Identity in a Box
(IIB)
One-command SSO for your self-hosted stack. Authentik, PostgreSQL, Redis, and a Grafana dashboard — wired together and ready.
Every self-hosted tool wants its own login. Twenty services, twenty password resets, twenty places to revoke access when someone leaves. IIB packages Authentik as a one-command deploy so the rest of your stack can authenticate against a single identity provider — OIDC, OAuth2, SAML, whatever your tools speak.
⚡ Quick Start
git clone https://github.com/matijazezelj/iib.git && cd iib
make up # copies .env.example, generates secrets, starts everything
That’s it. On first run, make up copies .env.example to .env and auto-generates the secrets you’d otherwise be tempted to set to password123 — AUTHENTIK_SECRET_KEY, AUTHENTIK_BOOTSTRAP_TOKEN, POSTGRES_PASSWORD. You don’t touch those. Optional overrides (external URL, ports, sync interval) live in .env if you want to tune them.
Open the Authentik admin interface at http://localhost:9080 and finish initial setup. The bundled Grafana ships at http://localhost:3004.
🧠 Why Self-Hosted Identity Matters
Self-hosted identity is one of those things you don’t realize you need until you have it. Then you wonder how you ever lived without it.
| Without an IdP | With IIB |
|---|---|
| Separate users in every tool | One user, one password, one MFA |
| Offboarding = hunt down 20 accounts | Disable in Authentik, done |
| Inconsistent MFA enforcement | Enforce MFA centrally |
| No audit trail of who logged in where | Full login + session audit log |
| Sharing accounts because “it’s easier” | Real per-user access |
IIB doesn’t reinvent the wheel — Authentik is one of the best open-source IdPs out there. IIB just packages it with sensible defaults, a metrics pipeline, and integrations for the rest of the XIB suite.
🛡️ What You Get
| Component | Technology | Purpose |
|---|---|---|
| Identity Provider | Authentik server | OIDC, OAuth2, SAML, LDAP |
| Worker | Authentik worker | Background tasks, policy evaluation |
| Database | PostgreSQL 16 | User store, sessions, audit log |
| Cache | Redis 7 | Session and task queue cache |
| Metrics collector | iib-monitor | Polls the Authentik API every SYNC_INTERVAL_MINUTES (default 15) and pushes metrics |
| Metrics storage | VictoriaMetrics (port 8432) | Authentik metrics time-series |
| Visualization | Grafana (port 3004) | Pre-built iib-grafana dashboard |
All wired through a single docker-compose.yml. No external dependencies, no managed cloud, no monthly bill that goes up when you add users.
🌐 Endpoints
| Service | Port | URL |
|---|---|---|
| Authentik (HTTP) | 9080 | http://localhost:9080 |
| Authentik (HTTPS) | 9443 | https://localhost:9443 |
| Authentik admin | 9080 | http://localhost:9080/if/admin/ |
| Grafana | 3004 | http://localhost:3004 |
| VictoriaMetrics | 8432 | http://localhost:8432 |
Put AUTHENTIK_EXTERNAL_URL behind your reverse proxy of choice (Caddy, Traefik, HAProxy), then apply the access controls, backup policy, and hardening required by your environment.
🔗 XIB Integration
This is where IIB earns its place in the suite. Out of the box, IIB wires SSO for every XIB tool that needs it.
make setup-sso
That setup command:
| Target | What It Does |
|---|---|
| VIB Grafana | Creates OIDC application + provider, configures Grafana auth |
| TIB Grafana | Same for Trivy Image Bandit |
| CIB Grafana | Same for Compliance in a Box |
| PIB Grafana | Same for PKI in a Box |
| PIB step-ca | Registers IIB as the OIDC provisioner for cert issuance |
After make setup-sso, log in to any XIB tool with your Authentik account. Disable a user in Authentik and they lose access everywhere instantly. No more “did we revoke their CIB access?” anxiety.
How step-ca uses IIB
PIB ships an internal CA (step-ca) for issuing certificates to internal services. With IIB wired in, step-ca uses Authentik as the OIDC provisioner — meaning cert requests are authenticated against your central identity, with full audit trail of who asked for what cert.
📊 The IIB Dashboard
The bundled Grafana dashboard (iib-grafana) gives you operational visibility into Authentik itself:
- Health — Server and worker uptime, error rates
- Users — Active users, recent signups, locked accounts
- Sessions — Active sessions, login attempts, MFA usage
- Policy — Policy evaluations, denials, performance
- PostgreSQL — Connections, slow queries, replication lag
Because IIB ships its own VictoriaMetrics, you get all this without leaning on your main observability stack — and metrics survive container restarts.
🔧 Configuration Reference
make up auto-generates the secrets on first run — you only edit .env if you want to override defaults. The variables you might actually care about:
| Variable | Default | Purpose |
|---|---|---|
AUTHENTIK_SECRET_KEY |
auto-generated | Application secret. Do not set manually. |
AUTHENTIK_BOOTSTRAP_TOKEN |
auto-generated | Initial admin API token. Do not set manually. |
POSTGRES_PASSWORD |
auto-generated | PostgreSQL password. Do not set manually. |
AUTHENTIK_EXTERNAL_URL |
http://localhost:9080 |
Public URL (used for OIDC issuer, redirects) — set this when you put IIB behind a real domain |
AUTHENTIK_PORT_HTTP |
9080 |
Host port for Authentik HTTP |
AUTHENTIK_PORT_HTTPS |
9443 |
Host port for Authentik HTTPS |
GRAFANA_PORT |
3004 |
Host port for Grafana |
VICTORIAMETRICS_PORT |
8432 |
Host port for VictoriaMetrics |
SYNC_INTERVAL_MINUTES |
15 |
How often iib-monitor polls the Authentik API for metrics |
.env.example ships with everything documented inline. The generated secrets land in .env on first make up and persist across restarts — don’t regenerate them unless you want every existing session and OIDC client to break.
🏢 Who This Is For
- Homelab operators running 10+ self-hosted services who are tired of password manager bloat
- Small teams who want real SSO without paying Okta prices
- DevSecOps engineers who need an audit trail of who accessed what, when
- Anyone running XIB — IIB is the glue that makes the suite feel like one product instead of four
Who This Is NOT For
- Organizations that need enterprise SSO with SLAs and a support phone number
- Teams already running Keycloak / Authelia / Zitadel happily — Authentik is great but switching IdPs is a project
- Anyone hoping for a one-click “magic” identity solution. Identity is inherently fiddly. IIB makes it as painless as it gets, but you’ll still configure providers and policies
📄 License
Apache 2.0 License — use it, modify it, build on it.
Ready to centralise your identity?
View on GitHub🚀 Need Help Getting Started?
Self-hosting is free and always will be. But if you'd rather have it deployed, configured, and maintained for you — I can help.