How to Install Authentik on Your UGREEN NAS

by

How to Install Authentik on Your UGREEN NAS

Authentik is an open-source and self-hosted identity provider designed to unify authentication, authorization, and access management across multiple applications through a centralized single sign-on experience. The platform functions as a privacy-focused alternative to commercial cloud identity providers by allowing users to host and control their data on private infrastructure. It supports major modern and legacy authentication standards including OpenID Connect, SAML, LDAP, RADIUS, and SCIM to bridge communication between diverse systems. In this step by step guide I will show you how to install AuthentikĀ on your UGREEN NAS using Docker & Dockhand.

šŸ’”Note: This guide works perfectly with the latest Authentik v2026.8.0 release.

šŸ’”Note: Check out my guide on how to Install Authentik on Your Synology NAS.

  • STEP 1

Please Support My work by Making a Donation.

  • STEP 2

InstallĀ Dockhand using my step by step guide. If you already have Dockhand installed on your UGREEN NAS, skip this STEP. Attention: Make sure you have installed the latest Dockhand version.

  • STEP 3

āš ļøMandatory: Enable HTTPS on your UGREEN NAS.

  • STEP 4

Create a new hostname on the noip website using your noip account. For example, I have created mariusentikĀ as Host and I use the free ddns.net domain. In the IP Address area, type in your own IPV4 IP address from your ISP, then click Create. Follow the instructions in the image below.

Authentik UGREEN NAS Set up 1

  • STEP 5

āš ļøMandatory: Add Read & Write Permissions to the Docker Folder.

  • STEP 6

Go toĀ Files and open the docker folder. Inside the docker folder, create one new folder and name itĀ authentik. Follow the instructions in the image below.
Note: Be careful to enter only lowercase, not uppercase letters.

Authentik UGREEN NAS Set up 2

  • STEP 7

Now create five new folders inside the authentik folder that you have previously created at STEP 6 and name them certs, data, db, redis, templates. Follow the instructions in the image below.
Note: Be careful to enter only lowercase, not uppercase letters.

Authentik UGREEN NAS Set up 3

  • STEP 8

Follow my step by step guide on how to activate SMTP for your Gmail account. This step is mandatory. Note: If you don’t want to use the easiest way for SMTP with Google and you already have SMTP details from your own Mail Server, you can just skip this STEP and use your personalized email SMTP details instead.

  • STEP 9

Open your browser and type in http://ugreen-ip-address:3866 to connect to your Dockhand container. On the left sidebar, click Stacks then + Create. Follow the instructions in the image below.

Authentik UGREEN NAS Add Stack

  • STEP 10

In the Stack name field, type in authentik. āš ļøWarning: Type in the name in lowercase letters. The installation process can take up to a few seconds/minutes. It will depend on your Internet speed connection. Follow the instructions in the image below.

Note: Copy Paste the code below in the Dockhand Compose Stack then click Create & Start.

services:
  db:
    image: postgres:18-alpine
    container_name: Authentik-DB
    user: 999:10
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "pg_isready", "-q", "-d", "authentik", "-U", "authentikuser"]
      timeout: 45s
      interval: 10s
      retries: 10
    environment:
      POSTGRES_DB: authentik
      POSTGRES_USER: authentikuser
      POSTGRES_PASSWORD: authentikpass
    volumes:
      - /volume1/docker/authentik/db:/var/lib/postgresql:rw
    restart: on-failure:5

  redis:
    image: redis:7-alpine
    container_name: Authentik-CACHE
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping || exit 1"]
    environment:
      REDIS_PASSWORD: mariushosting
    volumes:
      - /volume1/docker/authentik/redis:/data:rw
    command: ["redis-server", "--requirepass", "mariushosting"]
    restart: on-failure:5

