Authelia: Single Sign-On for Your Entire Self-Hosted Stack

Managing separate logins for ten self-hosted applications creates three problems: users reuse passwords across applications, onboarding takes an hour per person, and offboarding is a guessing game of which accounts were disabled and which were forgotten. Authelia solves all three by putting a single authentication layer in front of every application.

What Authelia Does

Authelia is an open-source authentication and authorisation server that integrates with reverse proxies (Nginx, Traefik, Caddy). When a user tries to access any protected application, Authelia intercepts the request and checks whether they are authenticated. If not, it shows a login page. After login, Authelia forwards them to the application. The application never sees a password. It trusts Authelia's verification.

This means one login works for every application in your stack. Nextcloud, EspoCRM, Mattermost, Outline, Vaultwarden, Grafana, and Uptime Kuma all protected behind the same authentication. Your team remembers one password. You manage one account per person.

Setup in 30 Minutes

1. Deploy Authelia via Docker: The official Docker image starts with a single docker-compose.yml. Configure the domain, the session secret, and the user database.
2. Configure your reverse proxy: Add the Authelia configuration to your Nginx Proxy Manager or Traefik config. For each application you want to protect, add a single line referencing Authelia.
3. Create users and groups: Define users and groups in Authelia's configuration file or connect Authelia to an LDAP server. Assign access policies: which groups can access which applications.
4. Enable two-factor authentication: Authelia supports TOTP, WebAuthn, and Duo. Require 2FA for all users or only for specific groups.

Access Control by Group

Authelia's real power is group-based access control. The finance team can access the CRM and the accounting system. The development team can access the project management and the wiki. Managers can access the admin panels. Contractors can access only the tools they need for their project. One group membership change controls access to every application simultaneously.

When someone leaves, disable their Authelia account. They lose access to every application in your stack instantly. No lingering accounts on individual applications. No forgetting to disable their CRM login. No guessing whether their email account is still active. One action, complete offboarding.

Password Reset That Does Not Require IT Support

Authelia includes a self-service password reset flow. Users enter their email, receive a reset link, choose a new password, and log in. This eliminates the most common IT support request without requiring a helpdesk ticket.

For businesses that need it, Authelia also supports password policies: minimum length, required character types, password expiry, and password history. These can be configured globally or per group. Compliance requirements that mandate password rotation can be enforced automatically.

Multi-Factor Authentication That Sticks

The biggest obstacle to MFA adoption is friction. Authelia reduces friction by supporting multiple methods: TOTP (Google Authenticator and Authy compatible), WebAuthn (fingerprint readers, YubiKeys), and Duo push notifications. Users choose the method they prefer. The security team requires that at least one method is enabled.

Authelia also supports per-application MFA requirements. Your email might require MFA every login. Your wiki might require MFA once per week. The monitoring dashboard might not require MFA at all. This flexibility means security is appropriate to the sensitivity of the data, not uniformly burdensome.

VPS1 deploys Authelia as the authentication layer for every managed stack. We configure SSO, group-based access control, and enforced two-factor authentication. One login, every application, zero weak passwords.