Authentik

Authentik is the identity provider — the single sign-on that other services trust instead of keeping their own logins. Sign in once; every federated service knows who you are.

It runs as Authentik-Business in the Basement, the most protected zone, issuing SSO for both worlds: the Workplace under Alpha and the Commons under Beta. A second instance, Authentik-Den, serves the Den’s Sovereign-Life side on its own VPSs, kept separate by the same two-world boundary that divides everything else. Authentik-Business also projects a forward-auth outpost into the Lounge — the auth check at the gate that lets certified members operate on Range forks (the gate’s topology lives in Systems, guard). That outpost is an extension of Business, not a third directory of its own.