authentik/authentik/lib/default.yml

# update website/docs/installation/configuration.mdx
# This is the default configuration file
postgresql:
  host: localhost
  name: authentik
  user: authentik
  port: 5432
  password: "env://POSTGRES_PASSWORD"
  use_pgbouncer: false
  use_pgpool: false

listen:
  listen_http: 0.0.0.0:9000
  listen_https: 0.0.0.0:9443
  listen_ldap: 0.0.0.0:3389
  listen_ldaps: 0.0.0.0:6636
  listen_radius: 0.0.0.0:1812
  listen_metrics: 0.0.0.0:9300
  listen_debug: 0.0.0.0:9900
  trusted_proxy_cidrs:
    - 127.0.0.0/8
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - fe80::/10
    - ::1/128

redis:
  host: localhost
  port: 6379
  password: ""
  tls: false
  tls_reqs: "none"
  db: 0
  cache_timeout: 300
  cache_timeout_flows: 300
  cache_timeout_policies: 300
  cache_timeout_reputation: 300

paths:
  media: ./media

debug: false
remote_debug: false

log_level: info

error_reporting:
  enabled: false
  sentry_dsn: https://151ba72610234c4c97c5bcff4e1cffd8@authentik.error-reporting.a7k.io/4504163677503489
  environment: customer
  send_pii: false
  sample_rate: 0.1

# Global email settings
email:
  host: localhost
  port: 25
  username: ""
  password: ""
  use_tls: false
  use_ssl: false
  timeout: 10
  from: authentik@localhost
  template_dir: /templates

throttle:
  providers:
    oauth2:
      device: 20/hour
  default: 1000/second

outposts:
  # Placeholders:
  # %(type)s: Outpost type; proxy, ldap, etc
  # %(version)s: Current version; 2021.4.1
  # %(build_hash)s: Build hash if you're running a beta version
  container_image_base: ghcr.io/goauthentik/%(type)s:%(version)s
  discover: true
  disable_embedded_outpost: false

ldap:
  task_timeout_hours: 2
  page_size: 50
  tls:
    ciphers: null

reputation:
  expiry: 86400

cookie_domain: null
disable_update_check: false
disable_startup_analytics: false
avatars: env://AUTHENTIK_AUTHENTIK__AVATARS?gravatar,initials
geoip: "/geoip/GeoLite2-City.mmdb"

footer_links: []

default_user_change_name: true
default_user_change_email: false
default_user_change_username: false

gdpr_compliance: true
cert_discovery_dir: /certs
default_token_length: 60
impersonation: true

blueprints_dir: /blueprints

web:
  # No default here as it's set dynamically
  # workers: 2
  threads: 4

worker:
  concurrency: 2