diff --git a/group_vars/authentik/main.yml b/group_vars/authentik/main.yml
new file mode 100644
index 0000000..ad4503f
--- /dev/null
+++ b/group_vars/authentik/main.yml
@@ -0,0 +1,2 @@
+---
+zitadel_domain: auth.cosmosim.dev
diff --git a/group_vars/authentik/vault.yml b/group_vars/authentik/vault.yml
new file mode 100644
index 0000000..c38f854
--- /dev/null
+++ b/group_vars/authentik/vault.yml
@@ -0,0 +1,17 @@
+$ANSIBLE_VAULT;1.1;AES256
+63613964316265656364663039376361383531303836336337623534643938353932363232383339
+6434626239646435323934633235303735346663356461380a656637356330393661383638636535
+34633838303366396431373863393531383465623362643161613461646433303737633939646261
+3234646165616532650a313465366666653561643865323664323233333634616463636364326166
+64626162623932373734333839333538353130663036346233623666323834666139626331383032
+62303836656364366364663730386363306139623366633466643432393132343564316236666366
+32396531336562366333316634363237623561393361363535333338386639373530383562636166
+63313131343665343866353466356531646333313930663738353262633963616265373230636133
+63333066373064366132653664376639343939663335316662646633353730333763333236323932
+38373333383132316633376663336530323038646538663464303238626538633336386536333732
+64613532336466383739656166653335626630376663373535643162383130336132373239323465
+36656336323331383332333361333935646363373034316265613264396132383331353437303464
+32323136653737656135653064363465666464396264393831313436396663313136316133343530
+65653762323364373038356663623235326439346434303935643762636266663538333363653863
+61386166366462333665326266393966366263663035633232383034386634303161616335383732
+32633536646438303936
diff --git a/host_vars/cosmosim.dev/main.yml b/host_vars/cosmosim.dev/main.yml
new file mode 100644
index 0000000..8eb94f1
--- /dev/null
+++ b/host_vars/cosmosim.dev/main.yml
@@ -0,0 +1,2 @@
+---
+mailhost_is_local: true
diff --git a/inventory.yml b/inventory.yml
index 774aab1..857a64c 100644
--- a/inventory.yml
+++ b/inventory.yml
@@ -1,5 +1,8 @@
 [prod]
 cosmosim.dev
 
+[authentik]
+cosmosim.dev
+
 [gitea]
 cosmosim.dev
diff --git a/roles/authentik/defaults/main.yml b/roles/authentik/defaults/main.yml
new file mode 100644
index 0000000..b6c4fe5
--- /dev/null
+++ b/roles/authentik/defaults/main.yml
@@ -0,0 +1,5 @@
+---
+authentik_db_name: authentik
+authentik_db_user: authentik
+
+authentik_tag: 2026.8.3
diff --git a/roles/authentik/handlers/main.yml b/roles/authentik/handlers/main.yml
new file mode 100644
index 0000000..367d87c
--- /dev/null
+++ b/roles/authentik/handlers/main.yml
@@ -0,0 +1,10 @@
+---
+- name: Restart authentik-server
+  runit:
+    name: authentik-server
+    state: restarted
+
+- name: Restart authentik-worker
+  runit:
+    name: authentik-worker
+    state: restarted
diff --git a/roles/authentik/tasks/main.yml b/roles/authentik/tasks/main.yml
new file mode 100644
index 0000000..dcc62a3
--- /dev/null
+++ b/roles/authentik/tasks/main.yml
@@ -0,0 +1,117 @@
+---
+- name: Install dependencies for authentik
+  xbps:
+    pkg:
+      - podman
+      - python3-dnspython
+      - python3-psycopg2
+    state: present
+
+- name: add dns entry
+  community.general.nsupdate:
+    key_name: "ansible"
+    key_secret: "{{ dns_tsig_key }}"
+    key_algorithm: "hmac-sha512"
+    server: "127.0.0.1"
+    zone: "cosmosim.dev"
+    record: "{{ zitadel_domain }}."
+    type: "CNAME"
+    value: "{{ inventory_hostname }}."
