Authelia — Single Sign-On & 2FA for Your Homelab

What it is

Authelia is a self-hosted authentication and authorization server that adds single sign-on (SSO) and two-factor authentication (2FA) to any web application behind a reverse proxy. It supports TOTP, WebAuthn (hardware keys), passkeys, and push notifications for second factors. Authelia is OpenID Connect certified.

Authelia targets homelab users and small teams who run self-hosted applications (Grafana, Nextcloud, Gitea) and want unified login with strong authentication without paying for enterprise identity providers.

How it saves time or tokens

Authelia centralizes authentication for all your self-hosted services. Instead of configuring separate login systems for each application, users authenticate once with Authelia and get access to all authorized services. This reduces password fatigue and eliminates per-app 2FA setup.

Integration with reverse proxies (Nginx, Traefik, Caddy, HAProxy) means you add authentication to any application without modifying the application itself.

How to use

1. Deploy Authelia with Docker Compose:

services:
  authelia:
    image: authelia/authelia:4
    volumes:
      - ./config:/config
    ports:
      - 9091:9091
    environment:
      TZ: UTC

1. Configure Authelia in config/configuration.yml:

server:
  address: 'tcp://:9091'

authentication_backend:
  file:
    path: /config/users_database.yml

access_control:
  default_policy: deny
  rules:
    - domain: '*.example.com'
      policy: two_factor

session:
  domain: example.com
  secret: a-long-random-secret

1. Configure your reverse proxy to forward authentication requests to Authelia.

Example

Nginx configuration for Authelia-protected services:

server {
    server_name grafana.example.com;

    location /authelia {
        internal;
        proxy_pass http://authelia:9091/api/verify;
        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
    }

    location / {
        auth_request /authelia;
        auth_request_set $user $upstream_http_remote_user;
        proxy_set_header Remote-User $user;
        proxy_pass http://grafana:3000;
    }
}

Related on TokRepo

• Self-hosted tools -- Self-hosted infrastructure and applications
• AI tools for security -- Security tools for authentication and access control

Common pitfalls

• Not securing the Authelia configuration file. It contains secrets for sessions, OIDC clients, and SMTP credentials. Set restrictive file permissions (600) and never commit secrets to git.
• Forgetting to configure SMTP for password reset and 2FA enrollment emails. Without email, users cannot recover accounts or complete WebAuthn enrollment.
• Using file-based user storage for large teams. The file backend works for small deployments but switch to LDAP for teams with more than 20 users.