On-Premises Deployment
AuthNull can run entirely inside your own infrastructure, as a Docker Compose stack on a single Linux server. This guide takes you from an empty server to a working tenant, after which you choose which product to try: Active Directory, Database, RADIUS, or PAM MFA.
Index
| Step | Guide | What you do |
|---|---|---|
| 1 | Prerequisites | Check the server, network access, and accounts you need |
| 2 | Installation | Get the deployment files, configure .env, install Docker, and start the stack |
| 3 | Network Access: Domain or IP | Publish the stack through Nginx, on a domain with SSL or on the server's IP address |
| 4 | Organization and Tenant Setup | Create the organization and validate the tenant |
| 5 | Choose a Product | Sign in, choose an MFA provider, and try Active Directory, Database, RADIUS, or PAM MFA |
| - | Troubleshooting | Known installation and sign-in problems |
Architecture
AuthNull's backend is a single consolidated service, authnull-service. Users, tenants, policies, Active Directory, databases, PAM, RADIUS, and MFA all run in this one application, replacing the separate microservices of earlier versions.
All traffic enters through Nginx on the host. Nginx serves the Admin UI and the end-user console, and sends API calls to authnull-service. The containers share a private Docker network (authnull, 10.250.0.0/24). By default every container port is also published on all of the host's interfaces - see Restrict the published ports to keep everything except Nginx off the network.
When a sign-in needs a decision - for example a database login through ProxySQL - it goes to authn-service, which matches it against your policies and, if MFA is required, sends a push through the organization's MFA provider.
Components
Application
| Container | Purpose | Host port |
|---|---|---|
| authnull-service | The AuthNull backend - one consolidated application for users, tenants, policies, AD, databases, PAM, RADIUS, and MFA | 8080 |
| did-react | Admin UI | 5173 |
| self-service-console | End-user sign-in and self-service console (/ssc/) | 3000 |
| authn-service | Authentication decisions and push MFA, called by ProxySQL and other gateways | 2882 |
| authnz | Session authorization for API calls | 6066 |
| secret-management-service | Credential retrieval | 9291 |
| log-service | Audit and access logs | 9255 |
Infrastructure
| Container | Purpose | Host port |
|---|---|---|
| postgres | PostgreSQL 16: the master database, plus one database per organization | 5432 |
| did-schema-init | One-off job: creates the schema and runs migrations, then exits | - |
| redis | Cache, sessions, and MFA state (password protected) | 6379 |
| cassandra | Data store (with the one-off cassandra-init job) | 9042 |
Installed on the Host
| Component | Purpose |
|---|---|
| Nginx | Reverse proxy for the UI and API |
| Product agents | Installed later, per product - for example the database agent and ProxySQL for Database MFA |