+    state: present
+
+- name: Create authentik user
+  ansible.builtin.user:
+    name: authentik
+    state: present
+    createhome: true
+
+- name: Create postgres role
+  community.postgresql.postgresql_user:
+    name: "{{ authentik_db_user }}"
+    state: present
+    password: "{{ authentik_db_pass }}"
+  become: true
+  become_user: postgres
+
+- name: Create postgres database
+  community.postgresql.postgresql_db:
+    name: "{{ authentik_db_name }}"
+    owner: "{{ authentik_db_user }}"
+    state: present
+  become: true
+  become_user: postgres
+
+- name: Create podman network
+  containers.podman.podman_network:
+    name: authentik
+  become: true
+  become_user: authentik
+
+- name: Create runtime directory
+  ansible.builtin.file:
+    path: /home/authentik/{{ item }}
+    owner: authentik
+    group: authentik
+    mode: "0775"
+    state: directory
+  with_items:
+    - data
+    - certs
+    - custom-templates
+
+- name: Upload configuration
+  ansible.builtin.template:
+    src: templates/conf.j2
+    dest: /etc/authentik.env
+    owner: root
+    group: authentik
+    mode: "0640"
+  notify:
+    - Restart authentik-server
+    - Restart authentik-worker
+
+- name: Install Service (1/3)
+  ansible.builtin.file:
+    path: /etc/sv/{{item}}
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  with_items:
+    - authentik-server
+    - authentik-server/log
+    - authentik-worker
+    - authentik-worker/log
+
+- name: Install Service (2/3)
+  ansible.builtin.template:
+    src: authentik.run.j2
+    dest: /etc/sv/authentik-{{ item }}/run
+    owner: root
+    group: root
+    mode: "0755"
+  notify:
+    - Restart authentik-server
+    - Restart authentik-worker
+  with_items:
+    - worker
+    - server
+
+- name: Install Service (3/3)
+  ansible.builtin.template:
+    src: "log.run.j2"
+    dest: "/etc/sv/{{ item }}/log/run"
+    owner: root
+    group: root
+    mode: "0755"
+  with_items:
+    - authentik-server
+    - authentik-worker
+
+- name: Enable services
+  runit:
+    name: "{{ item }}"
+    enabled: true
+  with_items:
+    - authentik-server
+    - authentik-worker
diff --git a/roles/authentik/templates/authentik.run.j2 b/roles/authentik/templates/authentik.run.j2
new file mode 100644
index 0000000..6226539
--- /dev/null
+++ b/roles/authentik/templates/authentik.run.j2
@@ -0,0 +1,20 @@
+#!/bin/sh
+exec 2>&1
+export HOME=/home/authentik
+
+exec chpst -u authentik:authentik -C $HOME \
+  podman run -it --rm --sig-proxy \
+    --name=authentik-{{ item }} \
+    --env-file=/etc/authentik.env \
+{% if item == "server" %}
+    -p 9000:9000 \
+{% endif %}
+{% if mailhost_is_local is defined and mailhost_is_local %}
+    --add-host={{ mail_host }}:host-gateway \
+{% endif %}
+    --network=authentik \
+    -v ./data:/data \
+    -v ./certs:/certs \
+    -v ./custom-templates:/templates \
+    --mount type=bind,src=/tmp/.s.PGSQL.5432,target=/tmp/.s.PGSQL.5432 \
+    ghcr.io/goauthentik/server:{{ authentik_tag }} {{ item }}
diff --git a/roles/authentik/templates/conf.j2 b/roles/authentik/templates/conf.j2
new file mode 100644
index 0000000..01415ef
--- /dev/null
+++ b/roles/authentik/templates/conf.j2
@@ -0,0 +1,19 @@
+AUTHENTIK_POSTGRESQL__HOST=/tmp
+AUTHENTIK_POSTGRESQL__NAME={{ authentik_db_name }}
+AUTHENTIK_POSTGRESQL__PASSWORD={{ authentik_db_pass }}
+AUTHENTIK_POSTGRESQL__USER={{ authentik_db_user }}
+AUTHENTIK_SECRET_KEY={{ authentik_secret_key }}
+
+# SMTP server
+AUTHENTIK_EMAIL__HOST={{ mail_host }}
+AUTHENTIK_EMAIL__PORT=465
+# Optionally authenticate (don't add quotation marks to your password)
+AUTHENTIK_EMAIL__USERNAME=auth@cosmosim.dev
+AUTHENTIK_EMAIL__PASSWORD={{ authentik_mail_pass }}
+# STARTTLS / explicit TLS, usually on port 587
+AUTHENTIK_EMAIL__USE_TLS=false
+# Implicit TLS/SSL on the SMTP connection (`USE_SSL` is the variable name), usually on port 465
+AUTHENTIK_EMAIL__USE_SSL=true
+AUTHENTIK_EMAIL__TIMEOUT=10
+# Sender email address; verify that the domain is valid.
+AUTHENTIK_EMAIL__FROM=auth@cosmosim.dev
diff --git a/roles/authentik/templates/log.run.j2 b/roles/authentik/templates/log.run.j2
new file mode 100644
index 0000000..07e6f04
--- /dev/null
+++ b/roles/authentik/templates/log.run.j2
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec vlogger -t {{ item }}
diff --git a/site.yml b/site.yml
index b208d06..579c082 100644
--- a/site.yml
+++ b/site.yml
@@ -1,4 +1,13 @@
 ---
+- hosts: prod
+  become: yes
+  become_method: sudo
+  become_user: root
+  roles:
+    - authentik
+  tags:
+    - authentik
+
 - hosts: gitea
   become: yes
   become_method: sudo