OutlineWiki Authentik OIDC PKCE & Workspace RBAC Runbook
Hostinger KVM NVMe
OutlineWiki 8GB pick (90,000 IOPS) — KVM 4 (4 vCPU / 16GB DDR5 / 200GB NVMe)
InterServer Price-Lock KVM & ZFS
Low-RTT node for outline Node.js + Hocu (19 ms CRDT sync)
UltaHost Dedicated EPYC VDS
Steady OutlineWiki secondary tier (25–100 collaborative editors)
Authentik replaces per-user SaaS SSO tax with a 512 MB self-hosted container.
SaaS wiki vendors frequently lock SAML and OIDC SSO behind enterprise tiers costing $18/seat/mo or more.
On OutlineWiki, we recommend pairing Outline with Authentik OIDC using Authorization Code + PKCE, which requires 512 MB of dedicated IdP RAM and removes per-user identity licensing completely.
OutlineWiki Reference Configuration for Authentik OIDC PKCE & Group Sync
OIDC_CLIENT_ID=outline-wiki-prod
OIDC_CLIENT_SECRET=replace-with-authentik-secret
OIDC_AUTH_URI=https://sso.example.internal/application/o/authorize/
OIDC_TOKEN_URI=https://sso.example.internal/application/o/token/
OIDC_USERINFO_URI=https://sso.example.internal/application/o/userinfo/
OIDC_USERNAME_CLAIM=preferred_username
OIDC_DISPLAY_NAME=Authentik SSO
OIDC_SCOPES=openid profile emailOutlineWiki Implementation Checklist: Authentik OIDC PKCE & Group Sync
Phase 1: Authentik OIDC PKCE & Group Sync
Create an OAuth2/OpenID Provider in Authentik with redirect URI https://wiki.example.internal/auth/oidc.callback.
Phase 2: Authentik OIDC PKCE & Group Sync
Enable Strict Redirect URI matching and select RS256 signing key inside Authentik provider advanced settings.
Phase 3: Authentik OIDC PKCE & Group Sync
Budget 512 MB RAM for Authentik server + worker containers alongside the core OutlineWiki 2,966 MB stack.
Phase 4: Authentik OIDC PKCE & Group Sync
Test first login in an incognito browser session and verify email domain allowlisting before disabling magic-link email login.
OutlineWiki Infrastructure Recommendation for Authentik OIDC PKCE & Group Sync
Always retain one break-glass local admin email during initial OIDC cutover.
Our sizing formula on OutlineWiki confirms that Outline + Authentik OIDC + MinIO + PostgreSQL + Redis for 40 editors consumes ~3,478 MB total RAM, leaving over 4 GB of headroom on Hostinger KVM 2 ($11.99/mo promo).
OutlineWiki Hardware Ledger: NVMe Throughput vs Base Price
Packet-to-Disk Path for outline Node.js + Hocuspocus Yjs CRDT + OIDC on OutlineWiki
[+] Key Infrastructure Pros
- Keeps outline.env buffers stable at 100 collaborative editors via 8GB compute.
- Protects 19 ms CRDT sync objectives under heavy Postgres tsvector document graph + MinIO assets writes (90,000 IOPS).
- Trims OutlineWiki 3-year infrastructure bills 70%–85% versus metered SaaS seats.
[-] Operational Constraints
- Unlocking $10.49/mo on Hostinger KVM NVMe depends on annual commitment rather than 1m billing.
- Base OS templates need outline.env tuning (WEB_CONCURRENCY=4 & COLLABORATION_MAX_CLIENTS=150) before peak load.
Deploy This OutlineWiki Stack If
- DevOps squads standardizing outline Node.js + Hocuspocus Yjs CRDT + OIDC (100 collaborative editors) on KVM nodes.
- Builders needing root access to set WEB_CONCURRENCY=4 & COLLABORATION_MAX_CLIENTS=150 in outline.env.
When To Choose Alternatives
- Two-day load tests where InterServer Price-Lock KVM & ZFS pay-per-hour beats annual commitments.
- Mandates requiring vendor-staffed 24/7 NOC contracts with zero SSH access.
$10.49/mo