Setup

1. Add DNS records pointing docs.<domain> to the server:

   • A record: docs → <ipv4>
   • AAAA record: docs → <ipv6>

2. In Coolify, go to New Resource → Service, search for Outline, set the domain on the outline container (inside the container settings), then fill in the mail environment variables before deploying.

   Outline uses magic links for login — SMTP is required, not optional:

   Variable	Value
   SMTP_HOST	{{team.DEFAULT_SMTP_HOST}}
   SMTP_PORT	{{team.DEFAULT_SMTP_PORT}}
   SMTP_USERNAME	{{team.DEFAULT_SMTP_USERNAME}}
   SMTP_PASSWORD	{{team.DEFAULT_SMTP_PASSWORD}}
   SMTP_FROM_EMAIL	{{team.DEFAULT_SMTP_FROM}}
   SMTP_SECURE	false (port 587 uses STARTTLS, still encrypted)
   SMTP_NAME	a simple name without symbols (e.g. outline) — some mail providers reject the HELO command if this contains special characters

3. Deploy.

Authentik SSO

4. In Authentik, go to Applications → Providers → Create, choose OAuth2/OpenID Provider. Set a name, leave Client Type as Confidential, and add the redirect URI https://docs.<domain>/auth/oidc.callback. Save and note the Client ID and Secret.

5. Go to Applications → Applications → Create and link it to the provider from step 4. Note the application slug.

6. In Authentik, the default OpenID 'email' mapping does not include an email_verified claim, which Outline requires. Create a custom one:

   • Go to Customization → Property Mappings → Create → OAuth2/OpenID Provider (not OAuth Source)
   • Name it anything, set Scope name to email
   • Set the expression to:

     return {
         "email": request.user.email,
         "email_verified": True
     }

   • Save, then go back to the provider from step 4, add this mapping under Advanced protocol settings → Property Mappings, and remove the default OpenID 'email' mapping.

7. In the same Authentik provider, add a second redirect URI to allow post-logout redirect back to Outline:

   strict: https://docs.<domain>

8. In Coolify, set the following environment variables on the Outline container:

   Variable	Value
   OIDC_CLIENT_ID	from Authentik provider
   OIDC_CLIENT_SECRET	from Authentik provider
   OIDC_AUTH_URI	https://auth.<domain>/application/o/<slug>/authorize/
   OIDC_TOKEN_URI	https://auth.<domain>/application/o/<slug>/token/
   OIDC_USERINFO_URI	https://auth.<domain>/application/o/<slug>/userinfo/
   OIDC_DISPLAY_NAME	Authentik
   OIDC_SCOPES	openid profile email
   OIDC_LOGOUT_URI	https://auth.<domain>/application/o/<slug>/end-session/
   OIDC_ALLOWED_DOMAINS	(optional — leave unset to allow any domain)

   Restart the container after saving.