  server:
    image: ghcr.io/goauthentik/server:2026.8
    container_name: Authentik-SERVER
    environment:
      AUTHENTIK_POSTGRESQL__HOST: db
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentikuser
      AUTHENTIK_POSTGRESQL__PASSWORD: authentikpass
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_REDIS__PASSWORD: mariushosting
      AUTHENTIK_SECRET_KEY: dOxZYTTZgXKMHkqLBIQVImayQXAVWdzGBPuFJKggzcgvgPJPXpWzqzKaUOIOGGIr
      AUTHENTIK_BOOTSTRAP_PASSWORD: mariushosting
      AUTHENTIK_EMAIL__HOST: smtp.gmail.com
      AUTHENTIK_EMAIL__USERNAME: Your-own-gmail-address
      AUTHENTIK_EMAIL__PASSWORD: Your-own-app-password
      AUTHENTIK_EMAIL__FROM: Your-own-gmail-address
      AUTHENTIK_HOST: mariusentik.ddns,net
      AUTHENTIK_WEB__BASE_URL: mariusentik.ddns.net
      COLORBT_SHOW_HIDDEN: 1
    ports:
      - 9700:9000
      - 9743:9443
    volumes:
      - /volume1/docker/authentik/data:/data:rw
      - /volume1/docker/authentik/templates:/templates:rw
    command: server
    depends_on:
      db:
        condition: service_healthy
    restart: on-failure:5

  worker:
    image: ghcr.io/goauthentik/server:2026.8
    container_name: Authentik-WORKER
    user: 0:0
    environment:
      AUTHENTIK_POSTGRESQL__HOST: db
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentikuser
      AUTHENTIK_POSTGRESQL__PASSWORD: authentikpass
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_REDIS__PASSWORD: mariushosting
      AUTHENTIK_SECRET_KEY: dOxZYTTZgXKMHkqLBIQVImayQXAVWdzGBPuFJKggzcgvgPJPXpWzqzKaUOIOGGIr
      AUTHENTIK_BOOTSTRAP_PASSWORD: mariushosting
      AUTHENTIK_EMAIL__HOST: smtp.gmail.com
      AUTHENTIK_EMAIL__USERNAME: Your-own-gmail-address
      AUTHENTIK_EMAIL__PASSWORD: Your-own-app-password
      AUTHENTIK_EMAIL__FROM: Your-own-gmail-address
      AUTHENTIK_HOST: mariusentik.ddns.net
      AUTHENTIK_WEB__BASE_URL: https://mariusentik.ddns.net
      COLORBT_SHOW_HIDDEN: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /volume1/docker/authentik/data:/data:rw
      - /volume1/docker/authentik/certs:/certs:rw
      - /volume1/docker/authentik/templates:/templates:rw
    command: worker
    depends_on:
      db:
        condition: service_healthy
    restart: on-failure:5

Note: Before you paste the code above in the Stack editor area below, change the value numbers for user with your own UID and GID values. (Follow my step by step guide on how to do this.) 999 is my personal UID value and 10Ā is my personal GID value. You have to type in your own values.
Note: Before you paste the code above in the Stack editor area below, change the values for REDIS_PASSWORDĀ and AUTHENTIK_REDIS__PASSWORD. Check the orange colors in the code. mariushosting is an example for a redis password. The password should be the same for REDIS_PASSWORD, AUTHENTIK_REDIS__PASSWORD and in the redis command part.
Note: Before you paste the code above in the Stack editor area below, change the value for AUTHENTIK_SECRET_KEY. (Generate your own Random 64 length AUTHENTIK_SECRET_KEY.)
Note: Before you paste the code above in the Stack editor area below, change the value for AUTHENTIK_BOOTSTRAP_PASSWORD. mariushosting is an example for a password. You will need this password later at STEP 17.
Note: Before you paste the code above in the Stack editor area below, change the value for AUTHENTIK_EMAIL__USERNAMEĀ and type in your own Gmail address. STEP 8.
Note: Before you paste the code above in the Stack editor area below, change the value for AUTHENTIK_EMAIL__PASSWORDĀ and type in your own Gmail app password. STEP 8. āš ļøWarning: Do NOT confuse with your own Gmail password. This is the Gmail APP password.
Note: Before you paste the code above in the Stack editor area below, change the value for AUTHENTIK_EMAIL__FROMĀ and type in your own Gmail address. STEP 8.
Note: Before you paste the code above in the Stack editor area below, change the value for AUTHENTIK_HOST and type in your own NO IP DDNS withoutĀ https:// at the beginning that you have previously created at STEP 4.
Note: Before you paste the code above in the Stack editor area below, change the value for AUTHENTIK_WEB__BASE_URL and type in your NO
IP DDNS withĀ https:// at the beginning that you have previously created at STEP 4.

