Authelia + Nginx Proxy Manager: Self-Hosted SSO Setup

Authelia puts a single authentication layer in front of every application in your self-hosted stack. One username. One password. One two-factor authentication prompt. When someone leaves, you disable one account and they lose access to everything. Here is the complete setup.

Step 1: Create the Docker Compose File

services:
  authelia:
    image: authelia/authelia:latest
    container_name: authelia
    restart: unless-stopped
    volumes:
      - ./config:/config
    ports:
      - "127.0.0.1:9091:9091"
    environment:
      - TZ=Asia/Brunei

Step 2: Create the Authelia Configuration

Create ./config/configuration.yml:

theme: dark
jwt_secret: a_very_long_random_string_at_least_64_characters

default_redirection_url: https://auth.yourdomain.com

server:
  host: 0.0.0.0
  port: 9091

log:
  level: info

totp:
  issuer: yourdomain.com

authentication_backend:
  file:
    path: /config/users.yml
    password:
      algorithm: argon2id
      iterations: 1
      salt_length: 16
      parallelism: 8
      memory: 64

access_control:
  default_policy: deny
  rules:
    - domain: "auth.yourdomain.com"
      policy: bypass
    - domain: "*.yourdomain.com"
      policy: one_factor

session:
  name: authelia_session
  secret: another_long_random_string_at_least_64_characters
  expiration: 1h
  inactivity: 5m

regulation:
  max_retries: 5
  find_time: 2m
  ban_time: 5m

storage:
  local:
    path: /config/db.sqlite3

notifier:
  filesystem:
    filename: /config/notifications.yml

Step 3: Create Users

Create ./config/users.yml with your team accounts. Generate password hashes using the Authelia command:

docker compose exec authelia authelia crypto hash generate argon2

Example users.yml:

users:
  admin:
    disabled: false
    displayname: "Admin"
    password: "$argon2id$v=19$m=65536,t=1,p=8$..."
    email: admin@yourdomain.com
    groups:
      - admins
  staff:
    disabled: false
    displayname: "Staff Member"
    password: "$argon2id$v=19$m=65536,t=1,p=8$..."
    email: staff@yourdomain.com
    groups:
      - users

Step 4: Configure Nginx Proxy Manager

For each protected application, add these custom Nginx configuration lines in the Advanced tab of Nginx Proxy Manager:

location /authelia {
  internal;
  proxy_pass http://authelia:9091/api/verify;
  proxy_set_header Content-Length "";
  proxy_pass_request_body off;
  proxy_set_header X-Forwarded-URI $request_uri;
  proxy_set_header X-Forwarded-Method $request_method;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
}

location / {
  auth_request /authelia;
  auth_request_set $target_url $scheme://$http_host$request_uri;
  proxy_set_header Remote-User $http_remote_user;
  proxy_set_header Remote-Groups $http_remote_groups;
  proxy_pass http://application:port;
}

Create a proxy host in NPM for auth.yourdomain.com pointing to authelia:9091. Request SSL and enable Force SSL. Your authentication portal is now available at https://auth.yourdomain.com.

Step 5: Enable Two-Factor Authentication

In the Authelia configuration, enable TOTP globally:

access_control:
  default_policy: deny
  rules:
    - domain: "auth.yourdomain.com"
      policy: bypass
    - domain: "vault.yourdomain.com"
      policy: two_factor
    - domain: "*.yourdomain.com"
      policy: one_factor

This configuration requires two-factor authentication for your password manager and single-factor for everything else. Users enroll their TOTP device on first login.

If configuring authentication servers is not in your job description, VPS1 deploys Authelia with SSO, 2FA, and group-based access control. Your team gets one login for everything. You get the assurance that when someone leaves, they leave completely.