VoidAuth — Self-Hosted Single Sign-On for Your Server Stack

Introduction

VoidAuth is a self-hosted authentication and single sign-on server designed for homelabs and small infrastructure. It acts as an OpenID Connect provider that sits in front of your web services, adding login gates and user management without modifying each application individually.

What VoidAuth Does

• Provides a central login portal for all your self-hosted web applications
• Issues OpenID Connect tokens that reverse proxies can validate
• Manages users and groups with a built-in web administration panel
• Supports two-factor authentication via TOTP for added security
• Integrates with Nginx, Traefik, and Caddy as an auth middleware

Architecture Overview

VoidAuth is a TypeScript application built with Next.js for the frontend and a Node.js backend. It implements the OpenID Connect provider specification, issuing JWTs that downstream reverse proxies verify via the forward-auth pattern. User and session data is stored in SQLite. The entire application runs in a single Docker container.

Self-Hosting & Configuration

• Deploy via Docker with a persistent volume for the SQLite database
• Set VOIDAUTH_SECRET to a strong random string for JWT signing
• Configure your reverse proxy (Traefik, Nginx) to forward auth requests to VoidAuth
• Register each protected application in the VoidAuth admin panel
• Enable TOTP-based two-factor authentication per user account

Key Features

• OpenID Connect compliant provider works with any OIDC-capable application
• Forward-auth pattern protects any web service behind Nginx, Traefik, or Caddy
• Built-in user management with groups and per-application access control
• TOTP two-factor authentication for enhanced account security
• Lightweight single-container deployment with SQLite storage

Comparison with Similar Tools

• Authelia — mature auth proxy with more features; VoidAuth is simpler to configure
• Authentik — full identity provider with flows; VoidAuth is lighter and faster to set up
• Keycloak — enterprise IAM platform; VoidAuth targets homelab-scale deployments
• TinyAuth — minimal auth middleware; VoidAuth adds full OIDC provider capabilities
• Zitadel — cloud-native identity; VoidAuth is designed for single-server self-hosting

FAQ

Q: Which reverse proxies does VoidAuth support? A: Traefik, Nginx, and Caddy are supported via the forward-auth middleware pattern.

Q: Can I use VoidAuth with applications that support OIDC natively? A: Yes. Register VoidAuth as the OIDC provider in any application that supports OpenID Connect login.

Q: Does VoidAuth support LDAP? A: VoidAuth uses its own built-in user database. LDAP integration is not currently supported.

Q: How do I back up VoidAuth? A: Back up the /data directory which contains the SQLite database and configuration.

Sources

• https://github.com/voidauth/voidauth