This page explains the technical access/security flow behind public services. Authentik provides identity, while CrowdSec and Cloudflare enforce protection at the edge.
User onboarding is documented in Account Access.
authentik-server and authentik-workerdatabases stack| Component | Role |
|---|---|
| Cloudflare | Public DNS, certificate DNS challenge provider, and external edge filtering. |
| Traefik | Swarm ingress router, TLS termination, HTTP/HTTPS entrypoints, and middleware chain attachment. |
| CrowdSec | Behavior-based protection integrated with Traefik through the CrowdSec bouncer plugin. |
| Authentik | Identity provider and forward-auth layer for services that require centralized login. |
Lab network if Traefik needs to reach it.| Symptom | Likely cause |
|---|---|
| Infinite redirects | Provider/outpost mismatch, bad callback URL, or stale browser session. |
| Login succeeds but app denies access | Missing group, app-side permission, or wrong upstream user mapping. |
| Public hostname gives 404 | Traefik router rule or service label mismatch. |
| Service works internally but not externally | Cloudflare, firewall, Traefik entrypoint, or middleware chain issue. |
| Only one user is blocked | Authentik group membership or app-local account mapping. |