Why We Ditched Auth0: Complete Guide to Self-Hosting Modern Identity (Authentik, Zitadel & Keycloak)
Authentication and Identity Access Management (IAM) is one of the quickest ways SaaS bills explode. What starts as a convenient free tier on Auth0, Okta, or Clerk suddenly escalates to $200–$2,000+/month once your Monthly Active Users (MAUs) climb, or when enterprise clients demand SAML Single Sign-On (SSO) and custom domains.
In 2026, the open-source identity ecosystem has completely matured. You no longer need a dedicated identity team to run enterprise-grade SSO, OIDC, SAML, Passkeys (WebAuthn), and granular Role-Based Access Control (RBAC).
Here is an architectural breakdown and production Docker Compose blueprint for self-hosting your identity provider for under €4 to €15/month on a standard cloud VPS.
The True Cost of Proprietary Auth: SaaS vs Self-Hosted
| Feature / Scale | Auth0 (Enterprise) | Clerk / WorkOS | Self-Hosted Authentik / Zitadel |
|---|---|---|---|
| 5,000 MAUs | ~$240/mo | ~$150/mo | €4.50/mo (VPS) |
| 50,000 MAUs | ~$1,200+/mo | ~$800+/mo | €14.28/mo (VPS) |
| Enterprise SAML / SSO | Enterprise Plan ($$$$) | Add-on ($$$) | Included free |
| Custom Domains & Branding | High-tier lock-in | Pro plan | Unlimited & Free |
| Data Sovereignty (GDPR) | Restricted EU region | US-dependent or costly | 100% on your own server |
Interactive TCO Calculator & Deep Comparison: SelfHostStack Auth0 Alternatives & Architecture
Top 3 Modern Self-Hosted Identity Solutions
1. Authentik (Best All-in-One for Devs & Homelab/Production)
- Strengths: Beautiful modern UI, flexible Python/Flow-based policy engine, built-in reverse proxy outpost for legacy apps, multi-factor auth (Passkeys, TOTP, SMS), OIDC/SAML/LDAP.
- Resource Footprint: 1.5 GB RAM minimum (PostgreSQL + Redis + Worker + Server).
2. Zitadel (Best Cloud-Native, Multi-Tenant SaaS Backend)
- Strengths: Written in Go, extreme performance, built-in B2B multi-tenancy (organizations within organizations), CockroachDB / PostgreSQL backend, modern event-sourcing architecture.
- Resource Footprint: ~500 MB RAM (Single Go binary + DB).
3. Keycloak (The Enterprise Battle-Tested Standard)
- Strengths: Red Hat backed, gold standard in banking/government, deepest compliance certifications, vast plugin ecosystem.
- Resource Footprint: ~2 GB RAM (Java/Quarkus runtime).
Production Blueprint: Authentik with Docker Compose
Below is a tested, hardened Docker Compose configuration to deploy Authentik behind Traefik or Caddy on an Ubuntu VPS (e.g. Hetzner CX22 or CPX21).
docker-compose.yml
version: '3.8'
services:
postgresql:
image: docker.io/library/postgres:16-alpine
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
start_period: 20s
interval: 10s
timeout: 5s
retries: 5
volumes:
- authentik_db:/var/lib/postgresql/data
environment:
POSTGRES_PASSWORD: ${PG_PASS:?database password required}
POSTGRES_USER: ${PG_USER:-authentik}
POSTGRES_DB: ${PG_DB:-authentik}
networks:
- internal
redis:
image: docker.io/library/redis:alpine
command: --save 60 1 --loglevel warning
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
start_period: 20s
interval: 10s
timeout: 5s
retries: 5
volumes:
- authentik_redis:/data
networks:
- internal
server:
image: ghcr.io/goauthentik/server:2024.8.3
restart: unless-stopped
command: server
environment:
AUTHENTIK_REDIS__HOST: redis
AUTHENTIK_POSTGRESQL__HOST: postgresql
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
volumes:
- authentik_media:/media
- authentik_custom_templates:/templates
ports:
- "127.0.0.1:9000:9000"
- "127.0.0.1:9443:9443"
depends_on:
postgresql:
condition: service_healthy
redis:
condition: service_healthy
networks:
- internal
- web
worker:
image: ghcr.io/goauthentik/server:2024.8.3
restart: unless-stopped
command: worker
environment:
AUTHENTIK_REDIS__HOST: redis
AUTHENTIK_POSTGRESQL__HOST: postgresql
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
volumes:
- authentik_media:/media
- authentik_certs:/certs
- authentik_custom_templates:/templates
depends_on:
postgresql:
condition: service_healthy
redis:
condition: service_healthy
networks:
- internal
volumes:
authentik_db:
authentik_redis:
authentik_media:
authentik_custom_templates:
authentik_certs:
networks:
internal:
web:
external: true
Environment File (.env)
Generate secrets using openssl:
PG_PASS=$(openssl rand -base64 36)
AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60)
5 Security Best Practices When Self-Hosting Auth
- Automate Postgres Snapshots: Back up your database with encryption to an offsite S3-compatible storage (e.g. Hetzner Storage Box or Cloudflare R2).
- Enforce WebAuthn / Passkeys: Enable FIDO2/Passkey hardware authentication by default for administrators.
-
Isolate Network Exposure: Never bind Postgres or Redis ports to
0.0.0.0. Only expose ports9000or9443via a reverse proxy with TLS termination. -
Rate Limiting & Fail2Ban: Place Cloudflare or Caddy rate limiting in front of
/flows/executor/default-authentication-flow/to stop credential stuffing. - Continuous Health Checks: Monitor uptime and certificate validity with an open-source tool like Uptime Kuma or GlitchTip.
Recommended Hardware & Hosting
- Hetzner Cloud CX22 / CPX21: 2 vCPU, 4GB RAM (€3.79 - €7.05/mo) in Nuremberg/Falkenstein (EU) or Ashburn/Hillsboro (USA).
- Check our comprehensive VPS Hosting Benchmark & Buyer Guide for full network latency and performance comparisons.
Conclusion
Self-hosting auth doesn't just save thousands in SaaS licensing fees; it gives your team 100% control over customer data, compliance, and user lifecycles.
Explore over 170+ open-source stacks, Docker scripts, and ROI comparisons on SelfHostStack.
Top comments (0)