Dormancy Console

Dormancy Console is a self-hosted, read-only reporting service for authentik. It identifies groups that require review and provides directory reporting for users and groups.

Features

• Retrieves users and groups through the authentik API
• Handles paginated authentik API responses
• Classifies groups with no members, no enabled members, no recorded logins, or no recent logins
• Provides overview, users, and groups views
• Exports users, all groups, or a single group as CSV
• Does not modify authentik users, groups, sessions, or applications

Prerequisites

• Node.js 22 or later, or Docker Desktop
• A reachable authentik instance
• A dedicated authentik API token with read-only access to users and groups

Configuration

Create a local configuration file:

Copy-Item .env.example .env

Configure the following values:

Variable	Required	Default	Description
AUTHENTIK_URL	Yes	http://localhost:9000	Base URL of the authentik instance
AUTHENTIK_API_TOKEN	Yes	—	Dedicated read-only API token
DORMANT_DAYS	No	90	Days without sign-in activity before review is required
PORT	No	6767	Local listening port
HOST	No	127.0.0.1	Listening address
REPORT_CACHE_SECONDS	No	30	In-memory report cache duration

Example:

AUTHENTIK_URL=http://localhost:9000
AUTHENTIK_API_TOKEN=replace-with-read-only-token
DORMANT_DAYS=90
PORT=6767
HOST=127.0.0.1
REPORT_CACHE_SECONDS=30

Local development

pnpm start

Open http://localhost:6767.

Docker deployment

docker compose up --build -d

The supplied Compose configuration publishes the service only to 127.0.0.1:6767. Use an authenticated reverse proxy to expose the console to other users.

If authentik runs on the same Windows host as Docker Desktop, use the following value in .env:

AUTHENTIK_URL=http://host.docker.internal:9000

localhost inside the container refers to the container itself, not the Windows host.

Security guidance

• Store the token only in .env; the file is ignored by Git.
• Use a dedicated read-only token. Do not reuse an administrator token.
• Run the service on a trusted network.
• Use HTTPS and authentication at the reverse proxy when exposing the console.
• Do not include docker compose config output in shared logs because it can expand environment values.

HTTP endpoints

Endpoint	Purpose
/	Overview dashboard
/users	User directory view
/groups	Group directory view
/api/report	Report data for the dashboard
/api/refresh	Refresh the in-memory report cache
/api/users.csv	User CSV export
/api/groups.csv	Group CSV export; accepts ?group=<name>
/health	Service health response

Project structure

toolkit/
├── assets/       # Dashboard styles, browser logic, and icons
├── public/       # Dashboard document
├── src/          # API integration and HTTP server
├── .env.example  # Configuration template
├── Dockerfile
└── docker-compose.yml