On-Premises Deployment
AuthNull can run entirely inside your own infrastructure, as a Docker Compose stack on a single Linux server. This guide takes you from an empty server to a working tenant, after which you choose which product to try: Active Directory, Database, RADIUS, or PAM MFA.
Index
| Step | Guide | What you do |
|---|---|---|
| 1 | Prerequisites | Check the server, network access, and accounts you need |
| 2 | Installation | Get the deployment files, configure .env, install Docker, and start the stack |
| 3 | Network Access: Domain or IP | Publish the stack through Nginx, on a domain with SSL or on the server's IP address |
| 4 | Organization and Tenant Setup | Create the organization and validate the tenant |
| 5 | Choose a Product | Sign in, choose an MFA provider, and try Active Directory, Database, RADIUS, or PAM MFA |
| - | Troubleshooting | Known installation and sign-in problems |
Architecture
AuthNull's backend is a single consolidated service, authnull-service. Users, tenants, policies, Active Directory, databases, PAM, RADIUS, and MFA all run in this one application, replacing the separate microservices of earlier versions.
All traffic enters through Nginx on the host. Nginx serves the Admin UI and the end-user console, and sends API calls to authnull-service. The containers share a private Docker network (authnull); apart from the Admin UI, the end-user console, and the backend API, every container is published on the host's loopback address only.
When a sign-in needs a decision - for example a database login through ProxySQL - it goes to authn-service, which matches it against your policies and, if MFA is required, sends a push through the organization's MFA provider.
Components
Application
| Container | Purpose | Host port |
|---|---|---|
| authnull-service | The AuthNull backend - one consolidated application for users, tenants, policies, AD, databases, PAM, RADIUS, and MFA | 8080 |
| did-react | Admin UI | 5173 |
| self-service-console | End-user sign-in and self-service console (/ssc/) | 3000 |
| authn-service | Authentication decisions and push MFA, called by ProxySQL and other gateways | 127.0.0.1:2882 |
| authnz | Session authorization for API calls | 127.0.0.1:6066 |
Infrastructure
| Container | Purpose | Host port |
|---|---|---|
| postgres | PostgreSQL 16, the primary database | 127.0.0.1:5432 |
| did-schema-init | One-off job: creates the schema and runs migrations, then exits | - |
| redis | Cache, sessions, and MFA state | 127.0.0.1:6379 |
| cassandra | Data store (with the one-off cassandra-init job) | 127.0.0.1:9042 |
Installed on the Host
| Component | Purpose |
|---|---|
| Nginx | Reverse proxy for the UI and API |
| Product agents | Installed later, per product - for example the database agent and ProxySQL for Database MFA |