemap and needs no external tile server. If you set Map tiles under System > Brands, use an internally reachable tile source or clear the setting to restore the bundled map.

Review the services and URLs used by your configuration as well. External identity providers, CAPTCHA services, notification webhooks, and remotely hosted logos or backgrounds need network access from authentik or the user's browser. Use services and assets available inside your environment.

Start authentik

Docker Compose

If you use an internal registry, pull the mirrored images and start the services:

docker compose pull
docker compose up -d

If you transfer image archives, load them on the Docker host first and make sure their tags match the image references in compose.yml. Then run docker compose up -d.

Kubernetes

Install from the transferred chart archive and your configured values:

helm upgrade --install authentik ./authentik-<chart-version>.tgz -f values.yaml

Complete the initial setup from your installation guide. In the Admin interface, open System settings and set Avatars to initials to stop authentik and browsers from requesting Gravatar images.

Install an Enterprise license

authentik always validates Enterprise licenses locally, including in connected deployments. You do not need an online activation step, a licensing proxy, or an outbound firewall exception.

1. In the air-gapped authentik Admin interface, navigate to Enterprise > Licenses and copy Your Install ID.
2. On a system with internet access, obtain a license key for that Install ID from the Customer Portal or the authentik team.
3. Transfer the license key into the air-gapped environment using your organization's file transfer process.
4. On Enterprise > Licenses, click Install, paste the key into License key, and submit the form.
5. Check Current license status, the user capacity, and the expiry date on the Licenses page.

Only the system accessing the Customer Portal needs internet access. The authentik deployment can remain disconnected throughout the process.

For renewals or capacity changes, retrieve and transfer the replacement key, then update the installed license. License expiry and user capacity rules also apply offline; see license enforcement.

Upgrades

Review the target version's release notes and back up your deployment before upgrading. Download the updated Compose file or Helm chart on a connected system and mirror all required images for the target release, including any changed supporting-service images.

Transfer the resources, update your image references and version tags, and run the commands in Start authentik. Follow the required upgrade sequence and any additional migration instructions in the release notes. Keep the outbound-connection settings and internal registry configuration when merging a new Compose file or chart values.

With automatic update checks disabled, check the release notes from a connected system to keep track of new releases and security fixes.

Network requirements

An air-gapped installation still needs connectivity between its internal services. Allow the connections used by your deployment:

Required ports

• Browsers, applications, and outposts must reach the authentik server, normally on HTTPS port 443 through a reverse proxy or ingress. The server's default container ports are 9000 for HTTP and 9443 for HTTPS.
• The server and worker must reach PostgreSQL, normally on port 5432.
• Email delivery needs access to your configured SMTP server, commonly on port 25, 465, or 587.
• Configured storage, directory servers, applications, and other integrations must be reachable on their respective ports.

Outpost-specific ports

Every outpost must reach the authentik URL configured in AUTHENTIK_HOST, preferably over HTTPS. Allow clients to reach the outposts and outposts to reach their upstream services:

• LDAP outposts listen on container ports 3389 and 6636, commonly published as 389 and 636 for LDAP and LDAPS.
• Proxy outposts listen on container ports 9000 and 9443 and need access to the applications they proxy.
• RAC outposts need access to target devices over the configured remote access protocol. They do not require published inbound ports.
• RADIUS outposts listen on UDP port 1812.

See the outpost documentation for deployment and configuration details.