Authentik UGREEN NAS Set up 4

  • STEP 11

If everything goes right, you will see the following message at the bottom right of your screen: ā€œCreated stack “authentik”ā€œ.

Ugreen NAS stack success

  • STEP 12

Open your Nginx Proxy Manager container that you have previously installed at STEP 3. Click Add Proxy Host. A new pop up window will open. Add the following details:

Domain Names: Type in your own noip domain name that you have previously created at STEP 4.
Scheme: http
Forward Hostname/IP: Type in the local NAS IP of your UGREEN NAS.
Forward Port: Type in the Authentik local Port that is 9700
Check Block Common Exploits
Check Websockets Support
Click the SSL tab. Follow the instructions in the image below.

Authentik UGREEN NAS Set up 5

  • STEP 13

After you click the SSL tab, add the following details:

SSL Certificate: Request a new SSL Certificate
Check: Force SSL
Check: HSTS Enabled
Check: HTTP/2 Support
Click Save. Follow the instructions in the image below.

Authentik UGREEN NAS Set up 6

  • STEP 14

In the Proxy Hosts area, if everything goes right, you will see that your hostname has been generated. Click on it. Follow the instructions in the image below.

Authentik UGREEN NAS Set up 7

  • STEP 15

šŸŸ¢Please Support My work by Making a Donation. Almost 99,9% of the people that install something using my guidesĀ forget to support my work, or justĀ ignoreĀ STEP 1. Iā€™ve been very honest about this aspect of my work since the beginning: I donā€™t run any ADS, I donā€™t require subscriptions, paid or otherwise, I donā€™t collect IPs, emails, and I donā€™t have any referral links from Amazon or other merchants. I also donā€™t have any POP-UPs or COOKIES. I have repeatedly been told over the years how much I have contributed to the community. Itā€™s something I love doing and have been honest about my passion since the beginning. But I also Need The Community to Support me Back to be able to continue doing this work.

  • STEP 16

Now open your browser and type in your HTTPS/SSL certificate like this https://yourname.ddns.netĀ that you have previously created at STEP 4. In my case it’s https://mariusentik.ddns.net If everything goes right, you will see the Authentik Login page. Type in akadmin as the default username, then click Log in. Follow the instructions in the image below.

āš ļøWarning: the default Username is akadmin

Authentik UGREEN NAS Set up 8

  • STEP 17

Type in your own AUTHENTIK_BOOTSTRAP_PASSWORD that you have previously added at STEP 10. Click Continue. Follow the instructions in the image below.

Authentik UGREEN NAS Set up 9

  • STEP 18

At the top right of the page, click Admin interface. Follow the instructions in the image below.

Authentik UGREEN NAS Set up 10

  • STEP 19

On the left sidebar, under System, click Settings. In the Base URL area, type in your own domain name or NO IP DDNSĀ with https:// at the beginning. Switch ON the following options:

  • Allow users to change name
  • Allow users to change email
  • Allow users to change username

Click Save changes. Follow the instructions in the image below.

Authentik UGREEN NAS Set up 11

  • STEP 20

At the top right of the page, click the gear icon. Change your default Username and Email with your own credentials then click Save. Follow the instructions in the image below.

Authentik UGREEN NAS Set up 12

  • STEP 21

Your Authentik Admin Dashboard at a glance! Click Create new application to add your first app.

Authentik UGREEN NAS Set up 13

Enjoy Authentik on your UGREEN NAS!

šŸ†˜TROUBLESHOOTING

šŸ†™Note/Update/Container: How to Update Your Docker Containers on UGREEN NAS Using Dockhand.
šŸ³Note: How to Create Docker Shortcuts on Desktop.
šŸ†•Note: How to Update Dockhand to the latest version.
šŸ†•Note: How to Clean Docker.

This post was updated on Sunday / August 30th, 2026 at 11:45 PM

No sponsors, no corporations, no ads, no subscriptions, no membership tiers, no referral links, no pop-ups, no cookies, no tracking code. Just pure guides for the community from Marius.