Authelia

Authentication and authorization companion for reverse proxies

oss-osi-approved planned guide featured

Overview

Authelia provides SSO and 2FA in front of reverse-proxied apps. Popular in homelab and small business self-hosted stacks protecting admin UIs.

At a glance

Field	Value
Categories	`identity-sso`, `security-compliance`
Deployment	`self-hosted`
License class	oss-osi-approved (`Apache-2.0`)
Cost model	`free-self-hosted`
Implementation difficulty	`moderate`
Maintenance burden	`medium`
Maturity	`stable`
Verification	`partially-verified` (2026-07-17)

Cost reality

Free software; pairs with Traefik/NGINX/Caddy.

Pricing and free-tier limits change frequently; re-check official pricing before budget decisions.

Tasks reduced or augmented

Software does not replace community or ops staff. It may reduce or augment:

SSO portal for internal apps
2FA enforcement

Human oversight still needed

Config complexity
Bypass path risks

Data held

users
sessions
auth logs
Personal data: yes
Payment data: no / not primary

Risks

Area	Notes
Vendor lock-in	Evaluate export formats and API completeness before deep customization.
Security	Apply updates promptly; restrict admin access; enable TLS.
Compliance	Operator remains responsible for privacy and local regulatory obligations.
Licensing	Confirm license fits commercial coworking use.
Operational	Plan backups, monitoring, and a restore drill before production use.

Coworking fit

Roles: technical-operator

Workflows: access-provisioning, compliance-review

Problems: secure-door-access, self-host-for-data-control, privacy-compliance

Smallest useful experiment

Protect Portainer and Uptime Kuma with Authelia + 2FA for admin users only.

Typical time to first value: 1–3 days

Implementation guide

A routable implementation guide is not currently published.

Verification

Seed entry compiled from official project sites and repositories. Re-verify pricing, license text, and feature claims before production decisions. Star counts and free-tier numeric limits intentionally omitted unless verified at review time.